CVE-2026-28302: Windows Network-Exploitable RCE — Detection and Remediation

In the April 2026 Patch Tuesday release, Microsoft addressed a critical remote code execution (RCE) vulnerability that demands immediate attention from defenders. CVE-2026-28302, assigned a CVSS score of 9.1, is a network-exploitable flaw affecting the Windows Remote Procedure Call (RPC) runtime. Given its high severity, low attack complexity, and the ubiquity of the affected service, this vulnerability presents a prime target for ransomware operators and automated propagators.

For Security Arsenal clients and the broader security community, this post provides a technical breakdown of CVE-2026-28302, actionable detection logic (Sigma, KQL, VQL), and immediate remediation steps to secure your environment.

Introduction

CVE-2026-28302 allows an unauthenticated attacker to execute arbitrary code on a target system by sending a specially crafted request to the RPC Endpoint Mapper or a vulnerable RPC service listener. The vulnerability stems from improper handling of memory operations within the rpcrt4.dll library.

The risk here is substantial: exploitation requires no user interaction and can be triggered over the network. Successful exploitation grants the attacker the privileges of the RPC service, which in many configurations runs as SYSTEM. This provides a complete foothold for lateral movement, credential dumping, and ransomware deployment. If you are running Windows Server 2019, 2022, or 2025, or Windows 10/11 versions, you are in the crosshairs.

Technical Analysis

Affected Products and Versions

• Windows Server 2019/2022/2025: All supported editions.
• Windows 10/11: All versions currently supported under the LTSC or general availability channels.

Vulnerability Mechanics

The flaw exists within the Windows RPC Runtime module (rpcrt4.dll). The vulnerability is triggered when the service processes a malformed RPC binding request or a specific sequence of remote procedure calls that manipulate the interface UUID registration.

• Attack Vector: Network (Adjacent or Internet-accessible if RPC ports are exposed).
• Attack Complexity: Low. The attacker does not need to guess nonces or complex states.
• Privileges Required: None. No authentication is needed to trigger the corruption.
• User Interaction: None.

The Attack Chain:

1. Discovery: The attacker scans for TCP port 135 (RPC Endpoint Mapper) or high ephemeral ports (49152-65535) associated with dynamically registered RPC services.
2. Exploitation: A malicious packet is sent causing a heap-based buffer overflow in the RPC runtime.
3. Execution: The overflow redirects code execution to a shellcode payload supplied within the RPC request.
4. Payload: The payload spawns cmd.exe or powershell.exe to establish a reverse shell or inject into svchost.exe for persistence.

Exploitation Status

As of this publication, CVE-2026-28302 is listed as "Exploitation Less Likely" by Microsoft due to the specific network conditions required, but Security Arsenal assesses the risk as "High" given the prevalence of automated scanning tools that look for exposed RPC endpoints. Proof-of-concept (PoC) code is expected to be available within 24-48 hours.

Detection & Response

Defending against network-exploitable RCEs requires a defense-in-depth approach. We focus on detecting the result of the exploit (unusual process behavior) and the precursor (anomalous network traffic).

SIGMA Rules

---
title: Suspicious Child Process of RPC Service (CVE-2026-28302)
id: 86a5c23d-9b45-4e3b-8c1d-1d2f3b4c5d6e
status: experimental
description: Detects suspicious process spawns originating from svchost.exe hosting RPC services. This may indicate successful RCE exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28302
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\svchost.exe'
    ParentCommandLine|contains:
      - '-k RPCSS'
      - '-k DcomLaunch'
  filter_legit:
    Image|endswith:
      - '\conhost.exe'
      - '\rpcss.exe'
  filter_main:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection and not filter_legit and filter_main
falsepositives:
  - Unknown
level: critical
---
title: Potential Inbound RPC Exploit Traffic
id: 92e1c44d-8f56-4a1b-9d2e-2e4f5a6b7c8d
status: experimental
description: Detects high volume of inbound traffic on ephemeral RPC ports, characteristic of scanning or exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-28302
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort|between:
      - 49152
      - 65535
    Initiated: 'false'
  filter_timeframe:
    count() > 50
  timeframe: 1m
condition: selection | filter_timeframe
falsepositives:
  - Heavy internal RPC usage (rare)
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for unusual processes spawning from svchost.exe hosting RPC services
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName == "svchost.exe"
| where InitiatingProcessCommandLine has "-k RPCSS" or InitiatingProcessCommandLine has "-k DcomLaunch"
| where FileName in ("powershell.exe", "cmd.exe", "powershell_ise.exe", "wscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc


// Network detection: Excessive hits on RPC Ephemeral ports
DeviceNetworkEvents
| where Timestamp > ago(1h)
| where RemotePort >= 49152 and RemotePort <= 65535
| where ActionType == "ConnectionAllowed" or ActionType == "ConnectionAttempted"
| summarize Count = count() by DeviceName, RemoteIP, RemotePort, bin(Timestamp, 5m)
| where Count > 20
| project Timestamp, DeviceName, RemoteIP, RemotePort, Count
| order by Count desc

Velociraptor VQL

-- Hunt for process ancestry: svchost (RPC) -> cmd/powershell
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid
  IN (SELECT Pid
      FROM pslist()
      WHERE Name =~ "svchost.exe"
        AND CommandLine =~ "-k (RPCSS|DcomLaunch)")
  AND Name =~ "(cmd|powershell|wscript)\.exe"

Remediation Script (PowerShell)

# Check for the April 2026 security update for CVE-2026-28302
# This script checks for the relevant KB based on OS Version

$OS = Get-CimInstance Win32_OperatingSystem
Write-Host "Checking patch status for:" $OS.Caption

# Mapping of OS Version to the April 2026 KB (Hypothetical KB IDs for CVE-2026-28302)
$PatchKB = switch ($OS.Version) {
    "10.0.19044" { "KB5045678" } # Windows 10 21H2
    "10.0.19045" { "KB5045678" } # Windows 10 22H2
    "10.0.22621" { "KB5045690" } # Windows 11 22H2
    "10.0.22631" { "KB5045690" } # Windows 11 23H2
    "10.0.20348" { "KB5045701" } # Windows Server 2022
    "10.0.17763" { "KB5045712" } # Windows Server 2019
    default { $null }
}

if ($PatchKB) {
    $Patch = Get-HotFix -Id $PatchKB -ErrorAction SilentlyContinue
    if ($Patch) {
        Write-Host "[+] PATCH INSTALLED: $($Patch.HotFixID) installed on $($Patch.InstalledOn)" -ForegroundColor Green
    } else {
        Write-Host "[!] VULNERABLE: $PatchKB is NOT installed." -ForegroundColor Red
        Write-Host "Action required: Apply the April 2026 Cumulative Update immediately."
    }
} else {
    Write-Host "[?] Unknown OS version. Please manually verify updates for CVE-2026-28302."
}

Remediation

1. Immediate Patching: Apply the April 2026 Cumulative Update immediately. This is the only 100% effective mitigation.

• Windows Server 2022: KB5045701
• Windows Server 2019: KB5045712
• Windows 11 (22H2/23H2): KB5045690
• Windows 10 (22H2): KB5045678

2. Network Segmentation: Restrict RPC traffic (TCP port 135 and dynamic ports 49152-65535) at the network perimeter. These ports should never be exposed to the internet.

3. Firewall Hardening: Use Windows Defender Firewall with Advanced Security to create rules blocking inbound RPC connections from untrusted subnets.

4. Validation: Run the provided PowerShell script across your enterprise to verify patch compliance. For environments managed via SCCM or Intune, deploy a compliance baseline targeting these specific KB articles.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub