The Microsoft Security Response Center assigns the vulnerability a CVSS base score of 7.1 and assesses exploitation as Exploitation Less Likely. That assessment is a reason to calibrate urgency—not a reason to leave affected systems unpatched. Microsoft explicitly identifies customer action as required.
What the Windows SMB vulnerability allows
Microsoft describes the vulnerability as follows:
The weakness is classified as CWE-197, a numeric truncation error. The important distinction for administrators is that this is an authorized-attacker scenario with additional prerequisites, rather than a claim that any unauthenticated network connection can trigger code execution.
Microsoft’s advisory explains the high attack complexity (AC:H): an attacker needs particular conditions, such as specific protocol settings or configurations, before an attack can succeed. Those requirements reduce the likelihood of widespread or opportunistic exploitation.
The advisory’s security metrics and status fields are:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-119988 |
| Exact title | Windows SMB Remote Code Execution Vulnerability |
| Severity | Important |
| CVSS base score | 7.1 |
| CVSS temporal score | 6.2 |
| Weakness | CWE-197 |
| Exploitation assessment | Exploitation Less Likely |
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The complete supplied CVSS vector is:
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Its base metrics describe a network attack vector, high attack complexity, low privileges required, user interaction required, and unchanged scope. Potential confidentiality, integrity, and availability impacts are each rated high.
The practical reading: the prerequisites constrain the attack opportunity, but the potential consequences remain substantial. “Less likely” and “low impact” are not interchangeable.
A patch-verification trap: matching the KB is not enough
A comparison of Microsoft’s affected-product mappings reveals an important deployment detail: one KB can map to different fixed builds on different Windows releases.
For example, KB5131096 maps to 10.0.19044.7846 for the listed Windows client products on one release branch and 10.0.19045.7846 on another. Similarly, KB5132043 and KB5132061 each cover multiple Windows client release branches, with different build numbers for each.
There is also a client/server distinction worth keeping in the deployment checklist. Windows 11 Version 24H2 for x64-based Systems has listed fixes under KB5132043 and KB5132061, while Windows Server 2025 (x64) has listed fixes under KB5131077 and KB5131080. Their build numbers share the 10.0.26100 prefix, but their exact KB-to-build mappings differ.
This comparison supports a concrete verification rule: match the complete product, architecture, KB, and fixed build—not just a familiar-looking build prefix or update number.
Windows client remediation
Microsoft lists the following product-specific remediation values. Each entry preserves the exact product name and its KB-to-fixed-build mapping.
Windows 10
- For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows 10 Version 1607 for x64-based Systems, install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows 10 Version 1809 for x64-based Systems, install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19044.7846.
- For Windows 10 Version 21H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
- For Windows 10 Version 21H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19044.7846.
- For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5131096 to reach fixed build 10.0.19045.7846.
- For Windows 10 Version 22H2 for ARM64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
- For Windows 10 Version 22H2 for x64-based Systems, install KB5131096 to reach fixed build 10.0.19045.7846.
Windows 11
- For Windows 11 Version 23H2 for ARM64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
- For Windows 11 Version 23H2 for x64-based Systems, install KB5131087 to reach fixed build 10.0.22631.7711.
- For Windows 11 Version 24H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
- For Windows 11 Version 24H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26100.9911; install KB5132061 to reach fixed build 10.0.26100.9974.
- For Windows 11 Version 25H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
- For Windows 11 Version 25H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26200.9911; install KB5132061 to reach fixed build 10.0.26200.9974.
- For Windows 11 Version 26H1 for ARM64-based Systems, install KB5132059 to reach fixed build 10.0.28000.3501.
- For Windows 11 version 26H1 for x64-based Systems, install KB5132059 to reach fixed build 10.0.28000.3501.
- For Windows 11 Version 26H2 for ARM64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
- For Windows 11 Version 26H2 for x64-based Systems, install KB5132043 to reach fixed build 10.0.26300.9911; install KB5132061 to reach fixed build 10.0.26300.9974.
Client takeaway: retain the release-specific build number when tracking remediation. A shared KB does not make the resulting builds identical across releases.
Windows Server remediation
Microsoft’s affected-product list includes both Server Core installation entries and the corresponding server entries below. Server Core must therefore remain in scope when checking deployment coverage.
- For Windows Server 2016 (Server Core installation) (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows Server 2016 (x64), install KB5131291 to reach fixed build 10.0.14393.9688.
- For Windows Server 2019 (Server Core installation) (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows Server 2019 (x64), install KB5131085 to reach fixed build 10.0.17763.9487.
- For Windows Server 2022 (Server Core installation) (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
- For Windows Server 2022 (x64), install KB5131090 to reach fixed build 10.0.20348.5870.
- For Windows Server 2025 (Server Core installation) (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
- For Windows Server 2025 (x64), install KB5131077 to reach fixed build 10.0.26100.33730; install KB5131080 to reach fixed build 10.0.26100.33822.
Server takeaway: check installation type as well as release. The listed Server Core installations require remediation just as their corresponding server entries do.
How to turn the advisory into a deployment check
The following is an operational checklist synthesized from Microsoft’s product and remediation mappings, rather than an additional vendor workaround:
- Identify the exact affected product. Record the release, architecture, and server installation type where applicable.
- Select its matching remediation entry. Keep each KB attached to the fixed build shown for that product.
- Deploy the applicable listed fix through your established update process. Where Microsoft lists two KB-to-build mappings, preserve both in your deployment records rather than reducing them to one generic target.
- Validate the resulting build against the correct product entry. A successful deployment record should identify the product, installed KB, and corresponding fixed build together.
- Reconcile exceptions. Investigate systems whose update results do not match their intended product-specific target before marking the deployment complete.
For prioritization, Microsoft’s high-complexity explanation provides useful context: particular protocol settings or configurations must be present for exploitation to succeed. It does not remove the explicit requirement for customer action.
The bottom line is straightforward: CVE-2026-119988 warrants planned, verified patching across the listed Windows client and server estate. Use the exploitation assessment to inform scheduling, and use the exact KB-to-build mappings to establish that the fix reached the right machines.