Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What system configurations would expose this vulnerability?
Servers that have installed the Network File System are exposed to this vulnerability in rpcxdr.sys.
An attacker would require read or write permission to any file on an NFS share on the victim system. If NFS is configured to allow anonymous access, then the victim system would be vulnerable to unauthenticated attackers.
Yes. While servers are much more likely to be exposed to this vulnerability, the security update to rpcxdr.sys applies to all Windows editions in the Security Updates table.
Security updates
10.0.17763.2114 — https://support.microsoft.com/help/5005030
10.0.18363.1734 — https://support.microsoft.com/help/5005031
10.0.19043.1165 — https://support.microsoft.com/help/5005033
10.0.10240.19022 — https://support.microsoft.com/help/5005040
10.0.14393.4583 — https://support.microsoft.com/help/5005043
6.3.9600.20094 — https://support.microsoft.com/help/5005076
6.3.9600.20094 — https://support.microsoft.com/help/5005106
6.2.9200.23435 — https://support.microsoft.com/help/5005099
6.2.9200.23435 — https://support.microsoft.com/help/5005094
Vulnerabilities 1
-
Critical 9.8CVE-2021-26432 EPSS 11%
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Revision history
-
#2
Added FAQ to provide further vulnerability details. This is an informational change only.
-
#1
Information published.
References
-
CVE-2021-26432 Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26432
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss