CVE-2026-62893 – Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

CVE-2026-62893 is a critical use-after-free vulnerability in Windows Deployment Services. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires low attack complexity, no privileges, and no user interaction, with successful exploitation carrying high confidentiality, integrity, and availability impact.

CVSS Score: 9.8.

SEVERITY: Critical.

THREAT:
The vulnerability creates a network-based remote code execution threat against affected Windows Deployment Services systems. Because exploitation requires neither authentication nor user interaction, a reachable vulnerable service could be attacked directly with a specially crafted network packet.

EXPLOITS:
The vulnerability is assessed as “Exploitation More Likely,” but it was not publicly disclosed and was not exploited at the time of publication. Exploit Code Maturity is listed as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
CVE-2026-62893 is caused by a use-after-free weakness (CWE-416) in Windows Deployment Services. The flaw involves improper use of memory after it has been freed. An unauthenticated remote attacker can target an affected service by sending a specially crafted packet over the network. The attack has low complexity and requires no privileges or user interaction. Successful exploitation can execute code on the target system and has a high potential impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 Windows 10 editions. An attacker can exploit the flaw remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution, creating the potential for serious compromise of affected Windows systems. The high confidentiality, integrity, and availability impacts mean an attack could expose sensitive information, alter system resources, or disrupt critical services. Systems running Windows Deployment Services can therefore represent a significant organizational risk when left unpatched.

WORKAROUND:
No workaround or mitigation is identified. An official fix is available, so affected systems should receive the applicable security update.

URGENCY:
This Critical vulnerability carries a CVSS base score of 9.8 and can be attacked remotely with low complexity, without privileges or user interaction. Although exploitation and public disclosure are both listed as No, exploitation is assessed as more likely. Prompt deployment is important because successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impact.