CVE-2026-72949Important

Windows SMB Server Network Transport Driver (srvnet.sys) Denial of Service Vulnerability

Assessment

Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network.

Severity: Important
CVSS base score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
Impact: Denial of Service
EPSS, next 30 days: 1.2%Higher than 66.2% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation Less Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows SMB Server Network Transport Driver (srvnet.sys)
Weakness: CWE-476: NULL Pointer Dereference
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 8 Sep 2026

5 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122871	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5122871
KB5122880	Security Update	Required	Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems	All CVEs in KB5122880
KB5122882	Security Update	Required	Windows Server 2022, Windows Server 2022 (Server Core installation)	All CVEs in KB5122882
KB5124008	Security Update	Required	Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems and 1 more	All CVEs in KB5124008
KB5124012	Security Update	Required	Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems	All CVEs in KB5124012

Windows

12 affected products