{"id":"CVE-2026-95885","kind":"vulnerability","aliases":["CVE-2026-95885"],"related":[],"title":"Windows Client for NFS: use-after-free lets a network attacker gain higher privileges","description":"Use after free in Windows Client for NFS allows an unauthorized attacker to elevate privileges over a network.","summary":"Windows Client for NFS has a use-after-free memory bug that lets an unauthorized attacker on the network elevate privileges. The NVD record gives a CVSS 8.1 score and does not describe the exact trigger.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows Client for NFS","fixed":["see fix field"],"affected":"< fixed build per Windows version","ecosystem":"vendor"}],"ecosystems":[],"tags":["client-for-nfs","infrastructure","nfs","windows","windows-client","windows-server"],"not_affected_if":["nfs-client-not-installed"],"how_to_check":"Run 'winver' or [Environment]::OSVersion to get the build and compare with the fixed builds in the fix field. Check whether Client for NFS is installed: PowerShell 'Get-WindowsOptionalFeature -Online -FeatureName ServicesForNFS-ClientOnly' (Windows client) or 'Get-WindowsFeature NFS-Client' (Server). If not installed, the vulnerable component is likely absent (not confirmed by Microsoft text we could read).","fix":"Install the November 2026 Windows cumulative update. First fixed builds (per NVD record): Win10 1607/Server 2016 10.0.14393.9688; 1809/Server 2019 10.0.17763.9487; Win10 21H2 10.0.19044.7846; 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; 24H2 10.0.26100.9974; 25H2 10.0.26200.9974; 26H1 10.0.28000.3501; 26H2 10.0.26300.9974; Server 2022 10.0.20348.5870; Server 2025 10.0.26100.33822. Confirm against the MSRC guide.","status":"open","published_at":"2026-11-10T19:21:41+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","triaged_at":"2026-11-10T19:34:35+00:00","updated_at":"2026-11-10T20:30:45+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:34:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Windows Client for NFS: use-after-free lets a network attacker gain higher privileges","impact":"high","summary":"Windows Client for NFS has a use-after-free memory bug that lets an unauthorized attacker on the network elevate privileges. The NVD record gives a CVSS 8.1 score and does not describe the exact trigger.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","nfs","windows-client"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker over the network gains elevated privileges on the Windows machine","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-95885 to confirm affected Windows builds, fixed builds, and whether NFS mounting is required.","how_to_check":"- Check whether the NFS client feature is installed and enabled in Windows Features (Client for NFS) on the machine.\n- Confirm the Windows build against Microsoft's security update guide for CVE-2026-95885: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nfs-client-not-installed"],"who_is_affected":"Windows machines that use the Client for NFS feature to mount NFS shares are the ones to look at. The sources do not say which Windows builds are affected or whether the feature must be actively mounting shares to be reachable. Machines without the NFS client feature installed can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4486,"output_tokens":552,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Microsoft's security update guide entry for CVE-2026-95885 to confirm affected Windows builds, fixed builds, and whether NFS mounting is required.","search":"'-2026':17A,20A '-95885':18A,21A '8.1':67B 'allow':84C 'attack':12A,55B,87C 'bug':50B 'client':2A,23A,27B,35B,40B,81C 'client-for-nf':26B 'cve':16A,19A 'cvss':66B 'describ':72B 'elev':59B,89C 'exact':74B 'for':24A 'free':8A,48B,78C 'gain':13A 'give':64B 'higher':14A 'infrastructur':30B 'let':9A,52B 'memori':49B 'network':11A,58B,93C 'nfs':4A,25A,29B,31B,42B,83C 'nvd':62B 'privileg':15A,60B,90C 'record':63B 'score':68B 'server':38B 'trigger':75B 'unauthor':54B,86C 'use':6A,46B,76C 'use-after-fre':5A,45B 'window':1A,32B,34B,37B,39B,80C 'windows':22A 'windows-cli':33B 'windows-serv':36B","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Client for NFS feature enabled, on the builds listed in the fix field, are the ones to look at: file servers, jump hosts and workstations that mount NFS shares. The attack is over the network without credentials but rated high complexity (CVSS 8.1). Machines without Client for NFS can likely skip it, but the source does not state the trigger.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["clientfornfs","windowsclientfornfs"],"ptokens":["client","for","nfs","windows"],"labels":["clientfornfs","high","infrastructure","nfs","windows","windowsclient","windowsserver"],"campaign_type":null,"search_a":"'-2026':17A,20A '-95885':18A,21A 'attack':12A 'client':2A,23A 'cve':16A,19A 'for':24A 'free':8A 'gain':13A 'higher':14A 'let':9A 'network':11A 'nfs':4A,25A 'privileg':15A 'use':6A 'use-after-fre':5A 'window':1A 'windows':22A","search_b":"'8.1':67B 'attack':55B 'bug':50B 'client':27B,35B,40B 'client-for-nf':26B 'cvss':66B 'describ':72B 'elev':59B 'exact':74B 'free':48B 'give':64B 'infrastructur':30B 'let':52B 'memori':49B 'network':58B 'nfs':29B,31B,42B 'nvd':62B 'privileg':60B 'record':63B 'score':68B 'server':38B 'trigger':75B 'unauthor':54B 'use':46B 'use-after-fre':45B 'window':32B,34B,37B,39B 'windows-cli':33B 'windows-serv':36B","search_c":"'allow':84C 'attack':87C 'client':81C 'elev':89C 'free':78C 'network':93C 'nfs':83C 'privileg':90C 'unauthor':86C 'use':76C 'window':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:21:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95885","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95885","severity":null,"published_at":"2026-11-10T19:21:41+00:00","modified_at":"2026-11-10T19:21:41+00:00","first_seen_at":"2026-11-10T19:25:22+00:00","fetched_at":"2026-11-10T19:25:22+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95885:2666","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95885","severity":null,"published_at":"2026-11-10T20:30:45+00:00","modified_at":"2026-11-10T20:30:45+00:00","first_seen_at":"2026-11-10T20:30:45+00:00","fetched_at":"2026-11-10T20:30:45+00:00","note":"MSRC page is JS-only and unreadable here (web-cli empty, CVRF 404); builds taken from NVD API record carrying Microsoft CNA data. Not verified against MSRC. Exploitation/PoC not stated; X/search not used. Whether NFS mounting is required is unknown.","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95885"]}],"documents":[{"id":118034,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-95885","title":"NVD record CVE-2026-95885 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}