Windows Deployment Services CVE-2026-62893

Exploitation requires that the target server has the Windows Deployment Services role installed and running and that the attacker can reach its network-imaging/PXE interface (TFTP/RPC boot services) - WDS is not present on default Windows installations, which is the primary limiting factor. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed once the service is reachable; there is no vendor-stated non-default configuration requirement beyond having the WDS role deployed. In practice WDS is typically confined to internal provisioning subnets, so realistic attackers need a foothold on or routing access to those segments rather than open internet exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the worst-case profile: remote, low-complexity, unauthenticated, no user interaction, with full confidentiality/integrity/availability impact - consistent with the 'execute code over a network' description and the use-after-free class. Counterbalancing signals: there is no CISA KEV entry (not confirmed actively exploited) and no public POC identified, and no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified here. The realistic mitigating factor is deployment surface - WDS is an optional role, not enabled on default Windows installs, so exposure is limited to organizations running network imaging infrastructure. Where WDS is deployed and reachable (often on internal provisioning/PXE segments), this is a genuine critical-priority patch; broad internet-facing exposure is unlikely given WDS's typical LAN-only role. The tags also list 'Denial Of Service' alongside RCE, meaning some exploitation paths may only crash the service rather than achieve code execution - verify with the vendor advisory.

An attacker with access to a network segment where a WDS server is listening sends a crafted sequence of imaging/PXE-boot protocol messages that triggers the use-after-free, grooms the heap to reuse the freed object, and gains code execution on the deployment server - a high-value host that stages OS images for the fleet. No credentials or user interaction are required (PR:N/UI:N), though the attacker must be able to reach the WDS service. No public POC is identified at time of analysis, so this scenario is inferred from the CVSS vector and vulnerability class.