High · 7.5 CVE-2026-0386 EUVD-2026-2206GHSA-5v86-jhpq-mr3r

Windows Deployment Services Remote Code Execution Vulnerability

Published Jan 13, 2026 · Updated Jul 30, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Windows Server 2008 R2 Service Pack 1 Product: Windows Server 2008 R2 Service Pack 1 (Server Core installation) Product: Windows Server 2008 Service Pack 2 Product: Windows Server 2008 Service Pack 2 (Server Core installation) Product: Windows Server 2012 Product: Windows Server 2012 (Server Core installation) Product: Windows Server 2012 R2 Product: Windows Server 2012 R2 (Server Core installation) Product: Windows Server 2016 Product: Windows Server 2016 (Server Core installation) Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server 2022, 23H2 Edition (Server Core installation) Product: Windows Server 2025 Product: Windows Server 2025 (Server Core installation) Platform: Windows

Description

Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Windows Server 2008 R2 Service Pack 1	6.1.7601.0 – < 6.1.7601.28117	6.1.7601.28117
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	6.1.7601.0 – < 6.1.7601.28117	6.1.7601.28117
Microsoft	Windows Server 2008 Service Pack 2	6.0.6003.0 – < 6.0.6003.23717	6.0.6003.23717
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	6.0.6003.0 – < 6.0.6003.23717	6.0.6003.23717
Microsoft	Windows Server 2012	6.2.9200.0 – < 6.2.9200.25868	6.2.9200.25868
Microsoft	Windows Server 2012 (Server Core installation)	6.2.9200.0 – < 6.2.9200.25868	6.2.9200.25868
Microsoft	Windows Server 2012 R2	6.3.9600.0 – < 6.3.9600.22968	6.3.9600.22968
Microsoft	Windows Server 2012 R2 (Server Core installation)	6.3.9600.0 – < 6.3.9600.22968	6.3.9600.22968
Microsoft	Windows Server 2016	10.0.14393.0 – < 10.0.14393.8783	10.0.14393.8783
Microsoft	Windows Server 2016 (Server Core installation)	10.0.14393.0 – < 10.0.14393.8783	10.0.14393.8783
Microsoft	Windows Server 2019	10.0.17763.0 – < 10.0.17763.8276	10.0.17763.8276
Microsoft	Windows Server 2019 (Server Core installation)	10.0.17763.0 – < 10.0.17763.8276	10.0.17763.8276
Microsoft	Windows Server 2022	10.0.20348.0 – < 10.0.20348.4648	10.0.20348.4648
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	10.0.25398.0 – < 10.0.25398.2092	10.0.25398.2092
Microsoft	Windows Server 2025	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230
Microsoft	Windows Server 2025 (Server Core installation)	10.0.26100.0 – < 10.0.26100.32230	10.0.26100.32230

Advisories 3

NCSC-2026-0007 Kwetsbaarheden verholpen in Microsoft Windows NCSC-NL (Netherlands) · Apr 10, 2026
WID-SEC-2026-0083 Microsoft Windows : Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2026
MSRC-CVE-2026-0386 Windows Deployment Services Remote Code Execution Vulnerability Microsoft Security Response Center · Jan 13, 2026

References

Windows Deployment Services Remote Code Execution Vulnerability vendor-advisory patch