What is the CVSS score of CVE-2026-56650?

CVE-2026-56650 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows Network File System are affected by CVE-2026-56650?

CVE-2026-56650 exposes organizations running Windows NFS services to privilege escalation risks that could give authenticated attackers full system control.. A patch is available.

How to fix or mitigate CVE-2026-56650?

Immediately conduct an inventory of Windows 10, 11, and Server 2012-2025 systems with NFS enabled to establish baseline exposure. Within 7 days, deploy the Microsoft MSRC patch across critical systems and production environments according to your change management process. By day 30, ensure patch deployment is complete across all affected infrastructure, validate functionality through regression testing, and configure patch compliance monitoring to detect regressions.

Windows Network File System CVE-2026-56650

EUVD-2026-44264 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-w2xr-m9cj-6q3w

Buffer Overflow Heap Overflow Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local privilege escalation from an existing low-privileged foothold (AV:L, PR:L), no user interaction, low complexity, yielding full SYSTEM-level C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 19:01 vuln.today

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Network File System (NFS) component allows an authenticated attacker to elevate to SYSTEM by triggering a heap-based buffer overflow (CWE-122). Reported by Microsoft and affecting a broad range of Windows 10, Windows 11, and Windows Server 2012-2025 releases, with a vendor patch available via MSRC. No public exploit identified at time of analysis, and no CISA KEV listing.

Technical ContextAI

The flaw resides in the Windows Network File System (NFS) subsystem, which implements the Sun RPC/ONC NFS protocol server that Windows Server can expose to allow UNIX/Linux clients to mount Windows-hosted shares. The root cause is CWE-122 (heap-based buffer overflow): memory allocated on the heap is written past its bounds, corrupting adjacent heap structures. NFS request parsing in kernel/driver context is a classic source of such overflows because attacker-influenced length or offset fields can drive undersized allocations or oversized copies. The CPE set spans microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server_2012 through 2025, indicating shared vulnerable NFS code across the servicing branches.

RemediationAI

Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-56650 for each affected OS build via Windows Update / WSUS; consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56650 for the exact KB and patched build number per SKU (the input does not specify a single fix version, so use the MSRC per-product build). As a compensating control where patching must be deferred, disable or uninstall the Server for NFS role on hosts that do not require UNIX/Linux client interoperability (Remove-WindowsFeature FS-NFS-Service), which removes the vulnerable service entirely at the cost of breaking NFS exports; alternatively restrict local logon and code-execution rights on NFS-enabled servers to trusted admins to raise the bar for the required local foothold. Since exploitation is local (AV:L), tightening who can run code on the host meaningfully reduces exposure until the patch is applied.