CVE-2026-71330

Windows Services for NFS's ONCRPC XDR driver exposes sensitive system information to an unauthorized control sphere (CWE-497), letting unauthenticated network attackers read data they should not be able to access. The flaw is triggered remotely over the network with no privileges, no user interaction, and low attack complexity, simply by reaching the affected ONCRPC/XDR service. An attacker gains disclosure of sensitive system information only; there is no integrity or availability impact per the CVSS vector. Affected systems are Windows hosts with the Services for NFS (ONCRPC XDR driver) component installed and reachable over the network, though the specific affected Windows version ranges were not included in the available data. As of this analysis there is no known exploitation in the wild, no public proof-of-concept, and the flaw is not in CISA's KEV catalog; EPSS puts 30-day exploitation probability at 0.8% (54th percentile).

What to do: Apply Microsoft's security update for CVE-2026-71330 when it is released via Windows Update. Until patched, audit Windows hosts (especially servers) for the enabled Services for NFS / Client for NFS feature and restrict or firewall NFS/ONCRPC-related network exposure (e.g., NFS and portmapper ports such as 2049 and 111) to trusted networks, or disable the feature entirely where it is unused.