External risk intelligence

Windows Services for NFS ONCRPC XDR Driver Use After Free Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-69595

Windows Services for NFS (Network File System) is designed for file sharing within internal network environments. While it is network-reachable, it is typically restricted to internal infrastructure and is not intended or commonly configured for direct exposure to the public internet.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Windows Services for NFS, specifically within its ONCRPC XDR driver. This flaw allows unauthorized network access, potentially leading to the execution of malicious code. The primary concern at this time is to confirm if this technology is in use and therefore potentially exposed.

Code execution vulnerability in a Windows file-sharing service.
Critical flaw impacting network security.
Confirm relevance and exposure in your environment.

Attack Path

How an attacker could exploit the issue

An attacker could reach the vulnerable Windows Services for NFS ONCRPC XDR Driver over a network. This driver's use-after-free flaw allows an unauthorized attacker to execute code remotely, potentially impacting the confidentiality, integrity, and availability of the affected system.

Unauthenticated network access required.
Triggered by a malformed ONCRPC request.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver could allow an unauthenticated attacker to execute arbitrary code remotely. This could potentially affect the integrity and availability of systems running the affected NFS driver when exposed to a network.

System code execution over network.
Remote code execution.
Potential system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Windows Services for NFS, suggesting that infrastructure or platform teams responsible for managing Windows servers and their associated services are the primary stakeholders. The first practical step is to inventory all systems running Windows Services for NFS, determine their network exposure and criticality, and identify the accountable system owners to prioritize remediation efforts.

Infrastructure teams own the remediation.
Verify NFS service exposure and criticality.
Plan maintenance for affected systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Windows Services for NFS ONCRPC XDR driver?

This component is part of Windows Services for NFS, which enables a Windows server to act as a file server for Unix-based systems. The ONCRPC XDR driver specifically handles the translation of data formats for remote procedure calls, ensuring that files can be shared seamlessly across heterogeneous network environments.

What does a use-after-free weakness mean in CVE-2026-69595?

A use-after-free is a memory management error identified as CWE-416. It happens when a program continues to use a memory address after it has been cleared or deleted. In this CVE, an attacker can manipulate this flaw to overwrite the freed memory with malicious instructions, potentially allowing them to hijack the system's execution flow.

How does an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted, malformed ONCRPC request to the driver over the network. It is important to note that the vulnerability is not triggered by legitimate, well-formed file sharing traffic or standard administrative tasks; it specifically requires malformed data designed to exploit the memory handling logic.

Why should I care if my systems use this driver?

Halo Surface Signal indicates that while this driver is reachable over a network, it is typically used for internal file sharing rather than public-facing services. You should care if your systems are reachable from untrusted network segments, as this increases the risk that an unauthorized actor could attempt the malicious requests described.

What is the first step I should take to address this?

Begin by auditing your environment to create an inventory of all Windows servers where the Services for NFS role is enabled. Once identified, work with your infrastructure teams to verify if these servers are restricted to internal networks and confirm which systems hold critical data, allowing you to prioritize maintenance efforts effectively.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69595

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.