CVE-2022-26809

CVE-2022-26809 is a critical Remote Procedure Call Runtime Remote Code Execution vulnerability affecting numerous Microsoft Windows versions, including Windows 10, 11, and various server editions. With a CVSS score of 9.8, it allows unauthenticated attackers to execute arbitrary code remotely over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, its high EPSS score (0.92562) and FAUCET Risk Score (99/100) indicate a significant likelihood of exploitation. Although no public exploit code is currently available on Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered substantial community discussion and media coverage, with articles highlighting its critical nature and potential for wormable attacks, urging immediate patching.