CVE-2026-72983 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

CVE-2026-72983 is a critical use-after-free vulnerability in Windows Internet Connection Sharing (ICS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a serious remote code execution threat because exploitation can occur over the network with low attack complexity. Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system, all of which are rated High in the CVSS metrics.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72983 is caused by a use-after-free weakness (CWE-416) in Windows Internet Connection Sharing. This type of memory-safety issue occurs when software continues to use memory after it has been freed. An unauthenticated attacker can target the affected ICS service by sending a specially crafted packet across the network. Successful exploitation can result in remote code execution on the target system. The CVSS characteristics show a network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and High impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and supported architectures shown for each release. Exploitation can be attempted remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on a vulnerable system. This creates the potential for significant compromise of sensitive information, system integrity, and service availability. Because authentication and user interaction are not required, vulnerable systems with an affected service reachable over the network present a particularly significant organizational risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network-based attack path, low complexity, and ability to be exploited without authentication or user interaction make prompt patch deployment important, even though exploitation is currently assessed as Less Likely and no active exploitation is identified.