Windows ICS Has a 9.8 RCE. Internet Connection Sharing Just Got Interesting
- The Mess: Microsoft patched CVE-2026-72983, a critical use-after-free in Windows Internet Connection Sharing. CVSS: 9.8.
- The Damage: An unauthenticated attacker can potentially execute arbitrary code over the network without user interaction.
- The Fix: Install the September 2026 updates and disable Internet Connection Sharing where it is not required.
Internet Connection Sharing is one of those Windows features administrators rarely think about until it becomes an attack surface.
CVE-2026-72983 changes that.
The vulnerability is a use-after-free (CWE-416) in Windows Internet Connection Sharing. Microsoft assigns it a CVSS 9.8 Critical score with AV:N/AC:L/PR:N/UI:N. The attacker needs network access, but no account, no privileges and no victim interaction.
The attack model is brutally simple:
network access → malicious input → memory corruption → code execution
The affected software range is broad. Microsoft lists Windows 10, Windows 11 and Windows Server releases from Server 2012 through Server 2025 among the affected products. Patched builds were released with the September 8, 2026 security updates.
ICS is normally used to share an Internet connection with other devices. It can therefore appear on systems that are acting as gateways, hotspots or ad-hoc network routers rather than traditional servers.
That makes the vulnerability particularly interesting from an attack-surface perspective.
A compromised endpoint providing network connectivity can become more than just another infected workstation. If the vulnerable ICS component can be reached through the relevant network path, the attacker may be able to turn the host itself into a remote code-execution target.
There is currently no indication of exploitation. CISA’s vulnerability enrichment records exploitation as “none” while marking the vulnerability as automatable with total technical impact.
That means this is not another zero-day emergency.
It is something slightly more useful: a 9.8 vulnerability before the exploit race starts.
Administrators should identify systems where ICS is enabled, especially Windows machines being used as gateways or connection-sharing hosts. If ICS is unnecessary, turn it off. If it is required, patch the host and restrict unnecessary network access.
Bugstoday Opinion
Windows ICS is exactly the sort of feature that gets forgotten.
Someone enables connection sharing. It works. Nobody touches the configuration for years.
Then Microsoft ships a 9.8 RCE.
The lesson is simple: every networking feature is an attack surface, including the ones nobody remembers enabling.
Patch it. Disable it where possible. And stop assuming that an ordinary Windows workstation cannot become network infrastructure.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Microsoft Security Response Center
CISA
National Vulnerability Database
