CVE-2026-72954 – Windows Deployment Services Remote Code Execution Vulnerability

CVE-2026-72954 is a critical use-after-free vulnerability in Windows Deployment Services. An authorized attacker with low privileges could exploit the flaw over a network to execute code. Successful exploitation requires winning a race condition, which increases attack complexity. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: Successful exploitation could allow remote code execution with high impact to confidentiality, integrity, and availability. The attack vector is network-based, requires low privileges, and requires no user interaction, although successful exploitation depends on a high-complexity race condition.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72954 is caused by a use-after-free weakness (CWE-416) in Windows Deployment Services. The flaw can occur when software continues using memory after it has been freed. An authorized attacker can target the vulnerability over a network and attempt to trigger a race condition. If successful, the attacker can execute code, with the CVSS metrics identifying high potential impact to confidentiality, integrity, and availability. Attack complexity is rated High because exploitation requires the attacker to win the race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809 for 32-bit and x64 systems, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires network access, low privileges, and a successful race condition; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable an attacker to execute code on affected systems, potentially leading to exposure of sensitive information, unauthorized modification of data, and disruption of system availability. For organizations running affected Windows Deployment Services environments, a successful attack could turn limited authorized access into a much more serious system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no active exploitation is reported, affected Windows systems should be updated promptly because no workaround or mitigation is identified.