CVE-2026-72957

Windows Deployment Services is used to help set up and deploy Windows to other machines. This vulnerability is a “memory handling” bug that can be abused to run code inside the deployment server—like breaking into the tool you use to install software and turning it into a way to run your own commands. If an attacker can reach and trigger the vulnerable part of the service, they can potentially take control of that server.

This matters if you run Windows Deployment Services on the listed Windows versions (including Windows Server and Windows 10) and the service is reachable by someone who already has some level of access to it (authorized attacker). It’s less about random internet attackers and more about the risk if your deployment environment is reachable and usable by users/systems that shouldn’t be able to trigger it. The risk is mainly present when the vulnerable service can be reached and triggered by an authorized attacker through the normal deployment workflow.

Treat this as urgent because it’s a remote code execution issue against a server role (Windows Deployment Services) where an attacker who can interact with the service may be able to run code. Even though it is not in CISA KEV and there’s no public exploit code on record, the impact is high enough that you should patch quickly to reduce the chance of abuse of your deployment infrastructure.