Windows DFS CVE-2026-105723

The target must be a Windows or Windows Server system with the Distributed File System (DFS) component reachable by the attacker over the network; a host not running or not exposing DFS is not affected by this network path. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) exploitation requires no authentication and no user interaction against affected, unpatched builds. The primary limiting factors are therefore network reachability of the DFS service and the system being at a build below the fixed version for its branch (e.g., Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650, Windows 10 1607/Server 2016 below 10.0.14393.9612). The description does not state any additional configuration prerequisite or how the pointer is controlled, so the precise trigger is not described in the available sources.

This vulnerability presents a genuine high-priority concern rather than a high-CVSS-but-low-risk issue, though the signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, with total impact (C:H/I:H/A:H), yielding the 9.8 base score; SSVC corroborates this with Technical Impact: total and Automatable: yes, and the vuln.today Decision label is act_now. However, SSVC Exploitation is 'none' and there is no CISA KEV listing, so exploitation status is: no public exploit identified at time of analysis. EPSS is only 1.15% (66th percentile) - modest, consistent with no observed exploitation yet, so the urgency is driven by severity and automatability rather than evidence of active attacks. A notable tension exists: the description characterizes this as privilege elevation ('allows an unauthorized attacker to elevate privileges over a network'), yet the CVSS vector is a fully unauthenticated network vector with total impact that reads more like remote code execution than classic local EoP - this EoP-labelled-but-network-unauthenticated framing is typical of Microsoft DFS advisories but should be verified against the MSRC advisory to understand the true attack surface. Given act_now, Automatable: yes, and a confirmed patch, this warrants prompt patching despite the low EPSS.

An attacker with network access to a Windows host running the Distributed File System service sends a crafted request that causes the DFS component to dereference an attacker-influenced (untrusted) pointer, corrupting memory. Because the CVSS vector indicates no authentication or user interaction is required (PR:N/UI:N) and SSVC marks the attack Automatable, this could be scripted against exposed DFS endpoints to gain elevated privileges. No public exploit has been identified at the time of analysis.