Microsoft QUIC Unauthenticated Remote Code Execution
Unauthenticated RCE in Microsoft QUIC. No user interaction required; any Windows service exposing QUIC can be exploited remotely with no prior access.
- Vendor
- Microsoft
- Product
- Windows / Microsoft QUIC
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.0%
- Status
- patched
- Published
Is CVE-2026-62815 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-62815 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-62815 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
CVE-2026-62815 is a critical remote code execution vulnerability in Microsoft’s QUIC implementation, the network transport protocol underlying HTTP/3 on Windows. No authentication is required and no user interaction is needed — a network-reachable attacker can trigger code execution on any vulnerable Windows host exposing QUIC services.
CVSS 9.8 reflects the worst-case exploitability profile: unauthenticated, network-accessible, zero user interaction. SANS ISC notes this as one of the standout critical issues in the August 2026 patch cycle.
Affected products: Windows Server and Windows client versions with Microsoft QUIC enabled (HTTP/3 services).
Mitigation: Apply the August 2026 Patch Tuesday cumulative update. If immediate patching is not possible, disabling HTTP/3 / QUIC on exposed services reduces the attack surface until the patch can be applied.
Priority: High — CVSS 9.8, unauthenticated, no user interaction required. Prioritize patching any internet-facing or network-exposed services using QUIC.
Other Microsoft CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-124194 Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Vulnerability | [ MEDIUM ] | 6.5 | 1.6% | |
| CVE-2026-96951 Microsoft Windows Command Injection Vulnerability | [ HIGH ] | 8.8 | 9.8% | |
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 2.7% | — |
| CVE-2026-65660 Microsoft SharePoint Code Injection Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 9.9% | |
| CVE-2026-85889 Azure AI Foundry missing authentication allows unauthorized privilege escalationwrite-up | [ CRITICAL ] | 10.0 | 0.7% | — |
| CVE-2026-69843 Microsoft Fabric authentication bypass by spoofingwrite-up | [ CRITICAL ] | 10.0 | 0.9% | — |
| CVE-2026-85880 Microsoft Windows ALPC Heap Buffer Overflow Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 0.4% | |
| CVE-2026-81963 Microsoft Windows Update Stack Link-Following Privilege Escalationwrite-up | [ HIGH ] | 7.8 | 7.1% |
