CVE-2026-62893

Windows Deployment Services can be used to help computers boot and install Windows over a network (kind of like a “remote installer”). In this bug, the TFTP part of that service can be tricked so an attacker can run code on the server remotely, without needing a login or user action—similar to finding a serious flaw in a remote “open door” that lets someone inside.

This matters if you run Windows Deployment Services (WDS) on any of these systems: Windows 10, Windows Server 2012/2012 R2, 2016, 2019, 2022, or 2025. If WDS’s TFTP service is reachable over the network, attackers can potentially trigger the bug remotely.

The risk is specifically relevant when the vulnerable service is reachable from the network (for example, from other internal networks, or from the internet) rather than only being locally available.

This is marked RED because reported activity ties the vulnerability to exploitation by a high-profile threat actor (Lazarus group). Even without a public exploit package on record, the remote code execution nature means any exposure of the WDS TFTP service should be treated as an immediate patching priority.

1. Confirm exposure

• Determine which machines run Windows Deployment Services (WDS).
• For those machines, confirm whether the WDS TFTP server is enabled and reachable from other networks.
• If you administer WDS in a managed lab or deployment network, verify that no unintended routing/firewall rules expose it to less-trusted networks.

2. Confirm affected versions

• On each WDS server (and any other Windows host running WDS components), capture the exact OS version/build.
• Compare the build number against Microsoft’s fixed versions:
  • Windows 10: fixed in 10.0.14393.9418 and 10.0.17763.9115 and 10.0.17763.9121
  • Windows Server 2012: fixed in 6.2.9200.26280
  • Windows Server 2012 R2: fixed in 6.3.9600.23338
  • Windows Server 2016: fixed in 10.0.14393.9418
  • Windows Server 2019: fixed in 10.0.17763.9115 and 10.0.17763.9121
  • Windows Server 2022: fixed in 10.0.20348.5440 and 10.0.20348.5499
  • Windows Server 2025: fixed in 10.0.26100.33222 and 10.0.26100.33296

3. Upgrade/patch

• Patch each affected system to the fixed version that matches its branch (per Microsoft’s guidance).
• Use Microsoft’s update guidance page for the exact update(s) appropriate to your OS:
  https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893

4. Temporary workaround (if patching is delayed)

• Restrict network access to the WDS TFTP service so it is not reachable from untrusted networks.
• Apply firewall rules to limit access only to the known deployment subnets/administrative hosts that require TFTP.

5. What to monitor after changes

• Confirm the WDS/TFTP service still functions for deployments after patching.
• Review logs on the WDS host for unusual network activity related to deployment/TFTP traffic (especially unexpected sources). If you have central logging, check there as well.

KEV / CISA

• This CVE is not listed in the CISA KEV catalog based on the provided findings.

Severity is critical (CVSS 9.8) and the issue type is use-after-free (CWE-416). Mechanism: a use-after-free condition in the Windows Deployment Services TFTP server can be triggered by a remote attacker over the network, without authentication and without user interaction, resulting in remote code execution.

Exploitation status: no public exploit code is on record, but press reporting indicates exploitation activity involving Lazarus group (treat as credible risk for exposed deployments).

EPSS: a prediction indicates relatively low likelihood on average (do not use the percentage to down-rank exposed systems; this is outweighed by exploitation reporting and the RED verdict).

KEV: not listed in CISA KEV in the provided findings.

Attack vector maturity: remote, unauthenticated network trigger; outcome is full compromise, which typically increases real-world impact if the service is reachable.