{"id":"CVE-2026-113862","kind":"vulnerability","aliases":["CVE-2026-113862"],"related":[],"title":"Windows NAT: use-after-free lets an unauthorized attacker run code over network","description":"Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.","summary":"A use-after-free in the Windows Network Address Translation (NAT) component lets an unauthenticated attacker run code over the network (CVSS 8.1, high attack complexity). Per secondary write-ups (Action1, Mallory) it was fixed in Microsoft's November 2026 Patch Tuesday, is not known to be exploited and has no public proof of concept; Microsoft rates exploitation more likely. Affected builds and the exact KB for this CVE are not yet confirmed from Microsoft's own page.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","nat","network-gateway","windows"],"not_affected_if":[],"how_to_check":"Unknown until the MSRC entry is read. Likely check: whether a Windows host or server runs NAT (e.g. Routing and Remote Access/NAT, Internet Connection Sharing, Hyper-V/container NAT) and whether the November 2026 cumulative update (10 Nov 2026) is installed.","fix":"Install the November 2026 Windows cumulative update (released 10 Nov 2026). The exact KB per Windows version for this CVE is not confirmed from Microsoft.","status":"open","published_at":"2026-11-10T19:19:06+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","triaged_at":"2026-11-10T19:35:58+00:00","updated_at":"2026-11-10T23:47:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:35:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows NAT: use-after-free lets an unauthorized attacker run code over network","impact":"high","summary":"A memory bug (use after free) in the Windows Network Address Translation component lets an unauthenticated attacker on the network run code on the affected machine. The sources give a CVSS score of 8.1 and do not describe a fix or a trigger condition beyond that.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","network-gateway"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows machine over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-113862 to get affected Windows builds, whether NAT must be enabled, and the patch.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Windows machines with the Network Address Translation component in use are the likely exposure, such as Windows hosts acting as a NAT gateway or sharing a connection. The sources do not state which Windows versions or configurations are affected. unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4492,"output_tokens":451,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-113862 to get affected Windows builds, whether NAT must be enabled, and the patch.","search":"'-113862':17A,20A '-2026':16A,19A '2026':68B '8.1':50B 'action1':59B 'address':36B,113C 'affect':89B 'allow':116C 'attack':10A,43B,52B,119C 'build':90B 'code':12A,45B,122C 'complex':53B 'compon':39B 'concept':83B 'confirm':101B 'cve':15A,18A,97B 'cvss':49B 'exact':93B 'execut':121C 'exploit':76B,86B 'fix':63B 'free':6A,31B,109C 'gateway':25B 'high':51B 'infrastructur':21B 'kb':94B 'known':73B 'let':7A,40B 'like':88B 'mallori':60B 'microsoft':65B,84B,103B 'nat':2A,22B,38B,115C 'network':14A,24B,35B,48B,112C,125C 'network-gateway':23B 'novemb':67B 'page':106B 'patch':69B 'per':54B 'proof':81B 'public':80B 'rate':85B 'run':11A,44B 'secondari':55B 'translat':37B,114C 'tuesday':70B 'unauthent':42B 'unauthor':9A,118C 'up':58B 'use':4A,29B,107C 'use-after-fre':3A,28B 'window':1A,26B,34B,111C 'write':57B 'write-up':56B 'yet':100B","nicknames":[],"mitigations":[],"who_affected":"Windows machines running the NAT component, such as hosts or servers acting as a NAT gateway or sharing a connection, are the likely exposure. Microsoft's affected-version list was not readable, so which Windows versions are affected is unconfirmed. Hosts without NAT enabled may be able to skip it, but that is not confirmed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","nat","networkgateway","windows"],"campaign_type":null,"search_a":"'-113862':17A,20A '-2026':16A,19A 'attack':10A 'code':12A 'cve':15A,18A 'free':6A 'let':7A 'nat':2A 'network':14A 'run':11A 'unauthor':9A 'use':4A 'use-after-fre':3A 'window':1A","search_b":"'2026':68B '8.1':50B 'action1':59B 'address':36B 'affect':89B 'attack':43B,52B 'build':90B 'code':45B 'complex':53B 'compon':39B 'concept':83B 'confirm':101B 'cve':97B 'cvss':49B 'exact':93B 'exploit':76B,86B 'fix':63B 'free':31B 'gateway':25B 'high':51B 'infrastructur':21B 'kb':94B 'known':73B 'let':40B 'like':88B 'mallori':60B 'microsoft':65B,84B,103B 'nat':22B,38B 'network':24B,35B,48B 'network-gateway':23B 'novemb':67B 'page':106B 'patch':69B 'per':54B 'proof':81B 'public':80B 'rate':85B 'run':44B 'secondari':55B 'translat':37B 'tuesday':70B 'unauthent':42B 'up':58B 'use':29B 'use-after-fre':28B 'window':26B,34B 'write':57B 'write-up':56B 'yet':100B","search_c":"'address':113C 'allow':116C 'attack':119C 'code':122C 'execut':121C 'free':109C 'nat':115C 'network':112C,125C 'translat':114C 'unauthor':118C 'use':107C 'window':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113862","severity":null,"published_at":"2026-11-10T19:19:06+00:00","modified_at":"2026-11-10T19:19:07+00:00","first_seen_at":"2026-11-10T19:24:43+00:00","fetched_at":"2026-11-10T19:24:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113862:3232","url":"https://www.action1.com/patch-tuesday/patch-tuesday-november-2026/","severity":null,"published_at":"2026-11-10T23:47:17+00:00","modified_at":"2026-11-10T23:47:17+00:00","first_seen_at":"2026-11-10T23:47:17+00:00","fetched_at":"2026-11-10T23:47:17+00:00","note":"MSRC page is JS-only and browser-cli is out of quota, so no primary Microsoft text was read; nothing verified. Secondary sources (Action1, Mallory): fixed in Nov 2026 Patch Tuesday, Microsoft rates exploitation more likely, not exploited, no public PoC, race condition per Mallory (unconfirmed). Builds/KBs and whether NAT must be enabled are still unknown. Revisit and read the MSRC entry.","cites":["https://www.action1.com/patch-tuesday/patch-tuesday-november-2026/","https://mallory.ai/vulnerabilities/CVE-2026-113862"]}],"documents":[{"id":120081,"url":"https://www.action1.com/patch-tuesday/patch-tuesday-november-2026/","title":"Patch Tuesday November 2026 (Action1)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120451,"url":"https://mallory.ai/vulnerabilities/CVE-2026-113862","title":"CVE-2026-113862 (Mallory)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}