CVE-2026-62893

Windows Deployment Services can be used to help computers boot and install Windows over a network (kind of like a “remote installer”). In this bug, the TFTP part of that service can be tricked so an attacker can run code on the server remotely, without needing a login or user action—similar to finding a serious flaw in a remote “open door” that lets someone inside.

This matters if you run Windows Deployment Services (WDS) on any of these systems: Windows 10, Windows Server 2012/2012 R2, 2016, 2019, 2022, or 2025. If WDS’s TFTP service is reachable over the network, attackers can potentially trigger the bug remotely.

The risk is specifically relevant when the vulnerable service is reachable from the network (for example, from other internal networks, or from the internet) rather than only being locally available.

This is marked RED because reported activity ties the vulnerability to exploitation by a high-profile threat actor (Lazarus group). Even without a public exploit package on record, the remote code execution nature means any exposure of the WDS TFTP service should be treated as an immediate patching priority.