Windows Services for NFS CVE-2026-69595

Exploitation requires the target Windows Server to have the optional Services for NFS role installed and the ONCRPC/NFS RPC endpoint (typically portmapper TCP/UDP 111 and NFS 2049) reachable by the attacker; the vulnerable ONCRPC XDR driver is not present or exposed on default installations without this role. Given CVSS PR:N/UI:N, no authentication or user interaction is needed once the service is reachable - the primary limiting factors are the non-default NFS role and network exposure of the RPC ports, not any credential or interaction requirement.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes an ideal remote-unauthenticated RCE, and the SSVC-relevant signals - network reachable, no privileges, no user interaction, total technical impact - all point to high priority IF the role is exposed. The critical real-world qualifier absent from the raw score is that Services for NFS is an OPTIONAL server role that is NOT installed by default; only hosts running NFS shares expose the ONCRPC XDR driver, which sharply narrows the actual attack surface versus the 9.8 headline. No EPSS score, KEV listing, or public PoC was provided, so there is no evidence of active exploitation - the priority is driven by severity and unauthenticated reachability, not observed in-the-wild activity. Use-after-free RCE in a kernel-mode driver is genuinely dangerous where NFS is enabled, but AC:L may understate the heap-grooming/race reliability typically needed to weaponize a UAF into reliable code execution.

An attacker with network reachability to a Windows Server that has the Services for NFS role enabled sends a crafted ONCRPC message with malformed XDR-encoded data to the NFS/RPC endpoint, driving the XDR driver to reference a freed object. By grooming the pool to control the freed allocation, the attacker converts the use-after-free into arbitrary code execution in the driver's privileged context. No public exploit is identified at time of analysis, but the unauthenticated network vector makes exposed NFS servers realistic targets.