Windows Server for NFS: Remote code execution via out-of-bounds read

Summary

A out-of-bounds read in the NFS implementation of Windows Server allows an unauthenticated network attacker to execute code. The CVSS vector requires no privileges, but it also includes user interaction (UI:R), and third-party sources disagree on how the trigger works. The risk is only relevant where the Services for NFS role is installed, and it is highest if an NFS endpoint is reachable from the internet.

Affected

• Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2012 (incl. Server Core): 6.2.9200.0 to before 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): 6.3.9600.0 to before 6.3.9600.23470
• Windows Server 2016 (incl. Server Core): 10.0.14393.0 to before 10.0.14393.9612
• Windows Server 2019 (incl. Server Core): 10.0.17763.0 to before 10.0.17763.9376
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (incl. Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Fixed in the October 2026 security updates.
• Build numbers are from CNA data mirrored by third parties and must be verified on the MSRC page.
• KB5126646 (Server 2025) and KB5126651 (Windows 10 1809 / Server 2019) are named by Tenable. No confirmed KB numbers were found for Windows 10 1607, Server 2012, 2012 R2, 2016 or 2022.

Workaround

• Disable the Services for NFS role on servers that do not need it until the update is installed (third-party recommendation, not confirmed by Microsoft).
• Block external access to NFS with network segmentation and firewall rules. Confirm which ports your NFS server uses first.

Exploitation

• Microsoft rates exploit code maturity as Unproven. Temporal CVSS score: 7.7.
• EPSS: 0.00557 (about 0.56% probability of exploitation within 30 days).
• No public proof-of-concept exploit found.
• No evidence of exploitation in the wild found. The CISA KEV catalog was not checked directly.

Our recommendation

• Check whether the NFS role is installed on any Windows Server.
• If it is, install the October 2026 security update and verify the build number on the MSRC page.
• Windows 10 1607 may be out of support for your licence type. Check Microsoft's lifecycle page.
• Until patched, disable the NFS role where it is not needed and block external access to NFS ports.
• Monitor NFS server logs for unusual activity.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88115 msrc.microsoft.com
• SentinelOne Vulnerability Database: CVE-2026-88115 www.sentinelone.com
• Strix: CVE-2026-88115 www.strix.ai
• Vulners (CIRCL): CVE-2026-88115 vulners.com
• Vulners (VulnCheck/VulnRichment): CVE-2026-88115 vulners.com
• OpenCVE: CVE-2026-88115 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:14.