CVE-2026-69595 – Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

CVE-2026-69595 is a critical use-after-free vulnerability (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. An unauthenticated remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and can be attacked without authentication. Successful exploitation can have a high impact on confidentiality, integrity, and availability, making vulnerable Windows Server systems a significant target when the affected service is reachable over a network.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69595 is caused by a use-after-free condition in the Windows Services for NFS ONCRPC XDR Driver. An unauthenticated attacker can send a specially crafted packet over the network to an affected service to trigger the vulnerability. Successful exploitation can result in remote code execution on the target system. The CVSS metrics identify network-based access, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. An unauthenticated attacker can exploit the flaw remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected Windows Server systems, potentially compromising sensitive information, system integrity, and service availability. Because no authentication or user interaction is required, reachable vulnerable services could expose organizations to serious server compromise.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This vulnerability should be prioritized for deployment because it carries a Critical severity rating and a CVSS base score of 9.8. Its network-based attack path, low attack complexity, and lack of authentication or user interaction requirements create a severe remote-code-execution risk, even though exploitation is currently assessed as Less Likely and no exploitation is reported.