Introduction
Microsoft's November 10, 2026 Patch Tuesday release fixed a use-after-free flaw in Windows Deployment Services (WDS) that lets an unauthenticated attacker execute code on a target server by sending it a specially crafted packet. Because WDS servers sit inside the operating system provisioning pipeline of many Windows environments, and the bug needs neither credentials nor user interaction, the Zero Day Initiative counted it among the month's "wormable" bugs, even though Microsoft's own assessment marks exploitation as less likely.
Microsoft rates CVE-2026-119951 Critical, while its CVSS 3.1 base score is 8.1 (High) with a temporal score of 7.1. Microsoft's severity rating and CVSS are two different systems, so the scores do not contradict each other. Microsoft also assigns High attack complexity, meaning particular protocol settings or configurations must be present before an attack can succeed. In this post we summarize what is publicly known, what the patch covers, and where the public record stops.
Technical information
Background: what WDS does
WDS is a Microsoft service for deploying Windows operating systems over the network, letting administrators install Windows without visiting each machine or relying on local installation media. Its PXE functionality supports network installation, and Microsoft's historical deployment documentation describes a dependency on DHCP for PXE addressing. These architectural facts describe the service's network surface in general. They do not establish which WDS protocol or endpoint contains this particular defect.
Root cause: CWE-416, Use After Free
Microsoft classifies the weakness as CWE-416: Use After Free. MITRE defines this as referencing memory after it has been freed. Once an allocation is released, the allocator may hand that memory to another object while a stale pointer still references it. Any read, write, or indirect call through the original pointer then operates on memory the code no longer owns. In network services this class of bug is often reachable through request teardown, error paths, or concurrent requests that free an object still in use elsewhere.
For CVE-2026-119951 specifically, Microsoft's FAQ confirms the defect is reached when an unauthenticated attacker sends a specially crafted packet to the affected service. That places the corrected code in WDS's network packet-handling path. Beyond that, WDS is closed-source Windows code: Microsoft has published no diff, no symbol-level change log, no root-cause write-up, and no public code snippet exists.
Attack flow based on the public advisory
The documented sequence is short, and we deliberately do not extend it beyond what Microsoft states:
- Network reachability. The attacker needs network access to an affected WDS service (AV:N).
- No prior access. No authentication (PR:N) and no user interaction (UI:N) are required.
- Configuration prerequisite. The target must have particular protocol settings or configurations in place. Microsoft does not say which ones, and states this requirement reduces the likelihood of widespread or opportunistic exploitation (AC:H).
- Trigger. The attacker sends a specially crafted packet that drives the WDS packet-handling code into the use-after-free condition.
- Outcome. Successful exploitation can execute code on the target system. Microsoft does not name the account or privilege level of that execution.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Temporal (Microsoft): E:U/RL:O/RC:C Base score: 8.1 Temporal score: 7.1
- AV:N / PR:N / UI:N: reachable over the network by an unauthenticated attacker with no victim action.
- AC:H: exploitation depends on undisclosed conditions outside the attacker's control.
- S:U: scope unchanged.
- C:H / I:H / A:H: high potential impact to confidentiality, integrity and availability once exploitation succeeds.
- E:U / RL:O / RC:C: unproven exploit maturity, official fix available, confirmed report.
High attack complexity narrows the conditions for exploitation, but it does not reduce the stated impact after successful exploitation. That combination is the central prioritization tension here: broad opportunistic attacks may be less likely, while a deployment that matches the undisclosed prerequisites can still face a serious outcome.
Public detail gaps
The reviewed materials do not identify the vulnerable function, the affected binary, the packet structure, the triggering protocol settings, exploit reliability, or the security context of resulting code execution. SYSTEM-level execution, domain compromise, a specific port, or a reproducible exploit chain are therefore not publicly confirmed. The available disclosure supports a network-reachable execution risk, but not a configuration-based exemption.
Exploitation status
- At publication Microsoft listed "Publicly disclosed: No," "Exploited: No," and "Exploitation Less Likely."
- The Zero Day Initiative's November review also lists the CVE as not public and not exploited at release.
- Senserva reports the CVE is absent from the CISA Known Exploited Vulnerabilities catalog. Absence from the catalog is not proof that exploitation is impossible.
- No threat actor, campaign, victim sector, infrastructure, or indicator set is associated with this CVE in the reviewed sources.
Interim exposure reduction
Microsoft's advisory does not provide a dedicated workaround. A separate VulDB advisory recommends restricting access to deployment services from untrusted networks through segmentation when immediate patching is not possible. This is third-party interim guidance, not a Microsoft-confirmed substitute for the fix, and it does not provide a CVE-specific port list.
Patch information
Microsoft fixed CVE-2026-119951 in its November 10, 2026 Patch Tuesday release. The fix ships inside the monthly cumulative updates for Windows Server, and there is no standalone hotfix for WDS. On the Security Update Guide entry, Microsoft set the temporal Remediation Level to Official Fix (RL:O), meaning a complete vendor fix is available. NVD's record is still awaiting enrichment, and its only reference is Microsoft's advisory.
Fixed builds by platform (including Server Core)
The practical way to check whether a server is protected is its OS build number. Any build below the threshold for its release is vulnerable, and NVD uses the same values as the upper bounds of the affected ranges.
- Windows Server 2025: KB5131080 (security update), fixed build 10.0.26100.33822; KB5131077 (security hotpatch update), fixed build 10.0.26100.33730
- Windows Server 2022: KB5131090, fixed build 10.0.20348.5870
- Windows Server 2019: KB5131085, fixed build 10.0.17763.9487
- Windows Server 2016: KB5131291, fixed build 10.0.14393.9688
Windows Server 2025 has two servicing paths
MSRC lists both a standard Security Update (the Update Catalog link points to KB5131080) and a Security Hotpatch Update, each with its own build number. Machines enrolled in hotpatching can receive the fix without the usual reboot. Machines on the standard cumulative update path need a full CU install, and NVD uses 10.0.26100.33822 as the cutoff for that path. The hotpatch build is numerically below that generic cutoff, so a version check that only compares against 10.0.26100.33822 will misclassify correctly patched hotpatch systems. Third-party trackers agree that the November Windows security updates for this CVE require a restart on the standard path.
What the patch changes
The exact change is not public. What we know is limited to the bug class (CWE-416), the trigger surface (crafted packets to the WDS network service), and the configuration prerequisite (AC:H). As general background only, use-after-free fixes in network services usually correct object lifetime management (for example reference counting or ownership when a request is torn down), clear dangling pointers after an object is freed, or add synchronization so a second request or error path cannot free an object still in use. This describes how such bugs are typically fixed, not confirmed detail of Microsoft's change. Patch diffing the WDS binaries before and after the November update is the only way to see the actual fix.
Related WDS fixes in the same release
The same cumulative updates fix several other WDS bugs: CVE-2026-105558, an Important-rated RCE (CVSS 7.5), and three information disclosure issues, CVE-2026-112977, CVE-2026-113818 and CVE-2026-118213. Installing one current cumulative update addresses all of these WDS issues together.
Credit
Microsoft credits Dawnflare with reporting the vulnerability through coordinated disclosure. The advisory is at revision 1.0, "Information published," dated November 10, 2026.
Affected systems and versions
Affected intervals from the CVE record, with Server Core coverage per Microsoft's advisory:
- Windows Server 2016 (including Server Core): 10.0.14393.0 up to, but not including, 10.0.14393.9688
- Windows Server 2019 (including Server Core): 10.0.17763.0 up to, but not including, 10.0.17763.9487
- Windows Server 2022 (including Server Core): 10.0.20348.0 up to, but not including, 10.0.20348.5870
- Windows Server 2025 (including Server Core): 10.0.26100.0 up to, but not including, 10.0.26100.33822 on the standard update path. Hotpatch-enrolled systems are remediated by KB5131077 at 10.0.26100.33730.
A few scoping notes:
- Microsoft's update table explicitly includes Windows Server 2022 Server Core, although the NVD affected product list does not separately enumerate it.
- Exploitation additionally requires particular, undisclosed protocol settings or configurations. Because those conditions are not public, they cannot be used to exempt a system from patching.
- Microsoft has announced that WDS is deprecated beginning with the operating system version following Windows Server 2025, including the inbox role, services, management interfaces and WDS-provided PXE functionality. That lifecycle change does not replace security updates for the releases listed above.
Vendor security history
The broader context for Microsoft is mixed, and neither side of it says anything direct about this WDS defect.
The Cyber Safety Review Board's review of the 2023 Exchange Online intrusion by Storm-0558, a group associated with the government of the People's Republic of China, concluded that the intrusion was preventable and that Microsoft's security culture required an overhaul. The Board cited a cascade of failures, including failure to detect the compromise of cryptographic assets and a compromised employee laptop, along with delayed correction of inaccurate public statements. This is evidence about security governance. It is not evidence that Storm-0558 or any other actor exploited CVE-2026-119951.
Microsoft's November 2025 Secure Future Initiative progress report describes corrective work under three principles: Secure by Design, Secure by Default, and Secure Operations. It reports mandatory MFA for Azure users, Azure Bastion Developer connectivity in 35 regions, and a 25% increase in Azure Local security default settings, reaching 400 settings. These are vendor-reported outcomes, not independent validation of the WDS fix.
For this CVE, the actionable evidence remains the CVE-specific update mapping and servicing guidance described above.
References
- NVD: CVE-2026-119951
- CVE Record: CVE-2026-119951
- Microsoft Security Update Guide: CVE-2026-119951, Windows Deployment Services Remote Code Execution Vulnerability
- Zero Day Initiative: The November 2026 Security Update Review
- LayerLogix: Windows November 2026 Vulnerabilities
- Senserva: KB5131077
- Senserva: CVE-2026-119951
- VulDB: CVE-2026-119951 in Windows
- CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
- Microsoft Support: KB5131090, Windows Server 2022 (OS Build 20348.5870)
- Microsoft Support: KB5131080, Windows Server 2025 (OS Build 26100.33822)
- Microsoft Support: KB5131080 help article
- Microsoft Support: KB5131291, Windows Server 2016 (OS Build 14393.9688)
- Microsoft Support: Hotpatch KB5131077, Windows Server 2025 (OS Build 26100.33730)
- Microsoft Learn: Windows Deployment Services
- Microsoft Learn: Windows Deployment Services Overview
- Microsoft Learn: WDS boot.wim support
- MITRE CWE-416: Use After Free
- CISA Known Exploited Vulnerabilities Catalog
- CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
- Microsoft Secure Future Initiative Progress Report, November 2025
