Microsoft has fixed a critical flaw in the Windows Remote Procedure Call Runtime that could let an unauthenticated attacker run code on a network, as part of its November 2026 security updates.

The flaw, tracked as CVE-2026-118737, carries a CVSS score of 8.1. Microsoft describes it as a remote code execution vulnerability caused by improper verification of a cryptographic signature. Cisco Talos, which reviewed the release, lists it among the November updates and notes that Microsoft rates exploitation as less likely than for some other flaws fixed in the same batch.

An attacker would need network access to a vulnerable system and would have to win a timing race tied to a pending DNS query, according to technical analysis of the flaw. No privileges and no action by a user are needed if that race is won. The flaw affects Windows 11 versions 23H2 to 26H2, Windows 10 Enterprise LTSC 2021 and Windows Server 2016 to 2025, including Server Core installations.

No known exploitation so far

Microsoft has not reported active exploitation of CVE-2026-118737, and the flaw was not listed in the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue as of 10 November. No public proof-of-concept code was known at the time of the fix.

The November updates also start a phased tightening of NTLM signing in Windows. In the first phase, which began on 10 November, Windows clients offer NTLM signing on all connections by default, while servers still accept both signed and unsigned clients and record audit events for clients that do not sign. A stricter second phase is set for May 2027, when Windows Server will require NTLM signing by default and reject clients that do not offer it.

What to do

Administrators should apply the November 2026 Windows security updates across clients and servers, and watch the new audit events for systems still connecting without NTLM signing before enforcement tightens next year. Cisco Talos counted 1,095 vulnerabilities in Microsoft's November release, 64 of them rated critical, with 48 of the critical flaws allowing remote code execution.