Windows Deployment Services Remote Code Execution Vulnerability

Are there additional steps I need to take to be protected from this vulnerability?
Admins should take the following steps to be protected from CVE-2026-0386:
Audit existing WDS usage and identify hands-free deployments.
Opt in for protection by configuring the registry settings described in: Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance. This will provide immediate protection.
This security protection will be enabled by default in a future security update release and no additional administrator action will be required.
To address this vulnerability, by default the hands-free deployment feature will not be supported beginning with a security update in a future release in mid-2026.
The legacy WDS workflow transmits unattend.xml over unauthenticated RPC, exposing sensitive credentials during PXE boot. This creates a security risk, including potential machine-in-the-middle (MITM) attacks. To strengthen security posture, Microsoft is enforcing authenticated RPC by default and removing the insecure workflow.
Even in isolated networks, unauthenticated RPC introduces attack surfaces that can be exploited internally. Security best practices require eliminating unencrypted credential transmission and enforcing authenticated channels.
Hands-free deployments that rely on unauthenticated RPC will no longer work by default. Administrators can override this behavior via a registry key (See Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance, but this is not recommended for production environments.
Please see Windows Deployment Services (WDS) boot.wim support for alternate recommendations by Microsoft.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
The attacker must inject themselves into the logical network path between the target and the resource requested by the victim to read or modify network communications. This is called a machine-in-the-middle (MITM) attack.

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
An authenticated attacker could exploit this vulnerability with LAN access.

Security updates
10.0.17763.8276 — https://support.microsoft.com/help/5073723
10.0.20348.4648 — https://support.microsoft.com/help/5073457
10.0.26100.32230 — https://support.microsoft.com/en-us/topic/a6021fd2-b3b7-45a7-b68e-35c28a2a77da
10.0.25398.2092 — https://support.microsoft.com/help/5073450
10.0.14393.8783 — https://support.microsoft.com/help/5073722
6.0.6003.23717 — https://support.microsoft.com/help/5073697
6.0.6003.23717 — https://support.microsoft.com/help/5073700
6.1.7601.28117 — https://support.microsoft.com/help/5073695
6.1.7601.28117 — https://support.microsoft.com/help/5073699
6.2.9200.25868 — https://support.microsoft.com/help/5073698
6.3.9600.22968 — https://support.microsoft.com/help/5073696