Critical severity · published Aug 11, 2026
CVE-2026-62893
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
9.8
CVSS
1%
EPSS
No
On KEV
Description
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Windows Server 2012 · Microsoft
6.2.9200.0 before 6.2.9200.26280 · source: vendor, NVD
WS
Windows Server 2012 (Server Core installation) · Microsoft
6.2.9200.0 before 6.2.9200.26280 · source: vendor
WS
Windows Server 2012 R2 · Microsoft
6.3.9600.0 before 6.3.9600.23338 · source: vendor
WS
Windows Server 2012 R2 (Server Core installation) · Microsoft
6.3.9600.0 before 6.3.9600.23338 · source: vendor
WS
Windows Server 2016 · Microsoft
10.0.14393.0 before 10.0.14393.9418 · source: vendor, NVD
WS
Windows Server 2016 (Server Core installation) · Microsoft
10.0.14393.0 before 10.0.14393.9418 · source: vendor
WS
Windows Server 2019 · Microsoft
10.0.17763.0 before 10.0.17763.9121 · source: vendor, NVD
WS
Windows Server 2019 (Server Core installation) · Microsoft
10.0.17763.0 before 10.0.17763.9121 · source: vendor
WS
Windows Server 2022 · Microsoft
10.0.20348.0 before 10.0.20348.5499 · source: vendor, NVD
WS
Windows Server 2025 · Microsoft
10.0.26100.0 before 10.0.26100.33296 · source: vendor, NVD
WS
Windows Server 2025 (Server Core installation) · Microsoft
10.0.26100.0 before 10.0.26100.33296 · source: vendor
W1
Windows 10 1607 · Microsoft
before 10.0.14393.9418; before 10.0.14393.9418 · source: NVD
In the news
VulnerabilityHigh
ZDI-26-544: Microsoft Windows Deployment Services Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Windows Server. Authentication is not required to exploit this vulnerability. However, only systems with Windows Deployment Services enabled are vulnerable. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-62893.
Aug 11, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62893
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62893
vendor-advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893
More from Windows Server 2012
10.0
CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability
9.8
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
9.8
CVE-2017-8543
Microsoft Windows Search Remote Code Execution Vulnerability
9.8
CVE-2015-1635
Microsoft HTTP.sys Remote Code Execution Vulnerability
9.0
CVE-2020-1040
Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability