{"id":"CVE-2026-95962","kind":"vulnerability","aliases":["CVE-2026-95962"],"related":[],"title":"Windows Virtual Filtering Platform (VFP): remote code execution via use-after-free","description":"Use after free in Windows Virtual Filtering Platform (VFP) allows an unauthorized attacker to execute code over a network.","summary":"Microsoft's November 2026 update guide lists a use-after-free in the Windows Virtual Filtering Platform (VFP). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and run code on the target. Exploitation requires winning a race condition (attack complexity high). Microsoft rates it Important (CVSS 9.0), 'Exploitation Less Likely', not publicly disclosed and not exploited at publication.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hyper-v","infrastructure","network","pre-auth","windows"],"not_affected_if":[],"how_to_check":"Microsoft's entry does not list affected builds or KB numbers yet. Run winver (or Get-HotFix) on Windows hosts, especially Hyper-V and virtual-switch hosts, and compare the build against the November 2026 Patch Tuesday cumulative update for your Windows version in the Security Update Guide entry for CVE-2026-95962. Install the November 2026 cumulative update.","fix":null,"status":"open","published_at":"2026-11-10T19:21:51+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","triaged_at":"2026-11-10T19:25:49+00:00","updated_at":"2026-11-10T19:27:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:25:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows: use-after-free in Virtual Filtering Platform allows remote code execution","impact":"high","summary":"Windows Virtual Filtering Platform, the networking component that filters virtual switch traffic, has a use-after-free memory flaw. An unauthorized attacker on the network can run code on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code remotely on the Windows host","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95962 to confirm affected Windows builds, the fixed update, and whether exploitation needs a specific configuration.","how_to_check":"- Check the Windows build with `winver` and compare it against the Microsoft security update guide entry for CVE-2026-95962\n- unknown for other checks; the sources do not say which Windows versions are affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Machines running Windows with the Virtual Filtering Platform component, typically Hyper-V and virtual switch hosts. The sources do not say which versions or configurations are affected, so the exact scope is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000703,"input_tokens":4501,"output_tokens":505,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Update Guide entry for CVE-2026-95962 to confirm affected Windows builds, the fixed update, and whether exploitation needs a specific configuration.","search":"'-2026':15A,18A '-95962':16A,19A '2026':32B '9.0':84B 'affect':59B 'allow':105C 'attack':50B,76B,108C 'auth':27B 'code':7A,66B,111C 'complex':77B 'condit':75B 'could':51B 'craft':55B 'cve':14A,17A 'cvss':83B 'disclos':90B 'execut':8A,110C 'exploit':70B,85B,93B 'filter':3A,45B,102C 'free':13A,40B,98C 'guid':34B 'high':78B 'hyper':21B 'hyper-v':20B 'import':82B 'infrastructur':23B 'less':86B 'like':87B 'list':35B 'microsoft':29B,79B 'network':24B,63B,114C 'novemb':31B 'packet':56B 'platform':4A,46B,103C 'pre':26B 'pre-auth':25B 'public':89B,95B 'race':74B 'rate':80B 'remot':6A 'requir':71B 'run':65B 'send':52B 'servic':60B 'special':54B 'target':69B 'unauthent':49B 'unauthor':107C 'updat':33B 'use':11A,38B,96C 'use-after-fre':10A,37B 'v':22B 'vfp':5A,47B,104C 'via':9A 'virtual':2A,44B,101C 'win':72B 'window':1A,28B,43B,100C","nicknames":[],"mitigations":[],"who_affected":"Windows machines that use the Virtual Filtering Platform, which is the virtual switch layer used by Hyper-V and host networking. Microsoft's entry does not name products or builds, so the exact scope is unknown. Teams without Hyper-V or virtual switch hosts probably can skip it, but this is not confirmed by Microsoft.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","hyperv","infrastructure","network","preauth","windows"],"campaign_type":null,"search_a":"'-2026':15A,18A '-95962':16A,19A 'code':7A 'cve':14A,17A 'execut':8A 'filter':3A 'free':13A 'platform':4A 'remot':6A 'use':11A 'use-after-fre':10A 'vfp':5A 'via':9A 'virtual':2A 'window':1A","search_b":"'2026':32B '9.0':84B 'affect':59B 'attack':50B,76B 'auth':27B 'code':66B 'complex':77B 'condit':75B 'could':51B 'craft':55B 'cvss':83B 'disclos':90B 'exploit':70B,85B,93B 'filter':45B 'free':40B 'guid':34B 'high':78B 'hyper':21B 'hyper-v':20B 'import':82B 'infrastructur':23B 'less':86B 'like':87B 'list':35B 'microsoft':29B,79B 'network':24B,63B 'novemb':31B 'packet':56B 'platform':46B 'pre':26B 'pre-auth':25B 'public':89B,95B 'race':74B 'rate':80B 'requir':71B 'run':65B 'send':52B 'servic':60B 'special':54B 'target':69B 'unauthent':49B 'updat':33B 'use':38B 'use-after-fre':37B 'v':22B 'vfp':47B 'virtual':44B 'win':72B 'window':28B,43B","search_c":"'allow':105C 'attack':108C 'code':111C 'execut':110C 'filter':102C 'free':98C 'network':114C 'platform':103C 'unauthor':107C 'use':96C 'vfp':104C 'virtual':101C 'window':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95962","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95962","severity":null,"published_at":"2026-11-10T19:21:51+00:00","modified_at":"2026-11-10T19:21:52+00:00","first_seen_at":"2026-11-10T19:25:25+00:00","fetched_at":"2026-11-10T19:25:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95962:2504","url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95962","severity":null,"published_at":"2026-11-10T19:27:05+00:00","modified_at":"2026-11-10T19:27:05+00:00","first_seen_at":"2026-11-10T19:27:05+00:00","fetched_at":"2026-11-10T19:27:05+00:00","note":"Read MSRC Security Update Guide API entry (published 2026-11-10): Important, CVSS 9.0 (temporal 7.8), not exploited, not publicly disclosed, 'Exploitation Less Likely', AC:H race condition. Entry lists no products, builds or KB numbers, so fix/affected builds unknown; MSRC page is JS-only. Revisit when the Nov 2026 release notes list KBs. X not checked, no public discussion expected.","cites":["https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95962"]}],"documents":[{"id":117532,"url":"https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-95962","title":"MSRC Security Update Guide: CVE-2026-95962 (VFP RCE)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}