CVE-2026-69595: Windows NFS ONCRPC XDR Use After Free Flaw

CVE-2026-69595 Overview

CVE-2026-69595 is a use-after-free vulnerability [CWE-416] in the Windows Services for Network File System (NFS) Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) Driver. An unauthenticated attacker can exploit the flaw over the network to execute arbitrary code on an affected system. The vulnerability requires no user interaction and no prior privileges, which broadens the pool of viable targets to any host exposing the NFS service to reachable network segments. Microsoft published the advisory through the Microsoft Security Response Center.

Critical Impact
Unauthenticated remote code execution against Windows systems running the NFS ONCRPC XDR Driver. Full confidentiality, integrity, and availability compromise on successful exploitation.

Affected Products

Windows Services for NFS ONCRPC XDR Driver
Windows Server deployments with the NFS role enabled
Refer to the Microsoft Security Update Guide for the authoritative list of affected builds

Discovery Timeline

2026-09-08 - CVE-2026-69595 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-69595

Vulnerability Analysis

The flaw resides in the ONCRPC XDR Driver, the kernel component responsible for decoding external data representation payloads carried inside ONC RPC messages that back the Windows NFS server. XDR decoding runs before authentication in the NFS request pipeline, which is why exploitation does not require valid credentials. A use-after-free condition allows an attacker-controlled object to be referenced after it has been released, giving the attacker a path to hijack control flow inside the kernel driver. Successful exploitation results in code execution in the security context of the driver, typically SYSTEM.

Because the vulnerable code path is reachable over the network on port 2049 (NFS) and its associated portmapper and mount services, any exposed Windows host running the NFS role is at risk. Compromise of a Windows Server exposing NFS enables lateral movement, credential theft, and persistence across the environment.

Root Cause

The root cause is improper object lifetime management in the ONCRPC XDR decoding path. The driver releases a memory object while another code path retains and later dereferences a stale pointer to it. Attackers who race the free and reuse the allocation with attacker-controlled data can gain arbitrary read, write, or control-flow primitives in kernel memory.

Attack Vector

Exploitation requires network reachability to the NFS RPC endpoints on a vulnerable Windows host. An attacker sends a crafted sequence of ONC RPC messages that trigger the vulnerable XDR decode path, forcing the driver to free an object and then dereference the stale pointer. No authentication or user interaction is required.

No public proof-of-concept exploit is currently referenced in the CVE record, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for vendor-provided technical details.

Detection Methods for CVE-2026-69595

Indicators of Compromise

Unexpected kernel crashes or bugchecks referencing nfssvr.sys, oncrpc.sys, or related NFS driver modules
New or unexplained child processes spawned by NFS service accounts on servers exposing the NFS role
Anomalous outbound connections originating from Windows Server hosts immediately after inbound RPC traffic on port 2049

Detection Strategies

Inspect network traffic to TCP/UDP 2049 and RPC portmapper (111) for malformed or oversized XDR payloads sent by unauthenticated clients
Alert on Windows kernel crash telemetry that references the NFS or ONCRPC driver stack, particularly repeated crashes from the same source address
Correlate inbound NFS traffic with subsequent process creation, service installation, or credential access activity on the same host

Monitoring Recommendations

Enable Windows Defender Firewall logging and audit inbound NFS-related connections from outside trusted subnets
Forward endpoint and network telemetry into a central data lake to enable retrospective hunting for exploitation attempts once signatures become available
Track patch state of the NFS role across the fleet and alert when unpatched hosts expose NFS to untrusted networks

How to Mitigate CVE-2026-69595

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits
Inventory all Windows hosts with the Services for NFS role installed and prioritize internet-exposed or DMZ systems
Restrict inbound access to NFS ports (TCP/UDP 2049, 111, 4045) to trusted subnets using host and network firewalls

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center. Consult the Microsoft Security Update Guide entry for CVE-2026-69595 for affected product builds, KB article numbers, and update packages applicable to each supported Windows Server version.

Workarounds

Disable the Services for NFS role on any Windows host where NFS is not required
Block inbound traffic to NFS RPC endpoints at perimeter and internal segmentation firewalls
Place NFS servers behind IPsec or VPN gateways so that only authenticated hosts can reach the RPC listener

bash

# Verify and disable the Windows NFS server role where it is not required
Get-WindowsFeature -Name FS-NFS-Service
Uninstall-WindowsFeature -Name FS-NFS-Service -Restart

# Restrict inbound NFS RPC traffic to a trusted management subnet
New-NetFirewallRule -DisplayName "Restrict NFS 2049" -Direction Inbound `
  -Protocol TCP -LocalPort 2049 -RemoteAddress 10.0.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block NFS 2049 Default" -Direction Inbound `
  -Protocol TCP -LocalPort 2049 -Action Block