Server for NFS CVE-2026-88115

Exploitation requires the target to be running the Windows Server 'Server for NFS' role/service, which is an optional, non-default feature - hosts without this role are not affected. Per the CVSS vector, no authentication is needed (PR:N) and the attack is network-based (AV:N/AC:L), but exploitation requires user interaction (UI:R), which constrains fully automated remote attack. Affected builds span Windows Server 2012 through 2025 (and Windows 10 1607/1809) below the patched revisions listed in EUVD (e.g., Server 2025 <10.0.26100.33650, Server 2022 <10.0.20348.5761); patched or non-NFS systems are not exploitable.

Signals conflict and should be weighed carefully. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R, C:H/I:H/A:H, score 8.8) indicates a network-reachable, unauthenticated flaw with high impact across confidentiality, integrity and availability, which argues for priority patching. However, CISA's SSVC assessment reports Exploitation: none and Automatable: no (despite Technical Impact: total), and no CISA KEV listing or public POC is present in the input - so there is no evidence of active or scalable exploitation at this time. A further tension exists between the CWE (CWE-125 out-of-bounds READ, typically an information-disclosure/memory-read primitive) and the description's claim of code execution; the 'Information Disclosure' tag aligns with the CWE while 'Buffer Overflow' and the RCE description imply a write/control-flow effect - the exact impact mechanism is not fully reconciled in the available data. No EPSS score was provided, so probabilistic exploitation likelihood cannot be factored in. Net: this is a genuinely high-severity, vendor-patched Windows Server flaw worth prompt remediation on affected hosts, but current intelligence points to a not-yet-exploited, non-automatable issue rather than a mass-exploitation emergency.

An attacker lures or coerces interaction with a victim system running the Server for NFS role (consistent with UI:R) and sends crafted NFS protocol data that triggers an out-of-bounds read, corrupting memory state to achieve code execution over the network. No authentication is required (PR:N), but the required user interaction and the need for the NFS role to be present limit automated, widespread abuse. No public exploit code was identified in the provided data.