CVE-2026-113862CriticalRCENetwork

Windows Network Address Translation (NAT) Remote Code Execution Vulnerability

No KEV listing collectedCVSS 8.1Fixed by KB5131077 Fixed by KB5131080 Fixed by KB5131085 All 10 fixes

MSRC advisory NVD CVE.org

Assessment

Use after free in Windows Network Address Translation (NAT) allows an unauthorized attacker to execute code over a network.

Severity: Critical
CVSS base score: 8.1
Impact: Remote Code Execution
Exploitation detected: No known exploitation (MSRC assessment)
Exploitability: Exploitation More Likely
Publicly disclosed: No (MSRC assessment)
EPSS · 30-day forecast: 0.9%FIRST forecast dated 15 Nov 2026, for the following 30 days · FIRST percentile 60% · about EPSS
Customer action: Required: follow the MSRC remediation guidance

More details

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Public detection template: No Nuclei template is listed in the current collected catalog
Component: Windows Network Address Translation (NAT)
Weakness: CWE-416: Use After Free
Issued by: Microsoft
Published: 10 Nov 2026 · November 2026
Last revised: 10 Nov 2026

CVSS 3.1 base metricsRed raises the risk · green lowers it

Attack vector: NetworkAV:N
Attack complexity: HighAC:H
Privileges required: NonePR:N
User interaction: NoneUI:N
Scope: UnchangedS:U
Confidentiality: HighC:H
Integrity: HighI:H
Availability: HighA:H

Updates that fix it

10 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5131077	Security Update	—	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5131077
KB5131080	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5131080
KB5131085	Security Update	Required	Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019 and 1 more	All CVEs in KB5131085
KB5131087	Security Update	Required	Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5131087
KB5131090	Security Update	Required	Windows Server 2022, Windows Server 2022 (Server Core installation)	All CVEs in KB5131090
KB5131096	Security Update	Required	Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems and 3 more	All CVEs in KB5131096
KB5131291	Security Update	Required	Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2016 and 1 more	All CVEs in KB5131291
KB5132043	Security Update	—	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more	All CVEs in KB5132043
KB5132059	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5132059
KB5132061	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 3 more	All CVEs in KB5132061

Affected products

ESU, Windows

28 affected products

Independent patch analysis

Cisco Talos Intelligence

Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilities · 11 Nov 2026

Talos supplies analysis and cycle-level Snort rule references. Its article does not map each rule to a CVE or establish protection for your deployment. MSRC remains the source for vulnerability and fixing-update facts.

What changed

Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
13 Nov 2026 · 12:10:20 UTC
Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
13 Nov 2026 · 11:07:20 UTC

Page history

Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.

Cite this version

Field-level log (13)

Up to 100 recent field edits are shown; older edits may be outside retention.

15 Nov 2026 · 14:51:01 UTC EPSS0.9%; scored 14 Nov 2026 → 0.9%; scored 15 Nov 2026
14 Nov 2026 · 16:42:18 UTC EPSS0.9%; scored 13 Nov 2026 → 0.9%; scored 14 Nov 2026
13 Nov 2026 · 21:41:21 UTC EPSS0.9%; scored 12 Nov 2026 → 0.9%; scored 13 Nov 2026
13 Nov 2026 · 12:10:20 UTC Public detection templateUnknown: detection-template evidence is incomplete or retained → No Nuclei template listed
13 Nov 2026 · 12:10:20 UTC Source coverage: public-exploit-codeIncomplete → Current
13 Nov 2026 · 12:10:20 UTC Source coverage: first-epssIncomplete → Current
13 Nov 2026 · 12:10:20 UTC Source coverage: msrc-cvrfIncomplete → Current
13 Nov 2026 · 11:07:20 UTC Public detection templateNo Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
13 Nov 2026 · 11:07:20 UTC Source coverage: public-exploit-codeCurrent → Incomplete
13 Nov 2026 · 11:07:20 UTC Source coverage: first-epssCurrent → Incomplete
13 Nov 2026 · 11:07:20 UTC Source coverage: msrc-cvrfCurrent → Incomplete
13 Nov 2026 · 02:00:04 UTC EPSSNo EPSS score collected → 0.9%; scored 12 Nov 2026
11 Nov 2026 · 02:39:52 UTC Link: Cisco Talos analysishttps://blog.talosintelligence.com/microsoft-patch-tuesday-for-november-2026

Explore global source statements, affected packages and advisory history for CVE-2026-113862. The catalog has a separate collection scope from Microsoft release records.

More advisories, affected versions and source history

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Risk history

Compare earlier KEV listings and EPSS scores. Advisory wording and affected versions have a separate history.

When does an EPSS score appear as a change?

A prediction change is reported when EPSS rises from below 10% to 10% or higher. Every daily score change from the last 30 days stays in this history. Before that, it keeps KEV changes and moves between EPSS bands (0.1%, 1%, 5%, 10%, 20%, 50% and 90%).

Advisory history

9 saved versions

See how the publisher's advisory changed over time. Each link opens the version saved at that time. The publisher's update date can differ from the date shown here.

How advisory history works

Each link identifies one complete publisher record. History can include advisories that previously shared an identifier; an identifier removed by a publisher no longer establishes a current relationship. A historical link shows only that record and earlier saved versions. Failed checks and unchanged reads do not create new versions.

13 Nov 2026 19:56:54 UTC