CVE-2022-26937
Published: 10 May 2022
Summary
CVE-2022-26937 is a critical-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Windows Network File System contains a remote code execution vulnerability tracked as CVE-2022-26937. The flaw affects the NFS component in Windows and carries a CVSS 3.1 base score of 9.8, reflecting network-accessible attack vectors that require no authentication or user interaction and result in full confidentiality, integrity, and availability impact.
An unauthenticated attacker with network connectivity to an affected Windows system can send specially crafted NFS traffic to trigger the flaw and execute arbitrary code in the context of the NFS service. Successful exploitation grants the attacker the ability to install programs, view or modify data, and create new accounts with full administrative privileges.
Microsoft has published security guidance and patches for the vulnerability through its update channels, including the Microsoft Security Response Center advisory pages referenced for CVE-2022-26937. The current and peak EPSS score of 0.7128 indicates sustained exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-31482
Vulnerability details
Windows Network File System Remote Code Execution Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.