{"id":"CVE-2022-26809","published":"2022-04-15T19:04:49Z","modified":"2025-01-02T18:51:59Z","title":"Remote Procedure Call Runtime Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Windows 10 Version 1809","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.17763.0, < 10.0.17763.2803"]},{"vendor":"Microsoft","product":"Windows 10 Version 1809","versions":[">= 10.0.0, < 10.0.17763.2803"]},{"vendor":"Microsoft","product":"Windows Server 2019","versions":[">= 10.0.17763.0, < 10.0.17763.2803"]},{"vendor":"Microsoft","product":"Windows Server 2019 (Server Core installation)","versions":[">= 10.0.17763.0, < 10.0.17763.2803"]},{"vendor":"Microsoft","product":"Windows 10 Version 1909","versions":[">= 10.0.0, < 10.0.18363.2212"]},{"vendor":"Microsoft","product":"Windows 10 Version 21H1","versions":[">= 10.0.0, < 10.0.19043.1645"]},{"vendor":"Microsoft","product":"Windows Server 2022","versions":[">= 10.0.20348.0, < 10.0.20348.643"]},{"vendor":"Microsoft","product":"Windows 10 Version 20H2","versions":[">= 10.0.0, < 10.0.19042.1645"]},{"vendor":"Microsoft","product":"Windows Server version 20H2","versions":[">= 10.0.0, < 10.0.19042.1645"]},{"vendor":"Microsoft","product":"Windows 11 version 21H2","versions":[">= 10.0.0, < 10.0.22000.613"]}],"description":{"text":"Remote Procedure Call Runtime Remote Code Execution Vulnerability","provenance":"source","from":"CVE.org"},"summary":{"text":"The Remote Procedure Call (RPC) runtime component of Microsoft Windows 10 Version 1809 contains a flaw that allows remote code execution. An attacker with network access can exploit it without authentication or user interaction, gaining the ability to run code with high impact to confidentiality, integrity and availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:39Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.90859,"percentile":0.99805,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-04-14","exploitedFirstSeen":"2022-04-14","ransomware":true,"evidence":[{"url":"https://www.covertswarm.com/post/multiple-windows-zero-days-cve-2022-24521-cve-2022-26904-and-cve-2022-26809","date":"2022-04-14"},{"url":"https://www.group-ib.com/resources/research-hub/hi-tech-crime-trends-2022/","date":"2023-01-17"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":5,"pulses":[{"name":"blockioc","url":"https://otx.alienvault.com/pulse/68f49c515f89bb9e923f95ff","created":"2025-10-19"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"},{"name":"Cyble &mdash; Malware Campaign Targets InfoSec Community: Threat Actor Uses Fake Proof of Concept to Deliver Cobalt-Strike Beacon","url":"https://otx.alienvault.com/pulse/628bb1a7ffe48d5ec315f7aa","created":"2022-05-23"},{"name":"Malware Campaign Targets InfoSec Community: Threat Actor Uses Fake Proof of Concept to Deliver Cobalt-Strike Beacon","url":"https://otx.alienvault.com/pulse/62880093ce0d105c9a9670b5","created":"2022-05-20"},{"name":"Microsoft's April 2022 Patch Tuesday Fixes 2 Zero-days and 119 Bugs","url":"https://otx.alienvault.com/pulse/6261421ebedf96c99147e6a2","created":"2022-04-21"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809","tags":["vendor-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-31359","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-31359","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":9,"skipped":1,"earliest":"2022-04-14","earliestUrl":"https://github.com/sherlocksecurity/Microsoft-CVE-2022-26809-The-Little-Boy","repos":[{"name":"fuckjsonp/FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp","url":"https://github.com/fuckjsonp/FuckJsonp-RCE-CVE-2022-26809-SQL-XSS-FuckJsonp","stars":409,"created":"2022-07-27"},{"name":"s1ckb017/PoC-CVE-2022-26809","url":"https://github.com/s1ckb017/PoC-CVE-2022-26809","stars":108,"created":"2022-06-13"},{"name":"yuanLink/CVE-2022-26809","url":"https://github.com/yuanLink/CVE-2022-26809","stars":61,"created":"2022-05-01"},{"name":"corelight/cve-2022-26809","url":"https://github.com/corelight/cve-2022-26809","stars":32,"created":"2022-04-14"},{"name":"websecnl/CVE-2022-26809","url":"https://github.com/websecnl/CVE-2022-26809","stars":28,"created":"2022-04-14"}]},"first":{"date":"2022-04-14","source":"PoC-in-GitHub","url":"https://github.com/sherlocksecurity/Microsoft-CVE-2022-26809-The-Little-Boy"},"provenance":"source"},"detections":{"cveRules":[{"title":"Potential CVE-2022-26809 Exploitation Attempt","id":"a7cd7306-df8b-4398-b711-6f3e4935cf16","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml","techniques":["T1190","T1569.002"]}]},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-04-14","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sherlocksecurity/Microsoft-CVE-2022-26809-The-Little-Boy","provenance":"source"},{"date":"2022-04-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.covertswarm.com/post/multiple-windows-zero-days-cve-2022-24521-cve-2022-26904-and-cve-2022-26809","provenance":"source"},{"date":"2022-04-15","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-26809","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":78.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1659 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9980"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"9 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.77,"detail":"5 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}