CVE-2026-72957

Windows Deployment Services is used to help set up and deploy Windows to other machines. This vulnerability is a “memory handling” bug that can be abused to run code inside the deployment server—like breaking into the tool you use to install software and turning it into a way to run your own commands. If an attacker can reach and trigger the vulnerable part of the service, they can potentially take control of that server.

This matters if you run Windows Deployment Services on the listed Windows versions (including Windows Server and Windows 10) and the service is reachable by someone who already has some level of access to it (authorized attacker). It’s less about random internet attackers and more about the risk if your deployment environment is reachable and usable by users/systems that shouldn’t be able to trigger it. The risk is mainly present when the vulnerable service can be reached and triggered by an authorized attacker through the normal deployment workflow.

Treat this as urgent because it’s a remote code execution issue against a server role (Windows Deployment Services) where an attacker who can interact with the service may be able to run code. Even though it is not in CISA KEV and there’s no public exploit code on record, the impact is high enough that you should patch quickly to reduce the chance of abuse of your deployment infrastructure.

1. Confirm exposure

   • Identify which servers/workstations run the Windows Deployment Services role/service.
   • For each system, capture the OS version/build number.

2. Determine whether you’re on a fixed version

   • If you have Windows 10: verify build is at least 10.0.14393.9512 or 10.0.17763.9245.
   • If you have Windows Server 2012: verify build is at least 6.2.9200.26349.
   • If you have Windows Server 2012 R2: verify build is at least 6.3.9600.23397.
   • If you have Windows Server 2016: verify build is at least 10.0.14393.9512.
   • If you have Windows Server 2019: verify build is at least 10.0.17763.9245.
   • If you have Windows Server 2022: verify build is at least 10.0.20348.5622.
   • If you have Windows Server 2025: verify build is at least 10.0.26100.33438.

3. Patch

   • Install the Microsoft update for CVE-2026-72957 using the vendor’s update guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72957
   • Use your normal Windows servicing process (WSUS/SCCM/Windows Update for Business) if applicable, but ensure the update associated with CVE-2026-72957 is deployed.

4. Validate

   • Re-check the build number to confirm it’s the fixed one.
   • Confirm Windows Deployment Services still works (deployment tasks, imaging workflow).

5. Temporary risk reduction if patching is delayed

   • Restrict network access to Windows Deployment Services endpoints so only required admin/deployment systems can reach them.
   • Limit who can initiate or influence deployment actions so that only intended users/systems can trigger service behavior.

6. What to monitor

   • Windows Deployment Services logs and related security events for unusual requests or abnormal service errors around deployment activity.
   • Administrative access attempts to the deployment server (especially from systems/accounts that shouldn’t be managing deployments).

CVE-2026-72957 is a Windows Deployment Services heap-based buffer overflow (CWE-122) that can result in remote code execution. The provided backstop indicates an attacker can execute code locally, while the timing/privilege model from the scoring context indicates the attacker needs access level beyond completely unauthenticated users. No public exploit code is on record, and the vulnerability is not present in CISA KEV. Exploitation likelihood is not claimed as fact here (only a prediction was provided), so the primary driver for action is the high potential impact of a code execution bug in a deployment server role. Qualys press attention is noted as a roundup item and does not establish exploitation.