EUVD-2026-100104
GHSA-x4v7-2fxm-qhq5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WDS service over network
-
DeliverySend timed concurrent requests
-
ExploitWin race-condition window
-
ExecutionCorrupt shared resource state
-
ImpactExecute arbitrary code on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target to have the optional Windows Deployment Services (WDS) server role installed and reachable over the network (PXE/TFTP/WDS endpoints) - WDS is not enabled by default on Windows Server, so non-imaging servers are not exposed. No authentication and no user interaction are needed (PR:N/UI:N). The principal limiting factor is the race condition itself (AC:H): the attacker must repeatedly attempt to win a narrow timing window in access to a shared resource, which SSVC rates as not automatable, substantially reducing reliable and large-scale exploitation. Affected builds span Windows Server 2012 through Server 2025 (and Windows 10 1607/1809) below the patched build numbers listed in EUVD. |
| Impact | Signals are moderately conflicting and point to a serious-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, base 8.1) describes remote, unauthenticated code execution with total CIA impact, which is high severity. However, AC:H reflects the inherent difficulty of CWE-362 race conditions - the attacker must reliably win a timing window, which resists weaponization. CISA's SSVC framework reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (the race cannot be reliably scripted at scale), with Technical Impact=total (consistent with C:H/I:H/A:H). There is no KEV listing and no POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: a genuinely high-impact flaw that is NOT currently a drop-everything emergency - prioritize patching WDS servers in the normal expedited cycle, but the AC:H + SSVC Automatable=no signals argue against imminent mass exploitation. One caveat: the input Tags include 'Authentication Bypass', which is not supported by the CWE-362 classification or the description (a race-condition RCE); treat that label with caution and verify against the Microsoft advisory. |
| Exploit ScenarioDerived | An attacker with network reachability to a server running the Windows Deployment Services role repeatedly sends crafted requests timed to hit a race window in WDS's handling of a shared resource, and on a successful timing win triggers memory corruption or state confusion that yields code execution in the WDS service context. No authentication or user interaction is required (PR:N/UI:N), but reliable exploitation demands repeated attempts to win the race (AC:H). No public exploit code is identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Remote code execution in Windows Deployment Services (WDS) on affected Windows Server and Windows 10 systems allows an unauthenticated, remote attacker to exploit a race condition (CWE-362) in shared resource synchronization to execute arbitrary code, but the high attack complexity (AC:H) and lack of automation make reliable exploitation difficult. WDS is an optional role not enabled by default, so only servers actively using WDS for network imaging are exposed. No public exploit code or active exploitation has been reported (SSVC exploitation: none), and the vulnerability is not automatable per CISA SSVC. The assessed CVSS score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating total technical impact if successfully exploited. The 'Authentication Bypass' tag suggests the race may also bypass authentication, but the primary effect is network code execution.
RemediationAI
Apply vendor-released patches that bring systems to the fixed builds: Windows Server 2025 to 10.0.26100.33650 or later; Windows Server 2022 to 10.0.20348.5761 or later; Windows Server 2019 and Windows 10 1809 to 10.0.17763.9376 or later; Windows Server 2016 and Windows 10 1607 to 10.0.14393.9612 or later; Windows Server 2012 to 6.2.9200.26434 or later; and Windows Server 2012 R2 to 6.3.9600.23470 or later, as per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88174. If patching cannot be applied immediately, mitigating controls include disabling or uninstalling the Windows Deployment Services role on servers that do not require it (trade-off: eliminates WDS-based imaging), and restricting network access to WDS-related ports (PXE/TFTP/WDS endpoints) to trusted imaging subnets only (trade-off: may disrupt legitimate remote imaging workflows). Since the race condition requires repeated attempts, reducing network exposure and monitoring for anomalous WDS traffic can further lower risk. No workaround is as effective as applying the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying technology is Windows Deployment Services (WDS), a Windows Server role that provides PXE boot, TFTP, and multicast deployment services for OS imaging. The vulnerability is a race condition (CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization) in WDS, where improper synchronization of a shared resource allows an attacker to bypass authentication or execute code. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the attack is network-based, requires no privileges or user interaction, but has high attack complexity due to the need to win a narrow timing window. The SSVC decision points (Exploitation: none, Automatable: no, Technical Impact: total) reinforce that while impact is severe, exploitation is difficult and not currently observed. Affected products per EUVD include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations) as well as Windows 10 versions 1607 and 1809, all below specific patched build numbers.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-facing WDS service with no auth or interaction (AV:N/PR:N/UI:N); AC:H because exploitation depends on winning a race window; total impact gives C:H/I:H/A:H within the service's scope (S:U).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Executive ViewAI
A high-severity remote code execution flaw in the optional Windows Deployment Services (WDS) role on Windows Server and Windows 10 could allow an unauthenticated network attacker to run arbitrary code on imaging infrastructure, though successful exploitation requires winning a race condition and is assessed as difficult and non-automatable. Only organizations that have deliberately enabled WDS for network-based system imaging are exposed - default deployments are unaffected, limiting the blast radius largely to IT engineering and build teams. Leadership should care because a compromised WDS server sits at the heart of endpoint provisioning and could be used to distribute malicious images across the estate, but the absence of any public exploit or observed activity means this is a manage-through-patching item rather than an emergency.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Exploit-DB