CVE-2026-62893: Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

CVE-2026-62893 is a remote code execution vulnerability in Windows Deployment Services TFTP Server, rated Critical by Microsoft, with a CVSS 3.1 base score of 9.8 (Critical). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as more likely. The EPSS model estimates a 0.97% probability of exploitation activity in the next 30 days, higher than 62% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday, delivered through 8 security updates (KB5120238, KB5120242, KB5120229, KB5120233 and more). It affects 12 products in 2 product families (Windows, ESU).

Key facts

CVE ID: CVE-2026-62893
Severity: Critical CVSS 9.8
Microsoft severity: Critical
Impact: Remote Code Execution
Exploited in the wild: No
Publicly disclosed: No
Exploitation likelihood: More Likely
Weakness: CWE-416
EPSS: 0.97% (percentile 62%)
CISA KEV: Not listed
Released: 11 August 2026
Last updated: 8 September 2026
Patch Tuesday: August 2026 Patch Tuesday
Product families: Windows, ESU

From the August 2026 Patch Tuesday briefing

Windows Deployment Services (WDS) TFTP Server Remote Code Execution

This impacts the TFTP service used by Windows Deployment Services, commonly present in imaging/provisioning environments. If reachable, an attacker can potentially execute code on the WDS server, which often has privileged network placement and access to deployment assets. This Critical RCE affects Windows Deployment Services (WDS) TFTP Server with CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-416 (Use After Free). The attack scenario is straightforward: if WDS/TFTP is reachable (commonly on imaging networks, PXE environments, or poorly segmented admin VLANs), an unauthenticated attacker can send crafted TFTP traffic to trigger memory corruption and execute code.

From the briefing, written by an AI model from PatchaPalooza's data.

CVSS score and vector

Microsoft scores CVE-2026-62893 at 9.8 (temporal 8.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	High
Integrity impact	High
Availability impact	High
Exploit code maturity	Unproven
Remediation level	Official fix
Report confidence	Confirmed

Description

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Frequently asked questions (Microsoft)

How could an attacker exploit this vulnerability?

An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required..

Affected products (12)

Windows

Product	Security update	Type	Fixed build	Restart
Windows Server 2019	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2019 (Server Core installation)	KB5120238	Security Update	10.0.17763.9121	Yes
Windows Server 2022	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2022 (Server Core installation)	KB5120242 KB5120229	Security Update Security Hotpatch Update	10.0.20348.5499 10.0.20348.5440	Yes Yes
Windows Server 2025 (Server Core installation)	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2025	KB5120233 KB5120228	Security Update Security Hotpatch Update	10.0.26100.33296 10.0.26100.33222	Yes Yes
Windows Server 2016	KB5120418	Security Update	10.0.14393.9418	Yes
Windows Server 2016 (Server Core installation)	KB5120418	Security Update	10.0.14393.9418	Yes

ESU

Product	Security update	Type	Fixed build	Restart
Windows Server 2012	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 (Server Core installation)	KB5120386	Monthly Rollup	6.2.9200.26280	Yes
Windows Server 2012 R2	KB5120385	Monthly Rollup	6.3.9600.23338	Yes
Windows Server 2012 R2 (Server Core installation)	KB5120385	Monthly Rollup	6.3.9600.23338	Yes

Security updates (8)

KB5120238 (Security Update)
KB5120242 (Security Update)
KB5120229 (Security Hotpatch Update)
KB5120233 (Security Update)
KB5120228 (Security Hotpatch Update)
KB5120418 (Security Update)
KB5120386 (Monthly Rollup)
KB5120385 (Monthly Rollup)

NIST NVD data

NVD status: Analyzed
NVD CVSS: 9.8 (CRITICAL)
NVD weakness: CWE-416
Published to NVD: 11 August 2026
NVD last modified: 14 August 2026

Affected configurations (CPE)

Product	Vulnerable versions
windows 10 1607 (x64)	before 10.0.14393.9418
windows 10 1607 (x86)	before 10.0.14393.9418
windows 10 1809 (x64)	before 10.0.17763.9115
windows 10 1809 (x86)	before 10.0.17763.9115
windows server 2012	all listed versions
windows server 2012 r2	all listed versions
windows server 2016	before 10.0.14393.9418
windows server 2019	before 10.0.17763.9115
windows server 2022	before 10.0.20348.5440
windows server 2025 (x64)	before 10.0.26100.33222

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893 (Patch, Vendor Advisory)

Acknowledgments

Nikolai Skliarenko of TrendAI Research

Revision history

Version	Date	Description
1.0	11 August 2026	Information published.
1.1	8 September 2026	Updated software table to remove clients versions because this vulnerability only impacts Windows Servers. This is an informational change only.