CVE-2022-26809: Microsoft Windows RPC Runtime remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction vector and very high EPSS make this a top remediation priority despite no KEV listing.

What it is

The Windows Remote Procedure Call (RPC) runtime contains a remote code execution flaw. A network-reachable RPC endpoint can be driven to execute attacker-controlled code, and because RPC is a core Windows service the exposure is broad across client and server editions.

Impact

An unauthenticated remote attacker can execute arbitrary code in the context of the RPC service, typically leading to full system compromise.

Attack surface

Reached over the network via the RPC runtime (CVSS vector AV:N/PR:N/UI:N), so no authentication or user interaction is required. Any host exposing RPC endpoints is potentially reachable.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.90961, 99.8th percentile), indicating elevated likelihood of exploitation activity. The two references are Microsoft advisories with no exploit tags.

What to do

• Apply the Microsoft security update for CVE-2022-26809 on all affected Windows versions as the first action.
• Restrict RPC traffic at network boundaries and between segments; block TCP 135 and related RPC ports where not required.
• Enable Windows Firewall rules and network filtering to limit which hosts can reach RPC endpoints.
• Monitor Microsoft advisories for updated guidance and any revised affected-version list.

Detection

• Monitor for unexpected RPC traffic to TCP 135 and dynamic RPC ports from untrusted sources.
• Alert on RPC service crashes or restarts (Event ID 1000/1001, service control events) that may indicate exploitation attempts.
• Watch for anomalous child processes spawned by RPC-related services (e.g., svchost.exe hosting RPC).
• Correlate network IDS signatures for RPC runtime exploitation with host process creation events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.