Loading vulnerability…
Microsoft Windows Search Unauthenticated Remote Code Execution
CVE-2026-116928 is a critical out-of-bounds write vulnerability in the Microsoft Windows Search Component that permits unauthenticated remote code execution. An attacker can reach the vulnerable component through Microsoft Exchange Server by sending an email containing a specially crafted attachment. Exchange automatically processes the attachment for search indexing, triggering the vulnerability without the recipient opening the email or attachment. Successful exploitation executes attacker-controlled code with the permissions of the affected processing service. The vulnerability has a CVSS v3.1 base score of 9.8 and affects multiple Windows client and server releases.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the affected indexing-service security context, with potentially high impacts on confidentiality, integrity, and availability. Attacker-controlled code can access or modify resources available to that service and disrupt processing on the affected system. The execution privileges are those of the affected processing service; SYSTEM-level execution is not established. Microsoft reported no exploitation at original publication and assessed exploitation as less likely.
If you can’t patch tonight, do this now.
No vulnerability-specific interim mitigation or workaround is identified. Consult the Microsoft Security Response Center Security Update Guide for any vendor-supported workarounds and installation guidance.
Patch, then assume compromise.
Install the applicable November 2026 Microsoft Windows security update or a superseding update for the affected release and architecture. Updating Exchange alone does not resolve the underlying Windows Search vulnerability. Fixed build thresholds are: Windows 10 version 1607 and Windows Server 2016, 10.0.14393.9688; Windows 10 version 1809 and Windows Server 2019, 10.0.17763.9487; Windows 10 version 21H2, 10.0.19044.7846; Windows 10 version 22H2, 10.0.19045.7846; Windows 11 version 23H2, 10.0.22631.7711; Windows 11 version 24H2, 10.0.26100.9974; Windows 11 version 25H2, 10.0.26200.9974; Windows 11 version 26H1, 10.0.28000.3501; Windows 11 version 26H2, 10.0.26300.9974; Windows Server 2022, 10.0.20348.5870; and Windows Server 2025, 10.0.26100.33822. Confirm update applicability through Microsoft's per-CVE guidance, complete any required restart, and verify the installed build.
No public exploits tracked yet. Mallory keeps watching.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.