HIGHCVE-2026-0386Published Modified CNA microsoft
CVE-2026-0386: Windows Deployment Services Remote Code Execution Vulnerability
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
Metrics
- CVSS v3.1
- 7.5
- Severity
- HIGH
- Fixed in
- 6.0.6003.23717
- Affected Products
- 16
Fix available
6.0.6003.237176.1.7601.281176.2.9200.258686.3.9600.2296810.0.14393.878310.0.17763.827610.0.20348.464810.0.25398.209210.0.26100.32230
Affected packages
- Microsoft / Windows Server 2008 R2 Service Pack 1< 6.1.7601.28117 (from 6.1.7601.0)
- Microsoft / Windows Server 2008 R2 Service Pack 1 (Server Core installation)< 6.1.7601.28117 (from 6.1.7601.0)
- Microsoft / Windows Server 2008 Service Pack 2< 6.0.6003.23717 (from 6.0.6003.0)
- Microsoft / Windows Server 2008 Service Pack 2 (Server Core installation)< 6.0.6003.23717 (from 6.0.6003.0)
- Microsoft / Windows Server 2012< 6.2.9200.25868 (from 6.2.9200.0)
- Microsoft / Windows Server 2012 (Server Core installation)< 6.2.9200.25868 (from 6.2.9200.0)
- Microsoft / Windows Server 2012 R2< 6.3.9600.22968 (from 6.3.9600.0)
- Microsoft / Windows Server 2012 R2 (Server Core installation)< 6.3.9600.22968 (from 6.3.9600.0)
- Microsoft / Windows Server 2016< 10.0.14393.8783 (from 10.0.14393.0)
- Microsoft / Windows Server 2016 (Server Core installation)< 10.0.14393.8783 (from 10.0.14393.0)
- Microsoft / Windows Server 2019< 10.0.17763.8276 (from 10.0.17763.0)
- Microsoft / Windows Server 2019 (Server Core installation)< 10.0.17763.8276 (from 10.0.17763.0)
- Microsoft / Windows Server 2022< 10.0.20348.4648 (from 10.0.20348.0)
- Microsoft / Windows Server 2022, 23H2 Edition (Server Core installation)< 10.0.25398.2092 (from 10.0.25398.0)
- Microsoft / Windows Server 2025< 10.0.26100.32230 (from 10.0.26100.0)
- Microsoft / Windows Server 2025 (Server Core installation)< 10.0.26100.32230 (from 10.0.26100.0)
CVSS Vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C