{"id":"CVE-2026-112977","kind":"vulnerability","aliases":["CVE-2026-112977"],"related":[],"title":"Windows Deployment Services: privilege flaw lets an authorized user read data","description":"Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally.","summary":"Windows Deployment Services has an improper privilege management flaw that lets an attacker who already holds some access disclose information on the local machine. The sources give no further detail on what data is exposed.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","wds","windows","windows-server"],"not_affected_if":["wds-role-not-installed"],"how_to_check":"- Check whether the Windows Deployment Services role is installed on the server, for example with `Get-WindowsFeature WDS` in PowerShell.\n- Compare the server's Windows build against Microsoft's security update guide for this CVE; the sources do not name affected builds.","fix":null,"status":"open","published_at":"2026-11-10T19:18:49+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","triaged_at":"2026-11-10T20:02:07+00:00","updated_at":"2026-11-10T20:02:07+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:02:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows Deployment Services: privilege flaw lets an authorized user read data","impact":"low","summary":"Windows Deployment Services has an improper privilege management flaw that lets an attacker who already holds some access disclose information on the local machine. The sources give no further detail on what data is exposed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","windows-server","wds"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Local user reads information they are not authorized to see.","analyst_note":"Check Microsoft's security update guide entry for CVE-2026-112977 for affected builds, the fixed update, and the exact data disclosed.","how_to_check":"- Check whether the Windows Deployment Services role is installed on the server, for example with `Get-WindowsFeature WDS` in PowerShell.\n- Compare the server's Windows build against Microsoft's security update guide for this CVE; the sources do not name affected builds.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["wds-role-not-installed"],"who_is_affected":"Systems running the Windows Deployment Services role are the ones to look at. The sources do not state which Windows builds are affected or whether the role must be actively used. Servers without this role can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000701,"input_tokens":4482,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112977':14A,17A '-2026':13A,16A 'access':41B 'allow':66C 'alreadi':38B 'attack':36B,69C 'author':8A,68C 'cve':12A,15A 'data':11A,56B 'deploy':2A,25B,64C 'detail':53B 'disclos':42B,71C 'expos':58B 'flaw':5A,32B 'give':50B 'hold':39B 'improp':29B,59C 'inform':43B,72C 'infrastructur':18B 'let':6A,34B 'local':46B,73C 'machin':47B 'manag':31B,61C 'privileg':4A,30B,60C 'read':10A 'server':23B 'servic':3A,26B,65C 'sourc':49B 'user':9A 'wds':19B 'window':1A,20B,22B,24B,63C 'windows-serv':21B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Windows Deployment Services role are the ones to look at. The sources do not state which Windows builds are affected or whether the role must be actively used. Servers without this role can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","medium","wds","windows","windowsserver"],"campaign_type":null,"search_a":"'-112977':14A,17A '-2026':13A,16A 'author':8A 'cve':12A,15A 'data':11A 'deploy':2A 'flaw':5A 'let':6A 'privileg':4A 'read':10A 'servic':3A 'user':9A 'window':1A","search_b":"'access':41B 'alreadi':38B 'attack':36B 'data':56B 'deploy':25B 'detail':53B 'disclos':42B 'expos':58B 'flaw':32B 'give':50B 'hold':39B 'improp':29B 'inform':43B 'infrastructur':18B 'let':34B 'local':46B 'machin':47B 'manag':31B 'privileg':30B 'server':23B 'servic':26B 'sourc':49B 'wds':19B 'window':20B,22B,24B 'windows-serv':21B","search_c":"'allow':66C 'attack':69C 'author':68C 'deploy':64C 'disclos':71C 'improp':59C 'inform':72C 'local':73C 'manag':61C 'privileg':60C 'servic':65C 'window':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:18:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112977","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112977","severity":null,"published_at":"2026-11-10T19:18:49+00:00","modified_at":"2026-11-10T19:18:49+00:00","first_seen_at":"2026-11-10T19:24:36+00:00","fetched_at":"2026-11-10T19:24:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}