CVE-2026-69595

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 60th percentile. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile60th1.0% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-08Updated 2026-09-24Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you run Windows Services for NFS (NFS) on these servers: Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025.
For each affected server, update to the fixed version that matches your OS exactly:
- Windows Server 2012 → 6.2.9200.26349
- Windows Server 2012 R2 → 6.3.9600.23397
- Windows Server 2016 → 10.0.14393.9512
- Windows Server 2019 → 10.0.17763.9245
- Windows Server 2022 → 10.0.20348.5622
- Windows Server 2025 → 10.0.26100.33438
If you cannot patch immediately, remove or disable NFS exposure (especially any network-accessible NFS/ONCRPC services) until updates are applied.
After patching, confirm the update is installed on each server and monitor for unusual network traffic to NFS-related services.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-69595 is a Windows Services for NFS problem that can let an attacker run code remotely; if you use Windows Server with NFS enabled, this is serious and you should update.

CVE-2026-69595 is a remote code execution issue in the Windows Services for NFS ONCRPC XDR driver caused by a memory safety weakness (use-after-free), allowing a network attacker to trigger it without authentication.

If you're affected

Full server takeover
Ransomware and data theft risk
Operations disruption
Loss of confidentiality

What is it

This vulnerability is like a software “memory bug” in Windows’ NFS component. An attacker on the network can trigger the bug so the server behaves incorrectly and lets them run code. If exploited, the attacker could take control of your server.

Who is affected

This matters if you run Windows Server 2012, 2012 R2, 2016, 2019, 2022, or 2025 with Windows Services for NFS enabled. Because the issue can be triggered over a network, it’s only a risk when the affected NFS/ONCRPC functionality is reachable (for example, from the internet or from other networks you trust).

How urgent is it

This is RED because a real attacker has been associated with exploitation activity (Qualys press attention indicates exploitation). Even though no public exploit code is on record and it’s not listed in CISA KEV, the remote code execution nature makes timely patching critical.

What to do — in detail

Confirm exposure
- Inventory servers running Windows Server 2012/2012 R2/2016/2019/2022/2025.
- On each, confirm whether Windows Services for NFS is installed and enabled.
- Pay special attention to whether NFS-related services are reachable from untrusted networks (internet-facing, cross-site/VPN segments, or broad internal access).
Apply the correct fixed build
- Windows Server 2012: update to 6.2.9200.26349
- Windows Server 2012 R2: update to 6.3.9600.23397
- Windows Server 2016: update to 10.0.14393.9512
- Windows Server 2019: update to 10.0.17763.9245
- Windows Server 2022: update to 10.0.20348.5622
- Windows Server 2025: update to 10.0.26100.33438
  Use the vendor guidance in the update guide page for CVE-2026-69595.
If patching is delayed (workaround)
- Disable or restrict network access to NFS/ONCRPC-related services until updates are installed.
- The goal is to make the vulnerable service unreachable from any untrusted network.
Verification and monitoring
- After updating, verify the installed build/version matches the fixed build for your OS.
- Monitor network logs for unexpected connections to NFS-related ports/services and review server logs for signs of abnormal behavior around the update window.
Exploit risk context
- This CVE is not listed in CISA KEV and there is no public exploit code on record, but exploitation-associated attention has been reported, so treat it as actively relevant and focus on rapid patch deployment.

Technical context

CVE-2026-69595 is a critical remote code execution vulnerability (CWE-416: use-after-free) in the Windows Services for NFS ONCRPC XDR Driver. The described mechanism is a memory-use-after-free condition that can be triggered by an unauthorized network attacker, leading to code execution with high impact on the server (integrity and availability impact are consistent with the backstop and the high-risk CVSS rating).

Findings summary: it is not in CISA KEV; no public exploit code is on record; predicted likelihood is low-to-moderate and flat, but this should not be used to down-rank urgency because the verdict is RED. Patch availability exists with fixed OS-build versions provided by Microsoft’s update guidance for each supported Windows Server release.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS60th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

1.0% chance of exploitation activity in the next 30 days, which ranks it in the 60th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 16 days, from the signal feeds we watch.

2026-09-24Patch availablerecord updated
2026-09-21Patch availablerecord updated
2026-09-10OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

And 10 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable