Windows Services for NFS CVE-2026-71330

Exploitation requires that the target Windows system has the 'Services for NFS' role or feature explicitly installed and running - this is not enabled by default on any affected Windows edition. The NFS service ports (RPC portmapper on TCP/UDP 111 and NFS on TCP/UDP 2049) must be reachable from the attacker's network position. No authentication credentials are required (PR:N) and no user interaction is needed. Exploitation is limited to systems where an administrator has deliberately installed and enabled the NFS Server or NFS Client role. Systems without this feature installed are not affected regardless of Windows version.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N places this squarely in the high-severity, unauthenticated, network-reachable category with high confidentiality impact - even a mid-sized municipal IT team in inowroclaw managing a Windows-based file-sharing infrastructure should treat this as an urgent patching priority if NFS is in use. That said, the real-world population at risk is constrained: Windows Services for NFS is not installed or enabled by default on any affected Windows edition and requires explicit role/feature activation, which substantially narrows the attack surface compared to vulnerabilities in always-on components like SMB or HTTP. No EPSS score was supplied, no public POC has been identified, and the vulnerability does not appear in CISA KEV, all of which suggest current exploitation risk is low despite the attractive CVSS profile. The confidentiality-only impact (I:N/A:N) further limits blast radius - attackers can read information but cannot directly write data or cause disruption via this vector alone. The primary concern is information harvested being used to stage a follow-on attack.

An attacker on the same network - or reaching the target over an accessible NFS port - sends a malformed or specially crafted ONCRPC XDR-encoded request to the Windows NFS service. The XDR driver processes the request and, due to the CWE-497 flaw, includes sensitive system information (e.g., kernel memory, internal structures, or configuration data) in the response, which the attacker reads without any authentication. No public POC is currently known, but the low-complexity, no-authentication CVSS profile suggests the crafted request would not require sophisticated tooling.