For administrators, the practical task is to match each affected system to its exact update and fixed build. Several releases share a KB number but reach different builds, so a KB-only compliance check can miss an important distinction.
What the vulnerability does
Microsoft’s advisory states:
The weakness is classified as CWE-822, an untrusted pointer dereference. Microsoft supplies the following scoring and status information:
| Field | Microsoft advisory value |
|---|---|
| CVE | CVE-2026-70170 |
| Severity | Important |
| CVSS base score | 6.5 |
| CVSS temporal score | 5.7 |
| CWE | CWE-822 |
| Exploitation assessment | Exploitation Less Likely |
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
The vector describes a network attack with low attack complexity, low privileges required, and no user interaction. Its impact metrics specify unchanged scope, no confidentiality or integrity impact, and high availability impact.
That combination matters when setting priorities. This is not described as an unauthenticated remote takeover: the attacker requires authorization, and the stated outcome is denial of service. Nevertheless, interrupting a business-critical system can be consequential even without stealing or modifying its data.
Microsoft’s Exploitation Less Likely assessment should inform triage, not replace remediation. The customer-action status explicitly calls for action.
Complete affected-product and remediation list
The following Microsoft remediation values identify every affected product, its KB-to-build mapping, and its vendor fixed version. Match the complete product name, including release and architecture, rather than choosing an update solely because its build number looks similar.
Windows 10
- For Windows 10 Version 1607 for 32-bit Systems (x86), install KB5126868 to reach fixed build 10.0.14393.9612.
- For Windows 10 Version 1607 for x64-based Systems, install KB5126868 to reach fixed build 10.0.14393.9612.
- For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5126651 to reach fixed build 10.0.17763.9376.
- For Windows 10 Version 1809 for x64-based Systems, install KB5126651 to reach fixed build 10.0.17763.9376.
- For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5126657 to reach fixed build 10.0.19044.7807.
- For Windows 10 Version 21H2 for ARM64-based Systems, install KB5126657 to reach fixed build 10.0.19044.7807.
- For Windows 10 Version 21H2 for x64-based Systems, install KB5126657 to reach fixed build 10.0.19044.7807.
- For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5126657 to reach fixed build 10.0.19045.7807.
- For Windows 10 Version 22H2 for ARM64-based Systems, install KB5126657 to reach fixed build 10.0.19045.7807.
- For Windows 10 Version 22H2 for x64-based Systems, install KB5126657 to reach fixed build 10.0.19045.7807.
Windows 11
- For Windows 11 Version 23H2 for ARM64-based Systems, install KB5126653 to reach fixed build 10.0.22631.7652.
- For Windows 11 Version 23H2 for x64-based Systems, install KB5126653 to reach fixed build 10.0.22631.7652.
- For Windows 11 Version 24H2 for ARM64-based Systems, install KB5127648 to reach fixed build 10.0.26100.9711.
- For Windows 11 Version 24H2 for x64-based Systems, install KB5127648 to reach fixed build 10.0.26100.9711.
- For Windows 11 Version 25H2 for ARM64-based Systems, install KB5127648 to reach fixed build 10.0.26200.9711.
- For Windows 11 Version 25H2 for x64-based Systems, install KB5127648 to reach fixed build 10.0.26200.9711.
- For Windows 11 Version 26H1 for ARM64-based Systems, install KB5127646 to reach fixed build 10.0.28000.3231.
- For Windows 11 version 26H1 for x64-based Systems, install KB5127646 to reach fixed build 10.0.28000.3231.
- For Windows 11 Version 26H2 for ARM64-based Systems, install KB5127648 to reach fixed build 10.0.26300.9711.
- For Windows 11 Version 26H2 for x64-based Systems, install KB5127648 to reach fixed build 10.0.26300.9711.
Windows Server
- For Windows Server 2012 (Server Core installation) (x64), install KB5126835 to reach fixed build 6.2.9200.26434.
- For Windows Server 2012 (x64), install KB5126835 to reach fixed build 6.2.9200.26434.
- For Windows Server 2012 R2 (Server Core installation) (x64), install KB5126836 to reach fixed build 6.3.9600.23470.
- For Windows Server 2012 R2 (x64), install KB5126836 to reach fixed build 6.3.9600.23470.
- For Windows Server 2016 (Server Core installation) (x64), install KB5126868 to reach fixed build 10.0.14393.9612.
- For Windows Server 2016 (x64), install KB5126868 to reach fixed build 10.0.14393.9612.
- For Windows Server 2019 (Server Core installation) (x64), install KB5126651 to reach fixed build 10.0.17763.9376.
- For Windows Server 2019 (x64), install KB5126651 to reach fixed build 10.0.17763.9376.
- For Windows Server 2022 (Server Core installation) (x64), install KB5126655 to reach fixed build 10.0.20348.5761.
- For Windows Server 2022 (x64), install KB5126655 to reach fixed build 10.0.20348.5761.
- For Windows Server 2025 (Server Core installation) (x64), install KB5126646 to reach fixed build 10.0.26100.33650.
- For Windows Server 2025 (x64), install KB5126646 to reach fixed build 10.0.26100.33650.
Three deployment distinctions worth checking
Comparing Microsoft’s mappings reveals practical pitfalls that a flat list of KB numbers does not capture.
First, one KB can have several valid fixed builds. KB5127648 maps to three different Windows client build branches: 10.0.26100.9711, 10.0.26200.9711, and 10.0.26300.9711. Similarly, KB5126657 maps to both 10.0.19044.7807 and 10.0.19045.7807. Compliance rules should therefore pair the update with the installed release’s expected build rather than enforce one build across every device receiving that KB.
Second, a matching build prefix does not establish the correct update. Windows 11 Version 24H2 for x64-based Systems maps to KB5127648 and 10.0.26100.9711. Windows Server 2025 (x64) instead maps to KB5126646 and 10.0.26100.33650. Both share the 10.0.26100 prefix, but Microsoft specifies different remediation. Product identity remains essential.
Third, Server Core belongs in the remediation inventory. Microsoft explicitly lists Server Core installations for each affected server release above. Excluding them from this patch campaign would leave listed affected products outside the deployment scope.
These are operational conclusions drawn from Microsoft’s product mappings, not additional claims about how the vulnerability is exploited.
How to prioritize and verify remediation
For this availability-focused vulnerability, prioritize affected systems according to the business cost of disruption and the network access available to authorized users. The privilege requirement narrows the attack conditions, but it does not make an affected system immune.
A practical deployment checklist is:
- Identify the exact product. Record the release, architecture, and server installation type, then match it to the remediation list.
- Deploy the mapped update. Use the KB specified for that product through your established update-management process.
- Verify the resulting build. Compare the installed system’s build with the corresponding vendor fixed version above; do not treat a queued deployment as proof of remediation.
- Resolve mismatches before closing the finding. If the recorded build differs from the expected result, check the product mapping and deployment outcome.
- Validate service availability. Confirm that the system’s intended workloads remain operational after maintenance.
The bottom line: CVE-2026-70170 is an Important Windows Kernel denial-of-service vulnerability requiring customer action. Its authorization requirement and exploitation assessment provide useful context, but the concrete remedy is the product-specific update. Match the product, install the correct KB, and verify the corresponding build—especially where shared KB numbers make a mixed Windows estate look simpler than it really is.