CVE-2026-88174 – Windows Deployment Services Remote Code Execution Vulnerability

Microsoft has addressed a Critical Remote Code Execution (RCE) vulnerability in Windows Deployment Services (WDS) that could allow an unauthorized attacker to execute malicious code remotely over a network. The vulnerability results from a race condition caused by improper synchronization when multiple operations access a shared resource. Although successful exploitation requires precise timing, attackers do not need authentication or user interaction. If exploited, the vulnerability could compromise the confidentiality, integrity, and availability of affected systems. The issue affects multiple Windows Server versions and selected Windows 10 releases.

CVSS SCORE: 8.1

SEVERITY: Critical

Threat

This vulnerability presents a significant security threat because an unauthenticated attacker could potentially execute malicious code on vulnerable Windows systems through a network connection.

The attack requires no existing user privileges and no interaction from a victim, removing two common barriers to exploitation.

Although the attack complexity is rated High, successful exploitation could result in serious consequences, including unauthorized system access, sensitive information exposure, modification of critical system data, and disruption of essential services.

Organizations operating affected Windows Deployment Services environments should prioritize remediation to reduce their exposure to potential attacks.

Exploits

Microsoft has classified this vulnerability as Exploitation Unlikely, indicating that successful exploitation is considered difficult.

• Publicly Disclosed: No.
• Exploited in the Wild: No.
• Exploit Code Maturity: Unproven.
• Public Proof-of-Concept (PoC): No confirmed information about publicly available PoC exploit code.
• Zero-Day Exploitation: No confirmed evidence of zero-day exploitation.

The vulnerability requires an attacker to successfully exploit a race condition, which increases the complexity of an attack.

Despite the absence of confirmed exploitation, its Critical severity and potential for unauthenticated remote code execution make it an important security concern.

Technical Summary

CVE-2026-88174 is a Remote Code Execution vulnerability in Microsoft Windows Deployment Services caused by improper synchronization during concurrent access to shared resources.

The underlying weakness is classified as CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition).

A race condition occurs when multiple operations attempt to access or modify the same resource simultaneously, and the outcome depends on the timing or sequence of those operations.

In this case, improper synchronization within Windows Deployment Services creates a condition that could allow an unauthorized attacker to execute code remotely.

To exploit the vulnerability, an attacker must successfully trigger and win the race condition. This timing requirement makes exploitation more difficult but does not eliminate the risk.

The vulnerability has the following technical characteristics:

• Attack Vector: Network (AV:N) — Exploitation can occur remotely over a network.
• Attack Complexity: High (AC:H) — Successful exploitation requires winning a race condition.
• Privileges Required: None (PR:N) — Attackers do not need an authenticated account.
• User Interaction: None (UI:N) — No victim interaction is required.
• Scope: Unchanged (S:U).
• Confidentiality Impact: High — Sensitive information could be exposed.
• Integrity Impact: High — Attackers could potentially modify system information.
• Availability Impact: High — Successful exploitation could disrupt affected services.

The combination of remote accessibility, no authentication requirements, and high potential impact makes this vulnerability particularly concerning.

Although the race condition increases exploitation difficulty, a successful attack could significantly compromise an affected system.

Exploitability

The vulnerability affects Windows Deployment Services across the following Microsoft operating systems:

• Windows Server: 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.
• Windows 10: Versions 1607 and 1809, including 32-bit and x64-based systems.

An attacker could exploit the vulnerability remotely by triggering a race condition in Windows Deployment Services.

Successful exploitation requires precise timing but does not require authentication or user interaction.

Microsoft currently assesses exploitation as unlikely.

Business Impact

Successful exploitation of CVE-2026-88174 could have serious consequences for organizations relying on affected Windows environments.

Windows Deployment Services supports network-based Windows operating system deployment, making it an important component of many enterprise IT environments.

A successful attack could result in:

• Unauthorized Code Execution: Attackers could execute malicious code on vulnerable systems without requiring valid credentials.
• Sensitive Data Exposure: Confidential business information and system data could potentially be accessed.
• System Integrity Compromise: Attackers could modify critical information or interfere with normal system operations.
• Operational Disruption: Compromised systems could experience service interruptions, affecting business productivity.
• Infrastructure Security Risks: A compromised deployment server could create additional security concerns for organizations managing Windows deployments.

The potential consequences extend beyond a single vulnerable service, particularly in environments where Windows Deployment Services supports critical IT operations.

“An attacker does not need a password to exploit this weakness. One successful race condition could put critical Windows systems and business operations at risk.”

Applying the security update helps organizations reduce the likelihood of unauthorized access, system compromise, and operational disruption.

Workaround

Microsoft has not identified any official mitigations or workarounds for this vulnerability.

The recommended action is to install the applicable Microsoft security update.

Relevant security updates include:

• KB5126835: Windows Server 2012.
• KB5126836: Windows Server 2012 R2.
• KB5126868: Windows Server 2016 and Windows 10 Version 1607.
• KB5126651: Windows Server 2019 and Windows 10 Version 1809.
• KB5126655: Windows Server 2022.
• KB5126646: Windows Server 2025.

A system restart is required after installing the applicable security update.

If immediate patching is not possible, organizations should consider restricting network access to affected Windows Deployment Services environments as a temporary risk-reduction measure.

This is a general security precaution, not a Microsoft-confirmed workaround.

Urgency

Critical – Prioritize Deployment

CVE-2026-88174 should be prioritized for remediation because it allows potential remote code execution without requiring attacker privileges or user interaction.

Although Microsoft considers exploitation unlikely and there is no confirmed evidence of active exploitation, the vulnerability carries a CVSS score of 8.1 and presents a high potential impact on confidentiality, integrity, and availability.

The vulnerability affects multiple Windows Server generations, including Windows Server 2025, increasing its relevance across enterprise environments.

Organizations should prioritize patch deployment on affected systems running Windows Deployment Services, particularly those accessible from less-trusted networks.

Because the security updates require a restart, deployment should be coordinated with maintenance windows to minimize business disruption.

The absence of known attacks does not eliminate the risk. Patching now helps prevent a difficult-to-exploit vulnerability from becoming a serious security incident.