IT SBIT Services
Schneeberger
DEEN
CVE tracker

Windows Client for NFS: Security feature bypass vulnerability

CVE-2026-119404Medium 5.9

← All vulnerabilities

Summary

Improper access control in the Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network. The attack complexity is rated High, no privileges or user interaction are required, and the impact is limited to integrity. Microsoft's CVSS score is 5.9 (MEDIUM). Exposure mainly concerns Windows clients that mount NFS shares over networks an attacker could reach.

Affected

  • Windows 10 Version 1607 (Build before 10.0.14393.9688)
  • Windows 10 Version 1809 (Build before 10.0.17763.9487)
  • Windows 10 Version 21H2 (Build before 10.0.19044.7846)
  • Windows 10 Version 22H2 (Build before 10.0.19045.7846)
  • Windows 11 Version 23H2 (Build before 10.0.22631.7711)
  • Windows 11 Version 24H2 (Build before 10.0.26100.9974, see note on conflicting data)
  • Windows 11 Version 25H2 (Build before 10.0.26200.9974)
  • Windows 11 Version 26H1 (Build before 10.0.28000.3501)
  • Windows 11 Version 26H2 (Build before 10.0.26300.9974)
  • Windows Server 2016, including Server Core (Build before 10.0.14393.9688)
  • Windows Server 2019, including Server Core (Build before 10.0.17763.9487)
  • Windows Server 2022 (Build before 10.0.20348.5870)

Fixed in

Install the November 2026 cumulative update for the affected Windows version (Patch Tuesday, 10 Nov 2026). The fixed builds are listed in the Affected section. The KB numbers could not be confirmed; check the Microsoft Security Update Guide before rollout.

Workaround

No specific workaround is documented. Where patching is delayed, disable the Client for NFS feature on endpoints that do not need to mount NFS shares. This is not confirmed by Microsoft for this CVE.

Exploitation

  • No exploitation in the wild known; not listed in CISA KEV.
  • No public proof-of-concept exploit found.
  • Rapid7 rates exploitation as less likely.
  • CISA SSVC: exploitation none, not automatable.

Our recommendation

  • Install the November 2026 cumulative update on all affected Windows 10, Windows 11 and Windows Server systems.
  • Prioritise machines that mount NFS shares over the network.
  • Disable the Client for NFS feature where it is not required.
  • Check the Microsoft advisory for the exact fixed build before relying on version numbers from third parties.
  • Monitor for unusual NFS access and related security events.

Information from Microsoft (Patch Tuesday November 2026)

Severity (Microsoft)
Important
Impact
Security feature bypass – Windows Client for NFS
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows, Windows ESU (Extended Security Updates)
Updates (KB)
KB5131291, KB5131085, KB5131096, KB5131090, KB5131087, KB5132061

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:16.

Original description (NVD)

Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed