OVERSEER NOTE: Detected in the wild since early April, CVE-2026-28901 represents a critical failure in the Windows Kernel memory management subsystem. This isn’t just another bug; it is a “force multiplier” for ransomware groups. An attacker with standard user access can leverage this flaw to instantly claim SYSTEM privileges, effectively turning a local breach into a total domain collapse.
The Exploit: Memory Corruption
This vulnerability is an “Integer Overflow” that leads to a heap-based buffer overflow within ntoskrnl.exe.
- The Trigger: A malicious application passes a specifically crafted I/O request packet (IRP) to the kernel.
- The Result: The kernel miscalculates the memory buffer size, allowing the attacker to overwrite adjacent kernel memory with arbitrary code.
- The Payload: Once the overwrite is successful, the attacker’s code runs with the highest possible permissions, bypassing all user-mode security boundaries (UAC, AppLocker, etc.).
Remediation Protocol
There are no configuration-based workarounds for a kernel-level memory corruption. The only solution is the binary replacement provided in the April 2026 Cumulative Update.
- Deploy KB5079466 (Win 11) / KB5079471 (Win 10): This update replaces the vulnerable
ntoskrnl.exewith version 10.0.22621.4320 (or higher). - Reboot Mandatory: Because the kernel is the core of the OS, the fix cannot be “hotpatched” without a full system restart to reload the patched image into memory.
Verification: Auditing the Fleet
To ensure your terminals are secured against the breach, use the following PowerShell command to check the version of your kernel binary:
(Get-Item "$env:windir\System32\ntoskrnl.exe").VersionInfo.FileVersion
- Vulnerable: Anything lower than 10.0.22621.4320 (for 24H2) or 10.0.19045.5480 (for Win 10 22H2).
- Secured: Version numbers matching or exceeding the April 2026 baseline.
VIGILANCE NOTE: Cyber-intelligence suggests that Initial Access Brokers (IABs) are already selling automated “one-click” exploit kits for this CVE. If you have unpatched machines exposed via RDP or used by high-risk users, assume the breach has already occurred and initiate a full credential reset post-patching.