Windows NFS CVE-2026-69772

The NFS Server role (Services for NFS) or NFS Client feature must be explicitly installed and active on the target Windows system - neither is enabled by default on most Windows configurations, making this an opt-in attack surface primarily relevant to Windows Server environments providing Unix/Linux interoperability. The CVSS UI:R metric indicates that some user or process interaction is required to trigger the vulnerable NFS parsing path; the specific interaction is not detailed in the description but is consistent with a client mounting an NFS share, initiating a file operation against a malicious NFS server, or a server-side processing path requiring a client to initiate a session. Exploitation is limited to Windows systems where NFS is explicitly configured and reachable over the network; systems where NFS services are disabled, not installed, or firewalled from untrusted networks are not exposed.

CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) signals high severity with a network attack vector, low complexity, and full C/I/A impact, but the UI:R constraint differentiates this from fully wormable exploits and reduces the likelihood of mass automated exploitation compared to UI:N network bugs. No KEV listing and no public exploit code has been identified, consistent with a standard Microsoft Patch Tuesday disclosure cycle. EPSS data was not provided in source intelligence. The extremely broad affected version range - from legacy Windows Server 2012 through current Windows 11 and Windows Server 2025 - means organizations running NFS services face significant exposure, and even a mid-sized IT team managing a mixed-generation Windows estate should treat patching as urgent, particularly for any system where the NFS server role or NFS client feature is enabled. Heap overflow primitives in network-accessible services are historically reliable for weaponization once technical details emerge publicly, so the current absence of exploit code should not be treated as a durable protection.

An attacker positions themselves to interact with a Windows system running NFS services - either by hosting a malicious NFS server that a victim client mounts, or by sending crafted NFS protocol messages to a Windows NFS server. When a user or automated process initiates an NFS file operation (satisfying the UI:R requirement), the malformed data triggers a heap-based buffer overflow in the Windows NFS parsing routine. Successful exploitation overwrites heap metadata or a function pointer, redirecting execution to attacker-controlled code and achieving remote code execution in the context of the NFS service process. No public proof-of-concept has been identified at time of analysis.