Remote Code Execution Vulnerability in Windows Services for NFS by Microsoft
CVE-2026-69595

9.8CRITICAL

Key Information:

Vendor: Microsoft
Status: Windows Server 2012; Windows Server 2012 (server Core Installation); Windows Server 2012 R2; Windows Server 2012 R2 (server Core Installation)
Vendor: CVE Published:; 8 September 2026

What is CVE-2026-69595?

A vulnerability exists in the Windows Services for NFS ONCRPC XDR Driver that can be exploited to execute arbitrary code over a network. This issue arises from improper handling within the driver, which could allow an unauthorized attacker to gain control of the affected system.

Affected Version(s)

Windows Server 2012 (Server Core installation) x64-based Systems 6.2.9200.0 < 6.2.9200.26349

Windows Server 2012 R2 (Server Core installation) x64-based Systems 6.3.9600.0 < 6.3.9600.23397

Windows Server 2012 R2 x64-based Systems 6.3.9600.0 < 6.3.9600.23397

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...

vendor-advisorypatch

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Sep 8, 2026
Vulnerability Reserved
Aug 3, 2026

CVE-2026-69595 Data

JSON