Microsoft Windows Deployment Services Vulnerability Allows Remote Code Execution
A use-after-free vulnerability in Microsoft Windows Deployment Services (WDS) enables unauthenticated remote attackers to execute arbitrary code on affected servers.
A critical use-after-free vulnerability has been identified in Microsoft Windows Deployment Services (WDS), potentially allowing remote attackers to execute arbitrary code on vulnerable systems. The flaw, designated CVE-2026-62893 by Zero Day Initiative, carries a CVSS score of 7.5 and requires no authentication to exploit.
This vulnerability resides within the WDSServer service, a component responsible for deploying Windows operating systems over the network. The core issue stems from a failure to properly validate the existence of an object before performing operations on it. This oversight creates a window for attackers to trigger a use-after-free condition, which can then be leveraged to gain control of the affected server.
Exploitation of this vulnerability allows a network-adjacent attacker to execute code in the highest privilege context, known as SYSTEM. This means a successful attack could grant the attacker complete control over the compromised server, enabling them to install programs, view, change, or delete data, and create new accounts with full user rights.
Crucially, the vulnerability is limited to systems where Windows Deployment Services is actively enabled and configured. Servers not utilizing WDS are not directly exposed to this specific threat. However, given WDS's role in enterprise environments for large-scale OS deployments, many Windows Servers could be at risk if the service is active.
Microsoft has acknowledged the vulnerability and has released an update as part of its security patching efforts. Users and administrators are strongly advised to apply the available security update to mitigate the risk of exploitation. Further details and the specific update guidance can be found on Microsoft's Security Update Guide.
Zero Day Initiative, which disclosed the vulnerability, reported that it was initially reported to Microsoft on June 18, 2026. The coordinated public release of the advisory occurred on August 11, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered by Nikolai Skliarenko of TrendAI Research.
This discovery highlights the ongoing need for vigilance in securing network services, even those that appear to be primarily administrative. Use-after-free vulnerabilities remain a persistent challenge in software development, often leading to severe security consequences when exploited in critical system components like WDS.