CVE-2026-62815: Microsoft QUIC Remote Code Execution Vulnerability
CVE-2026-62815 is a remote code execution vulnerability in Microsoft QUIC, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.97% probability of exploitation activity in the next 30 days, higher than 62% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 8 security updates (KB5120242, KB5120229, KB5120233, KB5120228 and more). It affects 12 products in 1 product family (Windows).
Key facts
- CVE ID
- CVE-2026-62815
- Severity
- Critical CVSS 9.8
- Microsoft severity
- Critical
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-416
- EPSS
- 0.97% (percentile 62%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Windows
From the August 2026 Patch Tuesday briefing
Microsoft QUIC Remote Code Execution
This vulnerability affects Microsoft’s QUIC implementation and can allow remote code execution in scenarios where QUIC is enabled and reachable. In practical terms, this is a risk for systems using QUIC-enabled services where an attacker can send crafted network traffic to trigger compromise. This Critical RCE in Microsoft QUIC carries CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is a CWE-416 (Use After Free) memory corruption issue. The vector translates to a worst-case scenario: network-reachable, unauthenticated, no user interaction. Any Windows system exposing QUIC-enabled services (or where QUIC is reachable as part of application stacks using it) becomes a candidate for pre-auth remote code execution.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-62815 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..
Affected products (12)
Windows
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Windows Server 2022 | KB5120242 KB5120229 | Security Update Security Hotpatch Update | 10.0.20348.5499 10.0.20348.5440 | Yes Yes |
| Windows Server 2022 (Server Core installation) | KB5120242 KB5120229 | Security Update Security Hotpatch Update | 10.0.20348.5499 10.0.20348.5440 | Yes Yes |
| Windows Server 2025 (Server Core installation) | KB5120233 KB5120228 | Security Update Security Hotpatch Update | 10.0.26100.33296 10.0.26100.33222 | Yes Yes |
| Windows 11 Version 25H2 for ARM64-based Systems | KB5121003 KB5120994 | Security Update Security Hotpatch Update | 10.0.26200.9168 10.0.26200.9106 | Yes Yes |
| Windows 11 Version 25H2 for x64-based Systems | KB5121003 KB5120994 | Security Update Security Hotpatch Update | 10.0.26200.9168 10.0.26200.9106 | Yes Yes |
| Windows 11 Version 23H2 for ARM64-based Systems | KB5120240 | Security Update | 10.0.22631.7517 | Yes |
| Windows 11 Version 23H2 for x64-based Systems | KB5120240 | Security Update | 10.0.22631.7517 | Yes |
| Windows 11 Version 24H2 for ARM64-based Systems | ||||
| Windows 11 Version 24H2 for x64-based Systems | ||||
| Windows Server 2025 | KB5120233 KB5120228 | Security Update Security Hotpatch Update | 10.0.26100.33296 10.0.26100.33222 | Yes Yes |
| Windows 11 version 26H1 for x64-based Systems | KB5121000 | Security Update | 10.0.28000.2704 | Yes |
| Windows 11 Version 26H1 for ARM64-based Systems | KB5121000 | Security Update | 10.0.28000.2704 | Yes |
Security updates (8)
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.8 (CRITICAL)
- NVD weakness
- CWE-416
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| windows 11 23h2 (arm64) | before 10.0.22631.7517 |
| windows 11 23h2 (x64) | before 10.0.22631.7517 |
| windows 11 24h2 (arm64) | before 10.0.26100.9106 |
| windows 11 24h2 (x64) | before 10.0.26100.9106 |
| windows 11 25h2 (arm64) | before 10.0.26200.9106 |
| windows 11 25h2 (x64) | before 10.0.26200.9106 |
| windows 11 26h1 (arm64) | before 10.0.28000.2704 |
| windows 11 26h1 (x64) | before 10.0.28000.2704 |
| windows server 2022 | before 10.0.20348.5440 |
| windows server 2025 | before 10.0.26100.33222 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815 (Vendor Advisory, Patch)
Acknowledgments
- pwn2addr
- Damian Regulski
- Quac Tran
- AIフィジカルインターフェイス二号機
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 1.1 | Updated an acknowledgement. This is an informational change only. |