CVE-2026-71330: Windows NFS ONCRPC XDR Information Disclosure

CVE-2026-71330 Overview

CVE-2026-71330 is an information disclosure vulnerability in the Windows Services for Network File System (NFS) ONCRPC XDR Driver. The flaw exposes sensitive system information to an unauthorized control sphere, allowing a remote attacker to read data over the network without authentication or user interaction. The weakness is classified under [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere. Microsoft published the advisory through the Microsoft Security Update Guide.

Critical Impact
Unauthenticated remote attackers can disclose sensitive system information from hosts running the Windows Services for NFS role by sending crafted ONCRPC traffic.

Affected Products

Microsoft Windows Server deployments with the Services for NFS role enabled
Windows systems exposing the ONCRPC XDR Driver over the network
Environments providing NFS shares to Unix, Linux, or mixed clients

Discovery Timeline

2026-09-08 - CVE-2026-71330 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-71330

Vulnerability Analysis

The vulnerability resides in the Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) driver used by Windows Services for NFS. The driver deserializes XDR-encoded RPC payloads received from remote clients. Improper handling of these payloads causes the driver to return memory contents or metadata that were not intended for the requesting client.

Because the affected component runs in the network path of the NFS service, a remote attacker can trigger the disclosure without credentials. The impact is limited to confidentiality; integrity and availability are not affected according to the published CVSS vector. Disclosed content may include kernel memory fragments, driver state, or NFS export metadata useful for follow-on attacks.

Root Cause

The root cause is exposure of sensitive system information across a trust boundary, consistent with [CWE-497]. The ONCRPC XDR Driver returns data structures to callers without adequately scrubbing or bounds-checking the fields populated during response construction. This lets remnants of uninitialized or out-of-context memory reach the wire in NFS/ONCRPC replies.

Attack Vector

Exploitation is network-based and requires no privileges or user interaction. An attacker with reachability to the NFS/ONCRPC service ports (typically TCP/UDP 111 for portmapper and TCP/UDP 2049 for NFS) sends crafted XDR-encoded RPC requests. The malformed or edge-case requests coerce the driver into emitting responses that contain information beyond what the RPC procedure should return. The attacker parses these replies to extract sensitive host data.

No public proof-of-concept code is available for this CVE. Refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-71330

Indicators of Compromise

Unexpected inbound ONCRPC or NFS traffic from untrusted networks targeting TCP/UDP 111 and 2049
High volumes of malformed or short-lived RPC requests against the Services for NFS role
Repeated NULL, GETATTR, or portmap DUMP calls from a single external source over a short window

Detection Strategies

Enable NFS server auditing on Windows hosts and forward events to a centralized analytics platform for anomaly review
Deploy network intrusion detection signatures that flag malformed XDR payloads and out-of-spec ONCRPC procedure calls
Baseline normal NFS client behavior and alert on deviations in RPC procedure distribution or reply size

Monitoring Recommendations

Monitor perimeter firewall logs for external access attempts to portmapper and NFS ports
Track patch state of the Services for NFS role across the Windows Server fleet and alert on unpatched hosts
Correlate NFS access anomalies with subsequent authentication or lateral movement events on the same host

How to Mitigate CVE-2026-71330

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Windows hosts running the Services for NFS role
Inventory systems with the NFS Server feature enabled and prioritize internet-exposed or DMZ hosts
Restrict inbound access to ports 111 and 2049 to trusted NFS client subnets only

Patch Information

Microsoft has issued a fix through the Security Update Guide. Administrators should install the corresponding cumulative or security-only update for their Windows Server version. Validate patch installation by confirming the updated build number and by re-scanning affected hosts with a vulnerability scanner that recognizes CVE-2026-71330.

Workarounds

Disable the Services for NFS role on servers where NFS is not required using Uninstall-WindowsFeature FS-NFS-Service
Block ONCRPC and NFS ports at the network edge and enforce segmentation for hosts that must expose NFS internally
Require IPsec or VPN tunneling for NFS traffic to remove unauthenticated attacker reachability

bash

# Configuration example: disable NFS server role and restrict NFS ports at the host firewall
Uninstall-WindowsFeature -Name FS-NFS-Service -Remove

New-NetFirewallRule -DisplayName "Block NFS 2049 inbound (untrusted)" \
  -Direction Inbound -Protocol TCP -LocalPort 2049 \
  -RemoteAddress Any -Action Block

New-NetFirewallRule -DisplayName "Block Portmap 111 inbound (untrusted)" \
  -Direction Inbound -Protocol TCP -LocalPort 111 \
  -RemoteAddress Any -Action Block