CVE-2026-71336: Windows Work Folder Service RCE Vulnerability

CVE-2026-71336 Overview

CVE-2026-71336 is an integer overflow vulnerability in the Windows Work Folder Service. An authorized attacker can trigger the flaw over a network to execute arbitrary code on affected systems. The issue is classified under [CWE-190] Integer Overflow or Wraparound. Successful exploitation compromises confidentiality, integrity, and availability of the target host.

Microsoft published the advisory through the Microsoft Security Response Center (MSRC). The vulnerability requires low-privileged authentication but no user interaction, making it a strong candidate for lateral movement in enterprise Windows environments where Work Folders is deployed for file synchronization.

Critical Impact
An authenticated remote attacker can execute code within the Windows Work Folder Service context, enabling lateral movement and full system compromise.

Affected Products

Microsoft Windows (Work Folder Service component)
Windows Server deployments running Work Folders
Windows client editions with Work Folders enabled

Discovery Timeline

2026-09-08 - CVE-2026-71336 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-71336

Vulnerability Analysis

The vulnerability resides in the Windows Work Folder Service, a component that provides file synchronization between user devices and a central file server. The service processes network-supplied length or size fields without adequate bounds validation. An attacker who authenticates to the service can send crafted requests that cause an integer to wrap around during arithmetic operations.

When the wrapped value is used to allocate or index memory, the service writes beyond intended boundaries. This corruption is reachable over the network and yields remote code execution within the Work Folder Service process. The EPSS probability for exploitation stands at 0.852%.

Root Cause

The root cause is an [CWE-190] Integer Overflow or Wraparound condition. The service performs arithmetic on attacker-influenced size or count values without verifying that the result stays within the valid range of the destination type. The truncated value then drives a subsequent memory operation, producing an undersized allocation or an incorrect boundary check.

Attack Vector

Exploitation requires network access to the Work Folder Service endpoint and valid low-privilege credentials. No user interaction is required. The attacker sends a specially crafted protocol message containing size fields chosen to trigger the wraparound. Microsoft has not published exploitation details, and no public proof-of-concept is available. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-71336

Indicators of Compromise

Unexpected crashes or restarts of the Work Folder Service (SyncShareSvc) process on affected hosts.
Anomalous child processes spawned by the Work Folder Service, particularly command interpreters or scripting engines.
Outbound network connections initiated from the Work Folder Service to non-standard destinations.

Detection Strategies

Monitor Windows Event Logs for Work Folder Service errors, Application Error events, and Windows Error Reporting entries tied to the service binary.
Establish endpoint detection rules that flag process creation events where the parent is the Work Folder Service and the child is cmd.exe, powershell.exe, or rundll32.exe.
Baseline normal Work Folders network traffic and alert on oversized or malformed sync requests to the service endpoint.

Monitoring Recommendations

Track authentication events against Work Folders endpoints to identify low-privileged accounts issuing unusual sync operations.
Correlate Work Folder Service anomalies with subsequent lateral movement indicators such as SMB access or credential access telemetry.
Enable command-line auditing and Sysmon process creation logging on servers hosting the Work Folder Service.

How to Mitigate CVE-2026-71336

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide as soon as testing permits.
Inventory all Windows Server and client systems with the Work Folders role or feature enabled and prioritize patching internet-adjacent hosts.
Audit accounts that hold Work Folders access and remove unnecessary privileges to shrink the exploitation surface.

Patch Information

Microsoft addressed CVE-2026-71336 through the Windows security update channel. Refer to the Microsoft Security Update Guide for the specific KB articles and build numbers applicable to each Windows version. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or your preferred patch management platform.

Workarounds

Disable the Work Folders role on servers where it is not required until patches can be deployed.
Restrict network access to the Work Folder Service endpoint using host-based firewalls and network segmentation so that only trusted client subnets can reach it.
Enforce strong authentication and conditional access policies to reduce the pool of accounts that satisfy the low-privilege precondition.

bash

# Check whether the Work Folders role is installed on a Windows Server
Get-WindowsFeature -Name FS-SyncShareService

# Remove the Work Folders role if it is not required
Uninstall-WindowsFeature -Name FS-SyncShareService -Restart

# Restrict inbound access to the Work Folder Service (HTTPS/443) to trusted subnets
New-NetFirewallRule -DisplayName "Restrict Work Folders" -Direction Inbound -Protocol TCP -LocalPort 443 -RemoteAddress 10.0.0.0/8 -Action Allow