Improper access control in Windows Deployment Services

CVE-2026-0386 is a Windows Deployment Services flaw tied to *hands-free deployment* using Unattend.xml. Microsoft says the risk appears when that answer file is sent over an unauthenticated RPC channel, allowing an attacker on an *adjacent network* to intercept sensitive deployment data and potentially turn that into credential theft or code execution. Affected ranges span WDS-capable Windows Server releases before the January 13, 2026 fixes, including Windows Server 2008 SP2/2008 R2 SP1 under Premium Assurance, 2012/2012 R2 under ESU, 2016 <10.0.14393.8783, 2019 <10.0.17763.8276, 2022 <10.0.20348.4648, Server 23H2 <10.0.25398.2092, and 2025 <10.0.26100.32230.

Microsoft's HIGH 7.5 rating is technically defensible in a lab, but it overstates day-two enterprise risk. The attack requires *adjacent-network position*, *native WDS usage*, and specifically *hands-free deployment* exposure; Microsoft also states Configuration Manager is not affected because it doesn't use this Unattend.xml mechanism. That combination slashes reachable population, so this lands as a MEDIUM unless your org still runs native WDS on shared or poorly segmented build networks.

Why this verdict

• Down from vendor HIGH: AV:A plus AC:H means this already starts from a constrained, same-segment style position rather than broad remote reachability.
• Reachable population is small: Microsoft says the issue affects native WDS hands-free deployments and explicitly does not affect Configuration Manager's common PXE use case.
• Post-initial-access dynamics matter: requiring adjacent internal network presence implies the attacker has already crossed an earlier control boundary such as NAC, switchport control, or a prior host compromise.
• April hardening reduces exposure further: since April 14, 2026, secure-by-default behavior means defenders had to consciously keep insecure hands-free mode enabled for the vulnerable path to persist.
• Blast radius can still be ugly where it exists: if the answer file contains privileged deployment credentials, compromise of the build network can spill into server or workstation provisioning trust.

Why not higher?

This is not a one-shot internet RCE. The attacker needs adjacent-network position, a live WDS deployment path, native WDS hands-free usage, and an insecure configuration state that many enterprises either never used or stopped using after Microsoft's April 14, 2026 default hardening. Those compound prerequisites are exactly the kind of friction that should drag severity down.

Why not lower?

The impact is still real where WDS is used badly. A compromised build VLAN plus exposed Unattend.xml can leak secrets that matter, and deployment infrastructure has outsized trust over many endpoints. This is too much blast-radius potential to treat as backlog lint or ignore.

1. Force secure mode — Set HKLM\SYSTEM\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend\AllowHandsFreeFunctionality=0 on affected native WDS servers to block unauthenticated answer-file access. For a MEDIUM verdict there is no mitigation SLA, but this is the cleanest compensating control and should be applied at the next approved change if you still run native WDS.
2. Kill insecure exceptions — Hunt for servers where AllowHandsFreeFunctionality=1 keeps insecure hands-free behavior alive. That setting is an explicit risk acceptance; remove it before you forget why it was there.
3. Segment the imaging network — Constrain PXE/WDS traffic to dedicated deployment VLANs and tightly limit who can reach UDP 67/69/4011 and TCP 135/5040. This reduces the already narrow attack surface even further by making adjacent-network preconditions harder to satisfy.
4. Watch WDS debug events — Enable and monitor Microsoft-Windows-Deployment-Services-Diagnostics/Debug for insecure requests and insecure-mode warnings introduced by Microsoft's hardening guidance. This gives you direct evidence of whether the dangerous path is still being exercised.
5. Rotate deployment credentials — If Unattend.xml ever carried local admin or domain-join secrets, rotate them and right-size privileges. This limits the payoff if the file was exposed before you hardened the servers.

Run this on the target Windows Server that hosts WDS, locally or through PowerShell Remoting, as an Administrator. Invoke it with powershell.exe -ExecutionPolicy Bypass -File .\Test-CVE-2026-0386.ps1; it checks whether the WDS role is present, whether the server build is below Microsoft's fixed threshold, and whether the insecure override AllowHandsFreeFunctionality=1 is still enabled.

# Test-CVE-2026-0386.ps1

# Checks Windows Deployment Services exposure for CVE-2026-0386.

# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN


$ErrorActionPreference = 'Stop'

function Get-VersionObject {
    param([string]$Version)
    try { return [version]$Version } catch { return $null }
}

function Get-FixedVersion {
    param([string]$ProductName)

    switch -Regex ($ProductName) {
        'Windows Server 2025' { return '10.0.26100.32230' }
        'Windows Server 2022' { return '10.0.20348.4648' }
        'Windows Server 2019' { return '10.0.17763.8276' }
        'Windows Server 2016' { return '10.0.14393.8783' }
        'Windows Server 2012 R2' { return '6.3.9600.22968' }
        'Windows Server 2012' { return '6.2.9200.25868' }
        'Windows Server 2008 R2' { return '6.1.7601.28117' }
        'Windows Server 2008' { return '6.0.6003.23717' }
        default { return $null }
    }
}

try {
    $feature = Get-WindowsFeature -Name WDS -ErrorAction SilentlyContinue
    if (-not $feature -or -not $feature.Installed) {
        Write-Output 'PATCHED: WDS role not installed; host not affected by native WDS hands-free path.'
        exit 0
    }

    $cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $productName = [string]$cv.ProductName
    $currentVersion = '{0}.{1}.{2}.{3}' -f $cv.CurrentMajorVersionNumber, $cv.CurrentMinorVersionNumber, $cv.CurrentBuild, $cv.UBR

    if (-not $cv.CurrentMajorVersionNumber) {
        # Older OSes may not have CurrentMajorVersionNumber; derive from CurrentVersion/CurrentBuild/UBR.

        $base = if ($cv.CurrentVersion) { [string]$cv.CurrentVersion } else { '0.0' }
        $build = if ($cv.CurrentBuild) { [string]$cv.CurrentBuild } else { '0' }
        $ubr = if ($cv.UBR -ne $null) { [string]$cv.UBR } else { '0' }
        $currentVersion = "$base.$build.$ubr"
    }

    $fixedVersion = Get-FixedVersion -ProductName $productName
    $cur = Get-VersionObject $currentVersion
    $fix = Get-VersionObject $fixedVersion

    $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\WdsServer\Providers\WdsImgSrv\Unattend'
    $allowValue = $null
    if (Test-Path $regPath) {
        try {
            $allowValue = (Get-ItemProperty -Path $regPath -Name 'AllowHandsFreeFunctionality' -ErrorAction Stop).AllowHandsFreeFunctionality
        } catch {
            $allowValue = $null
        }
    }

    if (-not $fix -or -not $cur) {
        Write-Output "UNKNOWN: Unable to map or parse OS version. Product='$productName' Current='$currentVersion' Fixed='$fixedVersion'."
        exit 2
    }

    if ($cur -lt $fix) {
        Write-Output "VULNERABLE: WDS installed and OS build $currentVersion is below fixed threshold $fixedVersion for $productName."
        exit 1
    }

    if ($allowValue -eq 1) {
        Write-Output "VULNERABLE: WDS installed, patched build present, but AllowHandsFreeFunctionality=1 keeps insecure hands-free deployment enabled."
        exit 1
    }

    if ($allowValue -eq 0) {
        Write-Output "PATCHED: WDS installed, OS build $currentVersion meets or exceeds fixed threshold $fixedVersion, and secure mode is enforced (AllowHandsFreeFunctionality=0)."
        exit 0
    }

    Write-Output "UNKNOWN: WDS installed and OS build is patched, but AllowHandsFreeFunctionality is not set. If April 14, 2026 or later hardening is installed, default behavior is secure; otherwise verify manually in WDS diagnostics logs."
    exit 2
}
catch {
    Write-Output ('UNKNOWN: ' + $_.Exception.Message)
    exit 2
}

Sources

1. Microsoft Support KB5074952 - WDS hands-free deployment hardening guidance
2. NVD entry for CVE-2026-0386
3. OpenCVE mirror of CVE record including Microsoft CNA data and CISA ADP enrichment
4. Windows Message Center note on WDS hardening for CVE-2026-0386
5. Microsoft Learn - Network Ports Used by Windows Deployment Services
6. Rapid7 vulnerability database entry with KB mappings
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS overview and data availability