CVE-2026-69595

CVE-2026-69595 is a use-after-free memory corruption flaw (CWE-416) in the ONCRPC XDR driver of Microsoft's Windows Services for NFS (Network File System). An unauthenticated remote attacker can trigger it by sending crafted ONCRPC/XDR network traffic to a machine running the NFS service, causing the driver to reference freed memory. Successful exploitation yields arbitrary code execution on the target with full confidentiality, integrity, and availability impact (CVSS 9.8, no credentials or user interaction required). Affected organizations are those that have installed and enabled the optional Services for NFS interoperability feature, primarily on Windows Server in mixed Windows/Unix file-sharing environments; the source data does not specify affected version ranges. No exploitation is publicly known at this time: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS estimates only a 1.1% chance of exploitation within 30 days; Microsoft patched it as part of its record 974-flaw release.

What to do: Apply Microsoft's update for this CVE from the 974-flaw patch release as a priority. If the NFS feature is not needed, disable or remove Services for NFS; otherwise restrict ONCRPC/NFS traffic (typical ports 2049 and 111, TCP and UDP) to trusted networks only. Audit your Windows servers for whether the Services for NFS feature is installed, since it is optional and easily overlooked.