{"id":"CVE-2026-113825","kind":"vulnerability","aliases":["CVE-2026-113825"],"related":[],"title":"Windows SMB Server (srvnet.sys) race condition allows remote code execution by an authenticated attacker","description":"Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network.","summary":"A race condition in the Windows SMB Server network transport driver (srvnet.sys) lets an authorized attacker execute code over the network. The sources describe it only at this level, with no affected version range or fix listed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Server 2025","fixed":["10.0.26100.33822"],"affected":"< 10.0.26100.33822","ecosystem":"vendor"},{"name":"Windows Server 2022","fixed":["10.0.20348.5870"],"affected":"< 10.0.20348.5870","ecosystem":"vendor"},{"name":"Windows Server 2019","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"},{"name":"Windows 11 25H2","fixed":["10.0.26200.9974"],"affected":"< 10.0.26200.9974","ecosystem":"vendor"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":"< 10.0.26100.9974","ecosystem":"vendor"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":"< 10.0.22631.7711","ecosystem":"vendor"},{"name":"Windows 11 26H1","fixed":["10.0.28000.3501"],"affected":"< 10.0.28000.3501","ecosystem":"vendor"},{"name":"Windows 11 26H2","fixed":["10.0.26300.9974"],"affected":"< 10.0.26300.9974","ecosystem":"vendor"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":"< 10.0.19045.7846","ecosystem":"vendor"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":"< 10.0.19044.7846","ecosystem":"vendor"},{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":"< 10.0.17763.9487","ecosystem":"vendor"}],"ecosystems":[],"tags":["file-server","infrastructure","on-prem","server","smb","windows"],"not_affected_if":["patched-build","smb-server-disabled"],"how_to_check":"Run winver or (Get-ComputerInfo).OsBuildNumber / [System.Environment]::OSVersion and compare the full build (e.g. 10.0.20348.x) with the fixed build for your release. Lower means unpatched. Highest priority: machines that serve SMB shares (file servers, Server 2019/2022/2025). Whether the flaw needs the SMB server to be enabled is not yet confirmed.","fix":"Install the November 2026 Windows cumulative update that brings your build to at least: Win10 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974; Win11 25H2 10.0.26200.9974; Win11 26H1 10.0.28000.3501; Win11 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. KB numbers not confirmed.","status":"open","published_at":"2026-11-10T19:19:04+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:45:04+00:00","updated_at":"2026-11-10T23:51:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:45:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows SMB Server: race condition lets an authorized attacker run code","impact":"high","summary":"A race condition in the Windows SMB Server network transport driver (srvnet.sys) lets an authorized attacker execute code over the network. The sources describe it only at this level, with no affected version range or fix listed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","smb","file-server"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs code on the server over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-113825 to confirm affected Windows builds, the fixed update, and whether SMB server must be enabled.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines acting as SMB file servers are the likely exposure, since the flaw sits in the server-side network transport driver. The sources do not list affected Windows versions or confirm whether client-only machines are safe, so unknown beyond that.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000678,"input_tokens":4518,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-113825 to confirm affected Windows builds, the fixed update, and whether SMB server must be enabled.","search":"'-113825':17A,20A '-2026':16A,19A '10':46A,49A,52A '11':31A,34A,37A,40A,43A '1809':53A '2019':29A '2022':26A '2025':23A '21h2':50A '22h2':47A '23h2':38A '24h2':35A '25h2':32A '26h1':41A '26h2':44A 'affect':95B 'allow':7A,119C 'attack':14A,79B,122C 'authent':13A 'author':78B,121C 'code':9A,81B,125C 'concurr':101C 'condit':6A,66B,110C 'cve':15A,18A 'describ':87B 'driver':74B,117C 'execut':10A,80B,102C,124C 'file':55B 'file-serv':54B 'fix':99B 'improp':107C 'infrastructur':57B 'let':76B 'level':92B 'list':100B 'network':72B,84B,115C,128C 'on-prem':58B 'prem':60B 'race':5A,65B,109C 'rang':97B 'remot':8A 'resourc':105C 'server':3A,22A,25A,28A,56B,61B,71B,114C 'share':104C 'smb':2A,62B,70B,113C 'sourc':86B 'srvnet.sys':4A,75B,118C 'synchron':108C 'transport':73B,116C 'use':103C 'version':96B 'window':1A,63B,69B,112C 'windows':21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A","nicknames":[],"mitigations":[],"who_affected":"Windows machines that run the SMB server service (file servers and any host sharing folders) on Windows 10, Windows 11 and Windows Server 2019/2022/2025 builds below the fixed ones are the exposure. The attacker needs valid low-privilege credentials and must win a race (high complexity), per the CVSS vector. Hosts with SMB server disabled or not reachable on port 445 are likely lower risk, but Microsoft's page was not read to confirm.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","1125h2","1126h1","1126h2","server2019","server2022","server2025","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2","windows1125h2","windows1126h1","windows1126h2","windowsserver2019","windowsserver2022","windowsserver2025"],"ptokens":["10","11","1809","2019","2022","2025","21h2","22h2","23h2","24h2","25h2","26h1","26h2","server","windows"],"labels":["fileserver","high","infrastructure","onprem","server","smb","windows"],"campaign_type":null,"search_a":"'-113825':17A,20A '-2026':16A,19A '10':46A,49A,52A '11':31A,34A,37A,40A,43A '1809':53A '2019':29A '2022':26A '2025':23A '21h2':50A '22h2':47A '23h2':38A '24h2':35A '25h2':32A '26h1':41A '26h2':44A 'allow':7A 'attack':14A 'authent':13A 'code':9A 'condit':6A 'cve':15A,18A 'execut':10A 'race':5A 'remot':8A 'server':3A,22A,25A,28A 'smb':2A 'srvnet.sys':4A 'window':1A 'windows':21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A","search_b":"'affect':95B 'attack':79B 'author':78B 'code':81B 'condit':66B 'describ':87B 'driver':74B 'execut':80B 'file':55B 'file-serv':54B 'fix':99B 'infrastructur':57B 'let':76B 'level':92B 'list':100B 'network':72B,84B 'on-prem':58B 'prem':60B 'race':65B 'rang':97B 'server':56B,61B,71B 'smb':62B,70B 'sourc':86B 'srvnet.sys':75B 'transport':73B 'version':96B 'window':63B,69B","search_c":"'allow':119C 'attack':122C 'author':121C 'code':125C 'concurr':101C 'condit':110C 'driver':117C 'execut':102C,124C 'improp':107C 'network':115C,128C 'race':109C 'resourc':105C 'server':114C 'share':104C 'smb':113C 'srvnet.sys':118C 'synchron':108C 'transport':116C 'use':103C 'window':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113825","severity":null,"published_at":"2026-11-10T19:19:04+00:00","modified_at":"2026-11-10T19:19:04+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113825:3242","url":"https://app.opencve.io/cve/CVE-2026-113825","severity":null,"published_at":"2026-11-10T23:51:35+00:00","modified_at":"2026-11-10T23:51:35+00:00","first_seen_at":"2026-11-10T23:51:35+00:00","fetched_at":"2026-11-10T23:51:35+00:00","note":"MSRC page is JS-only and unreadable here; affected builds taken from Microsoft CNA data as mirrored by OpenCVE. Nothing verified. KB numbers, SMB-enabled requirement and workarounds unknown; no exploitation or PoC found.","cites":["https://app.opencve.io/cve/CVE-2026-113825","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113825"]}],"documents":[{"id":120474,"url":"https://app.opencve.io/cve/CVE-2026-113825","title":"OpenCVE: CVE-2026-113825 (mirrors Microsoft CNA record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120476,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-113825","title":"MSRC: Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability (referenced by CVE record; page is JS-only, not read)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}