Windows Network Connected Devices Auto-Setup: Remote code execution

Summary

A heap-based buffer overflow in the Windows Network Connected Devices Auto-Setup Service allows an unauthenticated attacker on the same adjacent network to execute code. No user interaction is required, and the CVSS score is 8.8 (High). The service is not internet-facing, and on Windows 10 it only runs when a user, an application or another service requests it, so exposure depends on whether it is active.

Affected

• Microsoft Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9688
• Microsoft Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9487
• Microsoft Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7846
• Microsoft Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7846
• Microsoft Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7711
• Microsoft Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9974
• Microsoft Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9974
• Microsoft Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3501
• Microsoft Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9974
• Windows Server editions: Unknown.

Fixed in

• Security update released on Patch Tuesday, 10 November 2026 (the fixed builds are the upper bounds listed above, as shown in the CVE record; confirm on the MSRC page)
• KB article numbers: Unknown.

Workaround

• No vendor mitigation known.
• Possible interim measure (not vendor-confirmed, test first): stop and disable the Network Connected Devices Auto-Setup service (NcdAutoSetup). This stops automatic discovery and installation of network-connected devices; devices can still be added manually.
• Limit which devices share a LAN segment with Windows endpoints and use client isolation on guest Wi-Fi.

Exploitation

• No exploitation in the wild found in the sources reviewed. The CISA KEV catalogue was not checked.
• No public proof-of-concept found.

Our recommendation

• Patch affected Windows systems, starting with shared LANs and Windows 10 1607 and 1809 devices. Check whether these versions still receive updates.
• Confirm the fixed builds and Server exposure on the MSRC page.
• If patching is delayed, disable the NcdAutoSetup service where it is not needed, after testing.
• Segment networks and isolate guest Wi-Fi to limit adjacent-network access.
• Check the CISA KEV catalogue and NVD once analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center: CVE-2026-125136 msrc.microsoft.com
• strix.ai: CVE-2026-125136 (secondary source) www.strix.ai
• Cryptika: Microsoft November 2026 Patch Tuesday www.cryptika.com
• batcmd.com: NcdAutoSetup service (Windows 10) batcmd.com
• revertservice.com: NcdAutoSetup service revertservice.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:06.