Use after free in Windows Deployment Services

CVE-2026-62893 is a use-after-free in the TFTP server component of Windows Deployment Services (WDS), the built-in PXE boot infrastructure role on Windows Server. An unauthenticated attacker can send a specially crafted UDP packet to port 69 to trigger the UAF and achieve remote code execution as SYSTEM — no credentials, no user interaction. Affected versions include Windows Server 2019, 2022, and 2025 with the WDS role enabled. The flaw was reported through the Zero Day Initiative program and the root cause is a failure to validate an object's existence before performing operations on it.

Microsoft rates this CRITICAL at 9.8, and the CVSS vector (AV:N/AC:L/PR:N/UI:N) is technically accurate — TFTP *is* a network service with no auth. But the vendor score ignores deployment reality. TFTP on UDP 69 is never intentionally exposed to the internet; it exists solely for internal PXE boot on provisioning VLANs. Every real attack path requires the adversary to already be on the internal network. That single prerequisite — post-initial-access positioning — compresses the reachable population dramatically. WDS is also an *optional* server role installed on roughly 11,400 organizations worldwide (per Sumble telemetry), and Microsoft has been actively deprecating it for Windows 11 and Server 2025 deployments. The 9.8 overstates real-world risk; a reassessed HIGH at 7.8 is more honest.

Why this verdict

• Internal-network-only exposure: TFTP/UDP 69 is universally blocked at the perimeter. No scanner data (Shodan, Censys, GreyNoise) shows meaningful internet-facing WDS/TFTP populations. The attacker must already be inside the network, which presupposes a prior compromise and dramatically narrows the reachable attack surface.
• Optional and declining server role: WDS is an opt-in role on ~11.4k organizations. Microsoft is actively deprecating WDS for Windows 11 and Server 2025 workflows. Many enterprises have migrated to SCCM/MDT/Intune/Autopilot. The affected population is a small fraction of the Windows Server installed base.
• Zero-auth, zero-click, zero-complexity once reachable: Despite the narrowed population, the exploit requires *no credentials, no user interaction, and low attack complexity*. Once an attacker has internal network access, finding and exploiting WDS is trivial — DHCP broadcasts the server's address.
• Role multiplier: WDS servers occupy a deployment-trust role — they serve OS images and often store domain join credentials in unattend.xml. A compromised WDS server enables (a) credential theft for AD lateral movement and (b) image poisoning affecting all future PXE-booted machines, an org-internal supply-chain attack. This deployment-trust blast radius (host → fleet for new deployments) sets the verdict floor at HIGH. However, WDS is not a canonical high-value-role component (it is not a DC, hypervisor, IdP, or PAM) and the supply-chain impact only affects *new* deployments, not the existing fleet — so the floor does not reach CRITICAL.
• No active exploitation or public PoC: Zero KEV listing, no observed campaigns, no public exploit code. Microsoft's "Exploitation More Likely" tag acknowledges the low-complexity attack surface but there is no evidence of weaponization today.

Why not higher?

The CRITICAL rating would require either active exploitation, a canonical high-value-role component (DC, hypervisor, IdP), or internet-facing exposure. WDS/TFTP has none of these: the service is internal-only, WDS is an optional role on a declining installed base, and the supply-chain impact (image poisoning) only affects new deployments — not the existing fleet of 10,000 hosts. The UAF also requires heap grooming to achieve reliable exploitation on modern Windows Server with CFG and ASLR, adding practical complexity not captured by the CVSS AC:L rating.

Why not lower?

Zero-authentication, zero-click RCE on a domain-joined server that handles OS deployment is not MEDIUM territory. The complete absence of any credential or interaction requirement means any internal attacker — including commodity malware with lateral-movement capabilities — can reach this. The deployment-trust role (credential storage, image serving) elevates blast radius beyond a typical line-of-business server. Microsoft's own "Exploitation More Likely" assessment and ZDI's prioritization reinforce that weaponization is expected.

1. Block UDP 69 to WDS servers from all non-PXE VLANs — Create firewall rules (host-based via Windows Firewall and network-level via switch ACLs) that restrict UDP 69 access to only the designated PXE boot / provisioning VLAN. This eliminates the attack path from compromised workstations or general server segments. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Disable WDS TFTP if not actively used — Many organizations have WDS installed but dormant after migrating to SCCM/Intune. Run Get-WindowsFeature WDS-* on all servers; if the role is enabled but no active deployments exist, remove it with Remove-WindowsFeature WDS-Transport. This eliminates the attack surface entirely. Deploy within 30 days.
3. Enable Windows Defender Exploit Guard on WDS servers — Configure Control Flow Guard (CFG) and ASLR force-randomization via Exploit Guard policies for the WDS server process (wdstftp.dll / svchost.exe hosting WDSServer). These mitigations raise the bar for reliable UAF exploitation. Deploy within 30 days.
4. Audit and remove credentials from unattend.xml — Review all answer files stored on WDS servers for plaintext or weakly obfuscated domain join credentials and local admin passwords. Replace with secure alternatives (LAPS, MDT credential-free join). This limits blast radius if the server is compromised.
5. Deploy EDR with behavioral detection on WDS servers — Ensure your EDR agent covers the WDS server and has rules for anomalous child processes from svchost.exe, memory corruption indicators, and unauthorized TFTP file access patterns.

Run this on each Windows Server to check if WDS TFTP is installed and whether the August 2026 patch is applied. Execute as Administrator in PowerShell: .\Check-CVE-2026-62893.ps1

#Requires -RunAsAdministrator
<#
  Check-CVE-2026-62893.ps1
  Checks for Windows Deployment Services TFTP vulnerability (CVE-2026-62893)
  Run on target Windows Server hosts as Administrator.
  Exit codes: 0 = PATCHED or not affected, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'

# Step 1: Check if WDS role is installed
$wdsFeature = Get-WindowsFeature -Name WDS-Transport -ErrorAction SilentlyContinue
if (-not $wdsFeature -or $wdsFeature.InstallState -ne 'Installed') {
    Write-Host 'PATCHED — WDS Transport role is not installed. Not affected by CVE-2026-62893.'
    exit 0
}

Write-Host '[!] WDS Transport role is INSTALLED.'

# Step 2: Check if TFTP service is running
$tftpService = Get-Service -Name WDSServer -ErrorAction SilentlyContinue
if ($tftpService -and $tftpService.Status -eq 'Running') {
    Write-Host '[!] WDSServer service is RUNNING — attack surface is active.'
} else {
    Write-Host '[i] WDSServer service is not running (reduced risk, but still patch).'
}

# Step 3: Check for August 2026 cumulative update
# Look for updates installed on or after 2026-08-11
$patchDate = [datetime]'2026-08-11'
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -ge $patchDate } | Sort-Object InstalledOn -Descending

if ($hotfixes.Count -gt 0) {
    $latest = $hotfixes[0]
    Write-Host "PATCHED — Found update $($latest.HotFixID) installed on $($latest.InstalledOn.ToString('yyyy-MM-dd'))."
    Write-Host "Verify this is the August 2026 cumulative update for your OS version."
    exit 0
} else {
    # Also check via Windows Update history
    $session = New-Object -ComObject Microsoft.Update.Session
    $searcher = $session.CreateUpdateSearcher()
    $historyCount = $searcher.GetTotalHistoryCount()
    $history = $searcher.QueryHistory(0, [Math]::Min($historyCount, 50))
    $augUpdates = $history | Where-Object { $_.Date -ge $patchDate -and $_.Title -match '2026-08' }
    if ($augUpdates.Count -gt 0) {
        Write-Host "PATCHED — August 2026 update found in Windows Update history: $($augUpdates[0].Title)"
        exit 0
    }
}

# Step 4: Check UDP 69 listener as additional confirmation
$udpListeners = Get-NetUDPEndpoint -ErrorAction SilentlyContinue | Where-Object { $_.LocalPort -eq 69 }
if ($udpListeners) {
    Write-Host '[!] UDP port 69 (TFTP) is actively listening.'
}

Write-Host 'VULNERABLE — WDS Transport is installed and no August 2026 patch detected.'
Write-Host 'Apply the August 2026 cumulative update immediately.'
exit 1

Sources

1. ZDI — August 2026 Security Update Review
2. CrowdStrike — August 2026 Patch Tuesday Analysis
3. Cisco Talos — Microsoft Patch Tuesday August 2026
4. SecurityWeek — August 2026 Patch Tuesday Coverage
5. Security Affairs — August 2026 Patch Tuesday
6. Gadget Hacks — What to Patch First August 2026
7. Sumble — WDS Usage Telemetry
8. NVD — CVE-2026-62893