What is the CVSS score of CVE-2026-56194?

CVE-2026-56194 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Windows Server 2012 CVE-2026-56194

Q: Which versions of Windows Server 2012 are affected by CVE-2026-56194?

Organizations running Windows systems with Network File System (NFS) services face a privilege escalation risk that could grant attackers administrative access to critical infrastructure using only…. A patch is available.

Q: How to fix or mitigate CVE-2026-56194?

Within 24 hours, identify all Windows systems with the Server for NFS role using Active Directory queries or configuration management tools; focus your scan on Windows 10 (1607-22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012-2025. Within 7 days, apply the vendor-released patch to all identified NFS systems, prioritizing those accessible from network perimeters and those handling sensitive business data. Within 30 days, verify patch deployment through vulnerability scanning and confirm no systems remain exposed to CVE-2026-56194.

EUVD-2026-44258 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-phqw-5f2g-2fgr

Buffer Overflow Heap Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

View

Vulnerability Assessment

Weakness

CWE

CWE-122

ASVS 5.0

V15 - Secure Coding and Architecture Heap buffer bounds checking

MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.9% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Privilege escalation via a heap-based buffer overflow in the Windows Network File System (NFS) role lets an authenticated, low-privileged network attacker send crafted requests to corrupt server heap memory and gain elevated privileges. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012 through 2025 wherever the Server for NFS role is present. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the 8.8 CVSS with a network-reachable, low-complexity, no-user-interaction profile makes it a meaningful patch priority on NFS hosts.

Affected VersionsENISA

Windows Server 2012 6.2.9200.0 <6.2.9200.26226

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9020

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548

Windows Server 2022 10.0.20348.0 <10.0.20348.5386

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9020

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548

Windows Server 2025 10.0.26100.0 <10.0.26100.33158

Windows Server 2019 10.0.17763.0 <10.0.17763.9020

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875

Windows 11 Version 25H2 10.0.26200.0 <10.0.26100.8875

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2525

Windows Server 2016 10.0.14393.0 <10.0.14393.9339

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26226

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23291

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9339

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23291

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9339

euvd windows_10_version_1809 fix: 10.0.17763.9020

euvd windows_10_version_21h2 fix: 10.0.19044.7548

euvd windows_10_version_22h2 fix: 10.0.19045.7548

euvd windows_11_version_24h2 fix: 10.0.26100.8875

euvd windows_11_version_25h2 fix: 10.0.26100.8875

euvd windows_11_version_26h1 fix: 10.0.28000.2525

euvd windows_server_2012 fix: 6.2.9200.26226

euvd windows_server_2012_r2 fix: 6.3.9600.23291

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23291

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26226

euvd windows_server_2016 fix: 10.0.14393.9339

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9339

euvd windows_server_2019 fix: 10.0.17763.9020

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9020

euvd windows_server_2022 fix: 10.0.20348.5386

euvd windows_server_2025 fix: 10.0.26100.33158

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows Server 2012 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal) 7.7 HIGH

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges over a network.

Executive ViewAI

Why It Matters

Organizations running Windows systems with Network File System (NFS) services face a privilege escalation risk that could grant attackers administrative access to critical infrastructure using only low-level user credentials and network connectivity. The vulnerability affects Windows 10, Windows 11, and all current Windows Server versions when NFS is enabled-a configuration widely deployed in enterprises supporting cross-platform file-sharing environments. Exploitation could enable attackers to pivot laterally through your infrastructure and access sensitive data, making patching a business-critical priority.

Recommended Action

Within 24 hours, identify all Windows systems with the Server for NFS role using Active Directory queries or configuration management tools; focus your scan on Windows 10 (1607-22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2012-2025. Within 7 days, apply the vendor-released patch to all identified NFS systems, prioritizing those accessible from network perimeters and those handling sensitive business data. Within 30 days, verify patch deployment through vulnerability scanning and confirm no systems remain exposed to CVE-2026-56194.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.9%

Top 46% exploitable

Vendor Action

See Below

Required. The vulnerability documented by this CVE requires customer action to resolve.

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Less Likely

Data Quality

5 sources

Confidence: Medium

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.9%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.