Windows Work Folders CVE-2026-71336

Exploitation requires network-level access to a host running the Work Folder Service and a valid low-privilege credential (PR:L per the provided CVSS vector), such as a standard domain user account or a local account with network logon rights. The Work Folders server role (FS-SyncShareService) must be explicitly installed and running - this role is not present in a default minimal Windows Server installation and must be deliberately added, providing natural exposure reduction for systems that do not use the feature. No user interaction is required once the attacker reaches the service endpoint. The SSVC 'Automatable: no' designation indicates exploitation is not trivially mass-deployable, likely requiring adaptation to specific target memory layout conditions, which limits opportunistic attack scenarios.

The CVSS 8.8 score reflects a network-accessible, low-complexity integer overflow requiring only low-privilege credentials and yielding full confidentiality, integrity, and availability impact - a severe combination on paper. However, the CISA SSVC assessment meaningfully qualifies the urgency: 'Automatable: no' indicates that reliable exploitation is not trivially scriptable or mass-deployable, and 'Exploitation: none' confirms no in-the-wild use has been observed. Together these signals suggest the technical impact is total but exploitation difficulty is non-trivial, likely requiring careful memory layout manipulation or multi-step reliability engineering. No POC code has been identified, further reducing near-term exploitation probability. The wide version range affected - spanning over a decade of Windows Server releases - means the exposure footprint is broad, and even a mid-sized enterprise IT organization managing diverse Windows Server versions should treat this as a priority within normal patch cycles rather than an emergency out-of-band response.

An attacker holding a low-privilege domain or local account connects to a Windows Server with the Work Folder Service enabled and transmits a crafted sync request containing an arithmetic value engineered to trigger an integer wraparound in the service's size calculation logic. The resulting memory corruption corrupts internal data structures, redirecting execution flow within the service process and enabling arbitrary code execution - potentially at elevated privilege depending on the service's runtime context. No public exploit code has been identified at time of analysis.