CVE-2026-42987: Windows Deployment Services Remote Code Execution Vulnerability

Technical summary

This vulnerability exploits a use-after-free condition (CWE-416) in Windows Deployment Services. Use-after-free flaws occur when a program references memory that has already been freed, allowing an attacker to overwrite or manipulate that memory to achieve code execution. The attack vector is network-based, requires high complexity to exploit, and does not require user interaction or elevated privileges. The impact spans confidentiality, integrity, and availability, meaning successful exploitation could lead to data theft, system compromise, and denial of service.

Business impact

Compromise of WDS infrastructure enables attackers to intercept or modify operating system deployment processes. This can result in widespread deployment of compromised systems across enterprise environments, persistent system access, intellectual property theft, and operational downtime. Organizations using WDS for large-scale OS deployments face particular risk, as a single successful exploit could compromise multiple systems during the deployment lifecycle.

Affected systems

The vulnerability affects Windows Server 2012, 2016, 2019, 2022, and 2025. Organizations running Windows Deployment Services on any of these platforms should prioritize assessment. Windows Server 2012 reached extended support end-of-life in 2023, so patches may not be available; customers should consider migration or network isolation strategies for those systems.

Exploitability

While the vulnerability requires high technical complexity to exploit (indicated by the AC:H vector parameter), it is network-accessible and requires no authentication or user interaction. The vulnerability is not currently documented in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not yet been widely observed; however, this does not indicate low risk. The memory corruption nature of the flaw means exploit development is feasible for skilled adversaries, and WDS exposure on internal networks increases attack surface.

Remediation

Apply security patches from Microsoft as soon as they become available for your affected Windows Server versions. Organizations unable to immediately patch should reduce attack surface by restricting network access to WDS servers, disabling WDS where not actively used, and implementing network segmentation to limit lateral movement if compromise occurs. Verify patching status against the official Microsoft security bulletin before returning systems to production.

Patch guidance

Consult the Microsoft Security Update Guide and the relevant Windows Server security bulletins for CVE-2026-42987 to identify and deploy the appropriate patches for your environment. Test patches in a non-production environment first, particularly if your organization relies heavily on WDS for deployment automation. Document patch deployment dates and verify successful application across all affected servers. Organizations running unsupported Windows Server 2012 should contact Microsoft support or plan migration to a supported version.

Detection guidance

Monitor WDS services for unexpected crashes or restarts, which may indicate exploitation attempts or successful compromise. Enable Windows Event Viewer logging for the Windows Deployment Services component and review for abnormal activity or error conditions. Network intrusion detection systems should be configured to alert on suspicious traffic to WDS service ports. Consider deploying endpoint detection and response (EDR) solutions on WDS servers and connected systems to detect code execution anomalies. Establish a baseline of normal WDS communication patterns to aid in identifying deviations.

Why prioritize this

This vulnerability merits high prioritization due to its network-accessible attack vector, code execution impact, and broad Windows Server version coverage. The high CVSS score reflects the severity of potential compromise. Although currently not in the KEV catalog, the combination of no authentication requirement and widespread infrastructure dependency makes this a strong candidate for active exploitation. Rapid patching minimizes the window of exposure.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects an attack that is network-accessible (AV:N) without requiring credentials or user interaction (PR:N/UI:N), but does require elevated attack complexity (AC:H). The full impact across confidentiality, integrity, and availability (C:H/I:H/A:H) underscores the severity of successful exploitation. The lack of scope change (S:U) means the vulnerability does not cross isolation boundaries, but the overall profile indicates a serious and readily exploitable condition if the technical hurdle is cleared.

Frequently asked questions