Microsoft Windows RPC Runtime: Remote code execution via improper signature check

Summary

A flaw in the Windows Remote Procedure Call (RPC) Runtime, a library used by RPC servers and Windows services, fails to verify a cryptographic signature correctly (CWE-347). An unauthenticated attacker on the network can exploit it to execute code, with a CVSS 3.1 base score of 8.1. Exploitation requires high attack complexity, and no user interaction is needed. The vendor has published patches as part of the November 2026 Patch Tuesday.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2: builds before 10.0.19044.7846
• Windows 10 Version 22H2: builds before 10.0.19045.7846 (per third-party source; the CVE record excerpt is incomplete here)
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2, Windows 11 26H1 and 26H2, Windows Server 2022: see the affected ranges in the CVE record and the MSRC advisory (builds before 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974 and 10.0.20348.5870 respectively, as listed in the record)

Fixed in

• Fixed in the November 2026 security updates. Install the builds that match or exceed the fixed versions in the MSRC advisory for each edition.
• Build numbers for 22H2 and Windows 11 23H2 are not confirmed from the MSRC advisory; verify them there before rollout.

Workaround

Unknown.

Exploitation

• No public exploit code found.
• No evidence of exploitation in the wild found.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Patch affected Windows hosts in the November 2026 cycle, starting with servers and with Windows 10 1607/1809 and any 21H2/22H2 hosts reachable from untrusted networks.
• Check the MSRC advisory for fixed builds and any workaround or FAQ.
• Make sure RPC ports (TCP 135 and the dynamic RPC range) and SMB are not exposed to the internet, and restrict them to internal network segments.
• Check which Windows 10 builds in your environment still receive updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE Record CVE-2026-118737 www.cve.org
• Microsoft Security Update Guide CVE-2026-118737 msrc.microsoft.com
• Senserva KB 5132061 (November 2026 updates) senserva.com
• Senserva KB 5131096 senserva.com
• Rapid7 Patch Tuesday November 2026 www.rapid7.com
• Strix CVE-2026-118737 (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:42.