{"id":"CVE-2026-88212","kind":"vulnerability","aliases":["CVE-2026-88212"],"related":[],"title":"Windows NAT: use-after-free lets an adjacent-network attacker run code","description":"Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over an adjacent network.","summary":"A use-after-free flaw in the Windows Network Address Translation component lets an unauthorized attacker on the same network segment run code. NVD rates it high with a CVSS score of 7.5.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Network Address Translation (NAT)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","network-address-translation","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:21:27+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","triaged_at":"2026-11-10T19:42:59+00:00","updated_at":"2026-11-10T19:42:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:42:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows NAT: use-after-free lets an adjacent-network attacker run code","impact":"high","summary":"A use-after-free flaw in the Windows Network Address Translation component lets an unauthorized attacker on the same network segment run code. NVD rates it high with a CVSS score of 7.5.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","network-address-translation"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the Windows host from the adjacent network.","analyst_note":"Confirm affected Windows builds, whether NAT must be enabled, and the Microsoft security update that fixes CVE-2026-88212, from the Microsoft Security Response Center advisory.","how_to_check":"- unknown","plain_action":"","product_name":"Windows Network Address Translation (NAT)","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running Windows with the Network Address Translation component are the ones to look at. The sources do not say which Windows versions or configurations are affected, or whether NAT must be enabled for exposure.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4496,"output_tokens":470,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Confirm affected Windows builds, whether NAT must be enabled, and the Microsoft security update that fixes CVE-2026-88212, from the Microsoft Security Response Center advisory.","search":"'-2026':16A,19A '-88212':17A,20A '7.5':65B 'address':23A,29B,42B,72C 'adjac':10A,84C 'adjacent-network':9A 'allow':75C 'attack':12A,48B,78C 'code':14A,55B,81C 'compon':44B 'cve':15A,18A 'cvss':62B 'execut':80C 'flaw':37B 'free':6A,36B,68C 'high':59B 'infrastructur':26B 'let':7A,45B 'nat':2A,25A,74C 'network':11A,22A,28B,41B,52B,71C,85C 'network-address-transl':27B 'nvd':56B 'rate':57B 'run':13A,54B 'score':63B 'segment':53B 'translat':30B,43B,73C 'translation':24A 'unauthor':47B,77C 'use':4A,34B,66C 'use-after-fre':3A,33B 'window':1A,31B,40B,70C 'windows':21A","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows with the Network Address Translation component are the ones to look at. The sources do not say which Windows versions or configurations are affected, or whether NAT must be enabled for exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["networkaddresstranslationnat","windowsnetworkaddresstranslationnat"],"ptokens":["address","nat","network","translation","windows"],"labels":["high","infrastructure","networkaddresstranslation","vendor","windows"],"campaign_type":null,"search_a":"'-2026':16A,19A '-88212':17A,20A 'address':23A 'adjac':10A 'adjacent-network':9A 'attack':12A 'code':14A 'cve':15A,18A 'free':6A 'let':7A 'nat':2A,25A 'network':11A,22A 'run':13A 'translation':24A 'use':4A 'use-after-fre':3A 'window':1A 'windows':21A","search_b":"'7.5':65B 'address':29B,42B 'attack':48B 'code':55B 'compon':44B 'cvss':62B 'flaw':37B 'free':36B 'high':59B 'infrastructur':26B 'let':45B 'network':28B,41B,52B 'network-address-transl':27B 'nvd':56B 'rate':57B 'run':54B 'score':63B 'segment':53B 'translat':30B,43B 'unauthor':47B 'use':34B 'use-after-fre':33B 'window':31B,40B","search_c":"'address':72C 'adjac':84C 'allow':75C 'attack':78C 'code':81C 'execut':80C 'free':68C 'nat':74C 'network':71C,85C 'translat':73C 'unauthor':77C 'use':66C 'window':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-88212","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88212","severity":null,"published_at":"2026-11-10T19:21:27+00:00","modified_at":"2026-11-10T19:21:27+00:00","first_seen_at":"2026-11-10T19:25:19+00:00","fetched_at":"2026-11-10T19:25:19+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}