CVE-2026-0386: Windows Deployment Services RCE Flaw

CVE-2026-0386 Overview

CVE-2026-0386 is an improper access control vulnerability in Windows Deployment Services (WDS) that allows an unauthorized attacker to execute arbitrary code over an adjacent network. This vulnerability stems from insufficient access control mechanisms within the WDS component, enabling attackers with network adjacency to exploit the flaw without requiring any user interaction or prior authentication.

Critical Impact
An attacker on an adjacent network can achieve remote code execution on affected Windows Deployment Services installations without authentication, potentially compromising enterprise deployment infrastructure and gaining access to sensitive system images.

Affected Products

Windows Deployment Services (WDS)
Windows Server systems with WDS role enabled
Enterprise deployment infrastructure utilizing WDS

Discovery Timeline

January 13, 2026 - CVE-2026-0386 published to NVD
January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0386

Vulnerability Analysis

This vulnerability is classified under CWE-284 (Improper Access Control), indicating that Windows Deployment Services fails to properly restrict access to critical functionality. The flaw allows an unauthenticated attacker positioned on an adjacent network segment to execute arbitrary code on the target system.

The attack requires network adjacency (such as being on the same LAN segment or having Layer 2 connectivity), which limits exposure compared to fully remote attacks. However, in enterprise environments where WDS is commonly deployed for network-based OS installations, this adjacency requirement is often trivially satisfied by any internal user or compromised endpoint.

While the attack complexity is noted as high, successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected system. WDS typically runs with elevated privileges to perform deployment operations, making successful exploitation particularly damaging.

Root Cause

The root cause is improper access control (CWE-284) within Windows Deployment Services. The service fails to adequately validate or restrict access to certain functions, allowing unauthorized entities on adjacent networks to invoke operations that should require authentication or elevated privileges.

Attack Vector

The attack vector requires adjacent network access, meaning the attacker must be on the same network segment as the target WDS server. This could be achieved through:

Physical presence on the same LAN
Compromising another device on the same network segment
Gaining access through VPN or other network tunneling that provides Layer 2 adjacency

Once positioned on the adjacent network, the attacker can exploit the improper access control without requiring credentials or user interaction. The vulnerability does not require any privileges on the target system, making it accessible to any network-adjacent attacker.

The exploitation mechanism targets the access control weaknesses in WDS network communication protocols. For detailed technical information on the exploitation specifics, refer to the Microsoft Security Update Guide for CVE-2026-0386.

Detection Methods for CVE-2026-0386

Indicators of Compromise

Unusual network traffic patterns to WDS service ports from unexpected internal hosts
Anomalous WDS service behavior or unexpected child processes spawned by WDS components
Authentication-less connections to WDS that result in privileged operations
Unexpected modifications to deployment images or WDS configuration files

Detection Strategies

Monitor network traffic to WDS servers for connections from unauthorized network segments
Implement network segmentation alerts for traffic crossing security boundaries to reach WDS infrastructure
Deploy endpoint detection and response (EDR) solutions to monitor WDS server process behavior and flag anomalous execution patterns
Enable comprehensive Windows event logging for WDS services and review for unusual access patterns

Monitoring Recommendations

Configure SIEM rules to alert on WDS access from non-administrative network segments
Implement baseline monitoring for WDS process behavior and alert on deviations
Monitor for process injection or unusual child process creation from WDS service processes
Enable network flow analysis to detect lateral movement toward WDS infrastructure

How to Mitigate CVE-2026-0386

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-0386 as soon as available
Restrict network access to WDS servers using firewall rules and network segmentation
Limit WDS accessibility to only required administrative network segments
Review and audit WDS server configurations for unnecessary exposure

Patch Information

Microsoft has released security guidance for this vulnerability. Administrators should consult the Microsoft Security Update Guide for CVE-2026-0386 for specific patch information and download links. Apply the relevant security update to all systems running Windows Deployment Services.

Workarounds

Implement strict network segmentation to isolate WDS servers from general user network segments
Use host-based firewalls to restrict WDS service access to specific authorized administrator workstations
Consider temporarily disabling WDS if not immediately required until patches can be applied
Deploy network access control (NAC) to limit which devices can reach WDS server network segments

bash

# Windows Firewall configuration to restrict WDS access
# Limit WDS access to specific administrative subnet
netsh advfirewall firewall add rule name="Restrict WDS Access" dir=in action=allow protocol=any remoteip=10.0.10.0/24 program="%systemroot%\system32\svchost.exe" service=wds
netsh advfirewall firewall add rule name="Block WDS from Other Networks" dir=in action=block protocol=any program="%systemroot%\system32\svchost.exe" service=wds