{"id":"CVE-2026-119951","kind":"vulnerability","aliases":["CVE-2026-119951"],"related":[],"title":"Windows Deployment Services: use-after-free lets an unauthenticated attacker run code","description":"Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.","summary":"Windows Deployment Services has a use-after-free memory bug that can be triggered over the network. An unauthorized attacker can use it to execute code on the affected server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","self-hosted","windows-deployment-services","windows-server"],"not_affected_if":["role-not-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:18+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","triaged_at":"2026-11-10T19:34:45+00:00","updated_at":"2026-11-10T19:34:45+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:34:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Deployment Services: use-after-free lets an unauthenticated attacker run code","impact":"high","summary":"Windows Deployment Services has a use-after-free memory bug that can be triggered over the network. An unauthorized attacker can use it to execute code on the affected server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows-server","windows-deployment-services","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code on the server over the network","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-119951 for affected builds, patched versions and whether the WDS role is required.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["role-not-installed"],"who_is_affected":"Organizations running Windows Deployment Services on Windows Server are exposed, since the flaw is reachable over the network without authentication. The sources do not state which Windows Server builds or configurations are affected, or whether the role must be enabled. Teams that do not run the Windows Deployment Services role can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4480,"output_tokens":456,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft security update guide entry for CVE-2026-119951 for affected builds, patched versions and whether the WDS role is required.","search":"'-119951':16A,19A '-2026':15A,18A 'affect':60B 'allow':69C 'attack':11A,51B,72C 'bug':41B 'code':13A,57B,75C 'cve':14A,17A 'deploy':2A,26B,32B,67C 'execut':56B,74C 'free':7A,39B,64C 'host':23B 'infrastructur':20B 'let':8A 'memori':40B 'network':48B,78C 'run':12A 'self':22B 'self-host':21B 'server':30B,61B 'servic':3A,27B,33B,68C 'trigger':45B 'unauthent':10A 'unauthor':50B,71C 'use':5A,37B,53B,62C 'use-after-fre':4A,36B 'window':1A,25B,29B,31B,66C 'windows-deployment-servic':24B 'windows-serv':28B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Windows Deployment Services on Windows Server are exposed, since the flaw is reachable over the network without authentication. The sources do not state which Windows Server builds or configurations are affected, or whether the role must be enabled. Teams that do not run the Windows Deployment Services role can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","selfhosted","windowsdeploymentservices","windowsserver"],"campaign_type":null,"search_a":"'-119951':16A,19A '-2026':15A,18A 'attack':11A 'code':13A 'cve':14A,17A 'deploy':2A 'free':7A 'let':8A 'run':12A 'servic':3A 'unauthent':10A 'use':5A 'use-after-fre':4A 'window':1A","search_b":"'affect':60B 'attack':51B 'bug':41B 'code':57B 'deploy':26B,32B 'execut':56B 'free':39B 'host':23B 'infrastructur':20B 'memori':40B 'network':48B 'self':22B 'self-host':21B 'server':30B,61B 'servic':27B,33B 'trigger':45B 'unauthor':50B 'use':37B,53B 'use-after-fre':36B 'window':25B,29B,31B 'windows-deployment-servic':24B 'windows-serv':28B","search_c":"'allow':69C 'attack':72C 'code':75C 'deploy':67C 'execut':74C 'free':64C 'network':78C 'servic':68C 'unauthor':71C 'use':62C 'window':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119951","severity":null,"published_at":"2026-11-10T19:20:18+00:00","modified_at":"2026-11-10T19:20:18+00:00","first_seen_at":"2026-11-10T19:25:04+00:00","fetched_at":"2026-11-10T19:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}