Microsoft Rates Exploitation 'More Likely' for CVE-2026-62893 in…

Microsoft patched a use-after-free in the WDSServer service of Windows Deployment Services. The exploitability assessment is 'More Likely' and the flaw requires no authentication.

On August 11, 2026, Microsoft released the fix for CVE-2026-62893, a use-after-free in the WDSServer service of Windows Deployment Services that enables unauthenticated remote code execution with SYSTEM privileges. The vulnerability, tracked as ZDI-26-544 by the Trend Micro Zero Day Initiative, presents a scoring gap: CVSS 9.8 CRITICAL per CVE.org versus 7.5 from ZDI.

Key Takeaways

The vulnerability is a use-after-free in the WDSServer service of Windows Deployment Services, exploitable by network-adjacent attackers without authentication.
CVE.org assigns CVSS 9.8 CRITICAL with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; ZDI reports 7.5, a discrepancy not explicitly explained in the sources.
Microsoft rates exploitability as "More Likely" and confirms no user interaction is required; no in-the-wild activity has been detected.
Only systems with Windows Deployment Services enabled are affected: Windows Server 2012, 2012 R2, 2016, 2019, and 2025 with specific builds.

The Mechanism: How the Use-After-Free Works in WDSServer

The flaw stems from a failure to validate an object's existence before performing operations on it within the WDSServer service. According to the ZDI advisory, "The specific flaw exists within the WDSServer service. The issue results from the lack of validating the existence of an object prior to performing operations on the object." This use-after-free condition allows an attacker to manipulate heap memory after an object has been freed.

The attacker achieves arbitrary code execution in the SYSTEM context, the most privileged in Windows. The attack requires the ability to send specially crafted network packets to the vulnerable service. ZDI classifies the vector as "network-adjacent"; CVE.org assigns AV:N (Network). The source does not specify the reason for the divergence between these assessments.

The absence of authentication and user-interaction requirements significantly lowers the exploitation threshold. Per Microsoft, "An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network." The result is a fully remote attack that requires no credentials or victim action.

The Scoring Gap: ZDI 7.5 vs. CVE.org 9.8

The discrepancy between CVSS 7.5 (ZDI) and 9.8 (CVE.org) is a material factor for risk assessment. The CVE.org vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) rates the attack as network-based with no privileges required and full impact on confidentiality, integrity, and availability. The more conservative ZDI score is not explicitly explained in the available sources.

The CVE.org record provides the full vector; the ZDI advisory does not publish a detailed vector in the extracted data. For security teams, both scores are documented but unreconciled by primary sources. Prudence dictates planning patching assuming the higher score as the benchmark for prioritization.

"Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network." — CVE.org, CVE-2026-62893

Timeline: June to August

The vulnerability was privately reported on June 18, 2026, and publicly disclosed on August 11, 2026, per ZDI advisory structured data. The 54-day window between reporting and coordinated disclosure allowed Microsoft to develop and test the fix.

Microsoft released the patch in the August 2026 cumulative update, with explicit confirmation: "A complete vendor solution is available." The credit field in the ZDI advisory is not populated in the extracted data. The source does not specify whether discovery occurred internally at Trend Micro Research or via an external researcher.

Microsoft's exploitability assessment rates exploitation as "More Likely," indicating a high probability of attack. At the same time, Microsoft confirms "Exploited: No," ruling out detected in-the-wild activity at the time of publication. No public exploit code is available: "No publicly available exploit code is available."

What to Do Now

Microsoft has made the fix available for all affected versions. The "Exploitation More Likely" classification signals that Microsoft assesses exploitation as technically feasible. Operational teams must act with priority on exposed systems.

Verify which systems run Windows Deployment Services and whether the WDSServer service is active.
Apply the August 2026 update for CVE-2026-62893 to Server 2012, 2012 R2, 2016, 2019, and 2025, checking the specific builds listed in the CVE.org record.
If immediate patching is not possible, consider temporarily disabling Windows Deployment Services on non-critical systems, acknowledging the operational impact on deployment workflows.
Monitor WDSServer service logs for anomalous network activity that may indicate exploit attempts.

Exposure Scope and Affected Versions

The vulnerability does not affect all Windows Server systems, only those with Windows Deployment Services enabled. This service is commonly used for OS image deployment in enterprise environments, making infrastructure servers particularly exposed.

The CVE.org record lists precise builds for five Windows Server versions: 2012, 2012 R2, 2016, 2019, and 2025. Impact is uniform across all versions: arbitrary code execution in the SYSTEM context without authentication. The presence of WDS in internal network environments does not eliminate risk, as CVE.org classifies the vector as network-based (AV:N).

Editor's Note

CVE-2026-62893 represents a concrete criticality for Windows Server infrastructures using Deployment Services. The combination of "More Likely" exploitability, no authentication requirement, and SYSTEM impact demands an aggressive patching posture. The scoring gap between CVE.org and ZDI, while unresolved in the sources, does not diminish the intrinsic severity of the vulnerability: the full network-based vector with triple C-I-A impact mandates maximum operational priority.

Primary sources — ZDI-26-544 advisory, CVE.org record, and Microsoft MSRC — provide a solid technical baseline but have known limits: the scoring discrepancy is unexplained, discovery attribution is undocumented, and no additional independent verifications exist. Security teams must supplement this information with their own asset inventory and proceed to patching without awaiting further clarification.

Information verified against cited sources and current as of publication.

Sources

Sources and references