CVE-2026-88174
8.1HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-362
Impact
Remote unauthenticated attackers can execute arbitrary code over the network. They only need network reachability to the Windows Deployment Services endpoint to exploit the timing window.
Root cause
A race condition from improper synchronization of shared resources during concurrent operations in Windows Deployment Services.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Install the Microsoft security update for Windows Deployment Services once identified in the vendor advisory. If patching must wait, stop and disable the Windows Deployment Services service (WDSServer) or block incoming network access to its ports.
$ Stop-Service -Name WDSServer -Force; Set-Service -Name WDSServer -StartupType DisabledAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.