{"id":"CVE-2026-119404","kind":"vulnerability","aliases":["CVE-2026-119404"],"related":[],"title":"Windows Client for NFS: access control flaw lets attackers bypass a security feature","description":"Improper access control in Windows Client for NFS allows an unauthorized attacker to bypass a security feature over a network.","summary":"Windows Client for NFS has an improper access control flaw that lets an unauthorized attacker bypass a security feature over the network. The sources do not say what the bypassed feature protects or what data is exposed.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["enterprise","infrastructure","nfs","windows"],"not_affected_if":["nfs-client-not-installed"],"how_to_check":"- Check whether the Client for NFS feature is installed on Windows machines (unknown: the sources do not give a command)\n- Confirm the Windows build against Microsoft's security update guide (unknown: the sources do not name fixed versions)","fix":null,"status":"open","published_at":"2026-11-10T19:19:55+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","triaged_at":"2026-11-10T20:00:04+00:00","updated_at":"2026-11-10T20:00:04+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T20:00:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Client for NFS: access control flaw lets attackers bypass a security feature","impact":"medium","summary":"Windows Client for NFS has an improper access control flaw that lets an unauthorized attacker bypass a security feature over the network. The sources do not say what the bypassed feature protects or what data is exposed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","nfs","enterprise"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown security feature bypassed over the network","analyst_note":"Find Microsoft's advisory for CVE-2026-119404 to confirm affected Windows builds, fixed versions and what the bypassed feature protects.","how_to_check":"- Check whether the Client for NFS feature is installed on Windows machines (unknown: the sources do not give a command)\n- Confirm the Windows build against Microsoft's security update guide (unknown: the sources do not name fixed versions)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nfs-client-not-installed"],"who_is_affected":"Systems running the Windows Client for NFS feature that can reach an NFS network path. The sources do not say which Windows versions or configurations are affected, so the exact scope is unknown.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000702,"input_tokens":4490,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119404':16A,19A '-2026':15A,18A 'access':5A,31B,62C 'allow':69C 'attack':9A,38B,72C 'bypass':10A,39B,53B,74C 'client':2A,25B,66C 'control':6A,32B,63C 'cve':14A,17A 'data':58B 'enterpris':20B 'expos':60B 'featur':13A,42B,54B,77C 'flaw':7A,33B 'improp':30B,61C 'infrastructur':21B 'let':8A,35B 'network':45B,80C 'nfs':4A,22B,27B,68C 'protect':55B 'say':50B 'secur':12A,41B,76C 'sourc':47B 'unauthor':37B,71C 'window':1A,23B,24B,65C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Windows Client for NFS feature that can reach an NFS network path. The sources do not say which Windows versions or configurations are affected, so the exact scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["enterprise","infrastructure","medium","nfs","windows"],"campaign_type":null,"search_a":"'-119404':16A,19A '-2026':15A,18A 'access':5A 'attack':9A 'bypass':10A 'client':2A 'control':6A 'cve':14A,17A 'featur':13A 'flaw':7A 'let':8A 'nfs':4A 'secur':12A 'window':1A","search_b":"'access':31B 'attack':38B 'bypass':39B,53B 'client':25B 'control':32B 'data':58B 'enterpris':20B 'expos':60B 'featur':42B,54B 'flaw':33B 'improp':30B 'infrastructur':21B 'let':35B 'network':45B 'nfs':22B,27B 'protect':55B 'say':50B 'secur':41B 'sourc':47B 'unauthor':37B 'window':23B,24B","search_c":"'access':62C 'allow':69C 'attack':72C 'bypass':74C 'client':66C 'control':63C 'featur':77C 'improp':61C 'network':80C 'nfs':68C 'secur':76C 'unauthor':71C 'window':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119404","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119404","severity":null,"published_at":"2026-11-10T19:19:55+00:00","modified_at":"2026-11-10T19:19:55+00:00","first_seen_at":"2026-11-10T19:24:57+00:00","fetched_at":"2026-11-10T19:24:57+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}