What is the CVSS score of EUVD-2026-44261?

EUVD-2026-44261 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Windows Server 2012 EUVD-2026-44261

Q: Which versions of Windows Server 2012 are affected by EUVD-2026-44261?

A remote code execution vulnerability in Microsoft's Windows Network File System server role (CVE-2026-56649, CVSS 8.1) affects Windows Server 2012-2025 and Windows 10/11 installations where NFS is…. A patch is available.

Q: How to fix or mitigate EUVD-2026-44261?

Within 24 hours, conduct an inventory of all Windows systems with the NFS server role enabled across the organization. Within 7 days, test and deploy the Microsoft security patch for all affected Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025) and Windows client (10, 11) systems. Within 30 days, complete the patching deployment across your entire environment, validate NFS connectivity and functionality, and establish monitoring for NFS-related anomalies.

| CVE-2026-56649 HIGH

Race Condition (CWE-362)

2026-07-14 microsoft

GHSA-32pv-2j2r-jjwx

Authentication Bypass Race Condition Microsoft Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025 Windows 10 Version 1607 Windows 10 Version 1809 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows Server 2016 Server Core Installation Windows Server 2019 Server Core Installation Windows 11 Version 24H2 Windows 11 Version 25H2 Windows 11 Version 26H1 Windows Server 2025 Server Core Installation Windows Server 2012 Server Core Installation Windows Server 2012 R2 Windows Server 2012 R2 Server Core Installation

8.1

CVSS 3.1 · NVD

Temporal: 5.2

View

Vulnerability Assessment

Weakness

CWE

CWE-362

OWASP Top 10:2025

A06:2025 - Insecure Design

ASVS 5.0

V15 - Secure Coding and Architecture Concurrency control, locking

MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Remote code execution in Microsoft's Windows Network File System (NFS) server role affects a broad range of Windows client and server builds from Windows Server 2012 through Windows Server 2025 and Windows 10/11. An unauthenticated network attacker who wins a race condition in a shared NFS resource can execute arbitrary code on the target. There is no public exploit identified at time of analysis and CISA SSVC rates exploitation as none; EPSS is low at 0.64% (47th percentile), consistent with the high attack complexity of racing the vulnerable code path.

Affected VersionsENISA

Windows Server 2016 (Server Core installation) 10.0.14393.0 <10.0.14393.9339

Windows 11 version 26H1 10.0.28000.0 <10.0.28000.2525

Windows Server 2016 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 1607 10.0.14393.0 <10.0.14393.9339

Windows 10 Version 21H2 10.0.19044.0 <10.0.19044.7548

Windows Server 2022 10.0.20348.0 <10.0.20348.5386

Windows Server 2012 R2 6.3.9600.0 <6.3.9600.23291

Windows Server 2012 (Server Core installation) 6.2.9200.0 <6.2.9200.26226

Windows 11 Version 25H2 10.0.26200.0 <10.0.26100.8875

Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 <6.3.9600.23291

Windows 10 Version 1809 10.0.17763.0 <10.0.17763.9020

Windows 11 Version 24H2 10.0.26100.0 <10.0.26100.8875

Windows Server 2025 (Server Core installation) 10.0.26100.0 <10.0.26100.33158

Windows 10 Version 22H2 10.0.19045.0 <10.0.19045.7548

Windows Server 2019 (Server Core installation) 10.0.17763.0 <10.0.17763.9020

Windows Server 2012 6.2.9200.0 <6.2.9200.26226

Windows Server 2025 10.0.26100.0 <10.0.26100.33158

Windows Server 2019 10.0.17763.0 <10.0.17763.9020

Affected Packages

euvd windows_10_version_1607 fix: 10.0.14393.9339

euvd windows_10_version_1809 fix: 10.0.17763.9020

euvd windows_10_version_21h2 fix: 10.0.19044.7548

euvd windows_10_version_22h2 fix: 10.0.19045.7548

euvd windows_11_version_24h2 fix: 10.0.26100.8875

euvd windows_11_version_25h2 fix: 10.0.26100.8875

euvd windows_11_version_26h1 fix: 10.0.28000.2525

euvd windows_server_2012 fix: 6.2.9200.26226

euvd windows_server_2012_r2 fix: 6.3.9600.23291

euvd windows_server_2012_r2_server_core_installation fix: 6.3.9600.23291

euvd windows_server_2012_server_core_installation fix: 6.2.9200.26226

euvd windows_server_2016 fix: 10.0.14393.9339

euvd windows_server_2016_server_core_installation fix: 10.0.14393.9339

euvd windows_server_2019 fix: 10.0.17763.9020

euvd windows_server_2019_server_core_installation fix: 10.0.17763.9020

euvd windows_server_2022 fix: 10.0.20348.5386

euvd windows_server_2025 fix: 10.0.26100.33158

euvd windows_server_2025_server_core_installation fix: 10.0.26100.33158

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 18 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Know when Windows Server 2012 gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY MEDIUM

NVD 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal) 5.2 MEDIUM

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Severity Changed

Jul 17, 2026 - 13:52 NVD

MEDIUM HIGH

CVSS changed

Jul 17, 2026 - 13:52 NVD

5.9 (MEDIUM) 8.1 (HIGH)

CVE Published

Jul 14, 2026 - 17:09 cve.org

MEDIUM 5.9

CVE Published

Jul 14, 2026 - 17:09 nvd

HIGH 8.1

DescriptionNVD

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.

Executive ViewAI

Why It Matters

A remote code execution vulnerability in Microsoft's Windows Network File System server role (CVE-2026-56649, CVSS 8.1) affects Windows Server 2012-2025 and Windows 10/11 installations where NFS is enabled. Although no public exploit has been identified at time of analysis, an unauthenticated attacker could execute arbitrary code by exploiting a race condition in shared NFS resources, potentially compromising file servers and exposing sensitive data. The broad reach across Windows infrastructure makes patching this vulnerability a priority for organizations with Windows-based file services.

Recommended Action

Within 24 hours, conduct an inventory of all Windows systems with the NFS server role enabled across the organization. Within 7 days, test and deploy the Microsoft security patch for all affected Windows Server (2012, 2012 R2, 2016, 2019, 2022, 2025) and Windows client (10, 11) systems. Within 30 days, complete the patching deployment across your entire environment, validate NFS connectivity and functionality, and establish monitoring for NFS-related anomalies.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.6%

Top 53% exploitable

Vendor Action

See Below

Required. The vulnerability documented by this CVE requires customer action to resolve.

Vendor Status

Publicly Disclosed:No

Exploited:No

Latest Software Release:Exploitation Unlikely

Data Quality

6 sources

Confidence: High

EUVD 🇯🇵JVN

NVD

CVE.org

EPSS

Vulnrichment MSRC

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.6%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).