Microsoft Windows Deployment Services: Local information disclosure

Summary

A flaw caused by improper privilege management in Windows Deployment Services (WDS) allows an authorized local user to read information they should not have access to. Per the CNA record, the impact is limited to confidentiality, with no integrity or availability impact. The attack requires a local logon with low privileges and no user interaction, and is most relevant on shared WDS servers.

Affected

• Windows Server 2016 and 2016 Server Core installation: builds 10.0.14393.0 to before 10.0.14393.9688
• Windows Server 2019 and 2019 Server Core installation: builds 10.0.17763.0 to before 10.0.17763.9487
• Windows Server 2022: builds 10.0.20348.0 to before 10.0.20348.5870
• Windows Server 2025 and 2025 Server Core installation: builds 10.0.26100.0 to before 10.0.26100.33822
• Windows client editions and Windows Server 2012: Unknown.

Fixed in

• Install the November 2026 cumulative updates for the affected Windows Server versions, which provide the builds listed above or later.
• Secondary sources name KB5131090 (Server 2022) and KB5131080 (Server 2025). These are not confirmed by Microsoft and must be verified against the MSRC entry before rollout.
• KB numbers for Server 2016 and 2019: Unknown.

Workaround

Unknown. No vendor-stated mitigation is known.

Exploitation

• Not known to be exploited.
• CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
• Rapid7 rates it 'Exploitation Less Likely'.
• Secondary sources report it is not in the CISA KEV catalog.
• No public proof of concept found.

Our recommendation

• Inventory all WDS servers and confirm their OS build against the MSRC entry.
• Apply the November 2026 cumulative update to all affected WDS hosts, not only for this CVE.
• Limit local logon on WDS servers to administrators.
• Check whether SME deployments still rely on hands-free deployment over WDS, which Microsoft no longer supports by default from April 14, 2026 updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE.org record CVE-2026-112977 www.cve.org
• MSRC Security Update Guide entry msrc.microsoft.com
• Microsoft WDS hands-free deployment hardening guidance support.microsoft.com
• Rapid7 Patch Tuesday review November 2026 www.rapid7.com
• Senserva KB5131090 (Server 2022, secondary) senserva.com
• Senserva KB5131080 (Server 2025, secondary) senserva.com
• Strix.ai CVE-2026-112977 (third-party) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:50.