Windows NFS CVE-2026-56648

Exploitation requires the target to have the Windows Server for NFS role (or NFS handling) enabled and reachable - this is an optional, non-default Windows feature, which is the primary limiting factor. The attacker must be an authorized/authenticated NFS user (CVSS PR:L), not an anonymous internet actor, and must reliably win a TOCTOU timing race (CVSS AC:H), meaning success is probabilistic and may require repeated attempts. No user interaction is needed (UI:N) and the vector is network-based (AV:N), but the combination of required NFS deployment, existing low privileges, and race-condition timing substantially narrows realistic exploitation compared to the raw 7.5 score.

Signals are moderate and internally consistent for a serious but not trivially exploitable issue. The CVSS base score of 7.5 (High) reflects network reach (AV:N) and full C/I/A impact, but is tempered by AC:H (winning a race condition is timing-dependent and not reliable) and PR:L (the attacker must already be an authenticated/authorized NFS user). No EPSS score was provided, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC is referenced, so this is not confirmed active exploitation - prioritization should rest on patch availability and exposure rather than in-the-wild pressure. Note a data conflict worth flagging: the description states elevation of privilege while the vendor Tags label this 'Information Disclosure' - verify the true impact class against the MSRC advisory, though the CVSS C:H/I:H/A:H is broader than pure information disclosure would imply. Given a patch exists and the affected footprint is limited to hosts with the NFS role enabled, this is a real but manageable priority: patch promptly on NFS servers, lower urgency on hosts without NFS.

An attacker who already holds low-privilege authenticated access as an NFS client repeatedly issues concurrent, precisely timed file operations against a Windows Server for NFS export, aiming to swap a file or its state between the service's permission check and its subsequent use. On a successful race window they cross a privilege boundary to obtain elevated rights (and potentially read/modify protected data). No public exploit is identified at time of analysis, and the AC:H rating reflects that reliably winning the race typically requires many attempts.