Microsoft disclosed a CVSS 9.8 use-after-free flaw in the Windows Services for NFS ONCRPC XDR Driver that lets an unauthorized attacker execute code over a network without any privileges or user interaction.
What Is It
CVE-2026-69595 is a use-after-free vulnerability (CWE-416) in the ONCRPC XDR Driver component of Windows Services for NFS. Per Microsoft's description, the flaw "allows an unauthorized attacker to execute code over a network." It was published on 2026-09-08 with a source identifier of [email protected] and currently carries an NVD status of "Awaiting Analysis."
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability dimension is maximally favorable to an attacker: network attack vector, low attack complexity, no privileges required, and no user interaction. The impact is equally severe; high confidentiality, integrity, and availability loss, yielding an exploitability subscore of 3.9 and an impact subscore of 5.9.
The affected component is a kernel-mode driver reachable over the network on hosts running Services for NFS, and the vulnerability spans every supported Windows Server release from 2012 through 2025, including Server Core installations.
No CISA KEV entry was supplied for this CVE, so there is no confirmed active exploitation and no KEV-mandated remediation deadline at this time.
What's Vulnerable
All listed products are x64-based Systems:
| Product | Fixed in |
|---|---|
| Windows Server 2012 (and Server Core) | 6.2.9200.26349 |
| Windows Server 2012 R2 (and Server Core) | 6.3.9600.23397 |
| Windows Server 2016 (and Server Core) | 10.0.14393.9512 |
| Windows Server 2019 (and Server Core) | 10.0.17763.9245 |
| Windows Server 2022 | 10.0.20348.5622 |
| Windows Server 2025 (and Server Core) | 10.0.26100.33438 |
Builds below the listed version on each branch are affected.
Patch Status
Microsoft has published fixed build numbers for every affected product, indicating updates are available through the MSRC Update Guide. Administrators should apply the relevant cumulative update to bring affected servers to or above the fixed builds listed above. The supplied source material does not include vendor-provided workarounds or mitigations.
Sources
- Microsoft Security Response Center; Update Guide, CVE-2026-69595: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69595
- NVD, CVE-2026-69595: https://nvd.nist.gov/vuln/detail/CVE-2026-69595