{"id":"CVE-2026-56179","aliases":[],"cve":{"records":[{"id":"CVE-2026-56179","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-06-19T13:53:31.990Z","published":"2026-08-11T17:07:10.631Z","modified":"2026-10-30T17:22:56.284Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T17:22:56.284Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-08-13T13:44:18.451Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56179","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-346","description":"CWE-346: Origin Validation Error","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33296"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.26200.0","versionEndExcluding":"10.0.26200.9168"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.9168"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33296"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*","versionStartIncluding":"10.0.28000.0","versionEndExcluding":"10.0.28000.2704"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-08-13T13:44:03.878002Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Windows Network Address Translation (NAT) Spoofing Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.","score":8.3,"severity":"high","published":"2026-08-11T17:07:10.631Z","modified":"2026-10-30T17:22:56.284Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows 11 Version 24H2","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.9168","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"},{"vendor":"Microsoft","name":"Windows 11 Version 25H2","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.26200.0","status":"affected","lessThan":"10.0.26200.9168","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"},{"vendor":"Microsoft","name":"Windows 11 version 26H1","platforms":["ARM64-based Systems","x64-based Systems"],"versions":[{"version":"10.0.28000.0","status":"affected","lessThan":"10.0.28000.2704","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33296","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33296","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56179"],"sources":[{"name":"CVE","id":"CVE-2026-56179","modified":"2026-10-30T17:22:56.284Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","score":8.3}],"sourceAffected":[],"observedAt":"2026-10-30T18:29:52.209Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T00:45:31.953Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-29T01:35:35.824Z","attemptedAt":"2026-10-29T01:35:35.824Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-29T01:35:36.273Z","attemptedAt":"2026-10-29T01:35:36.273Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-29T01:35:36.285Z","attemptedAt":"2026-10-29T01:35:36.285Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-29T01:35:36.272Z","attemptedAt":"2026-10-29T01:35:36.272Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-56179","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56179","modified":"2026-08-13T14:17:01.747","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-29T01:35:35.824Z"},{"source":"FIRST EPSS","id":"CVE-2026-56179","url":"https://www.first.org/epss/","probability":0.00276,"percentile":0.19976,"date":"2026-10-28","checkedAt":"2026-10-29T01:35:36.272Z"},{"source":"GitHub Advisory Database","id":"GHSA-rxw5-jh43-59h9","url":"https://github.com/advisories/GHSA-rxw5-jh43-59h9","modified":"2026-08-11T18:31:04Z","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","checkedAt":"2026-10-29T01:35:36.273Z"},{"source":"ENISA EUVD","id":"EUVD-2026-56763","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56763","modified":"Oct 28, 2026, 8:08:35 PM","score":8.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C","checkedAt":"2026-10-29T01:35:36.285Z"}],"aiSummary":{"text":"Windows Network Address Translation (NAT) has an origin validation error, allowing an unauthorized attacker to perform spoofing over an adjacent network, affecting Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2025. The attacker needs access to an adjacent network. The weakness is an origin validation error.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-30T08:58:15.152Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-56179"}]}}