CVE-2022-26937

What it actually does

CVE-2022-26937 is a remote code execution vulnerability in the Windows Network File System (NFS) service affecting multiple Windows Server versions. A remote, unauthenticated attacker can send specially crafted network traffic to a vulnerable NFS service and cause code execution with high impact to confidentiality, integrity, and availability. The CVSS vector indicates the flaw is network-accessible, low-complexity, requires no privileges, and requires no user interaction, making exposed NFS services particularly high risk.

Why it matters to the business

Successful exploitation could allow an attacker to take control of a vulnerable Windows Server running the NFS service, leading to data theft, service disruption, lateral movement, deployment of malware, or compromise of systems that rely on file-sharing infrastructure. Because Windows Server is widely deployed and NFS services are often used for shared storage and application dependencies, exploitation can disrupt business-critical workloads. Although this CVE is not listed in CISA KEV and no ransomware-specific KEV designation is present, its high CVSS score and elevated EPSS probability indicate meaningful exploitation risk, especially for internet-exposed or broadly reachable NFS endpoints.

How an attack unfolds

An attacker first identifies Windows Server systems exposing the NFS service, typically by scanning for NFS-related ports and service responses. If the target is running a vulnerable version and the NFS role or service is enabled, the attacker sends crafted requests designed to trigger the flaw in the Windows NFS implementation. Because the vulnerability requires no authentication or user interaction, exploitation can occur directly over the network when the vulnerable service is reachable. Successful exploitation may result in attacker-controlled code execution on the server, after which the attacker may establish persistence, dump credentials, access or modify shared files, move laterally to adjacent systems, or disrupt availability.

How to fix it

Apply the relevant Microsoft security updates released for CVE-2022-26937 to all affected Windows Server versions, including Windows Server 2008, 2012, 2016, 2019, and 2022, where applicable. If patching cannot be completed immediately, reduce exposure by disabling the NFS role/service where it is not required, restricting NFS access to trusted hosts and networks only, blocking inbound NFS traffic at firewalls, and preventing internet exposure of NFS services. Review Microsoft guidance for the specific Windows Server release and servicing channel in use, as fixed versions are delivered through Microsoft cumulative/security updates rather than a single package version. Prioritize externally reachable NFS servers, file servers supporting critical applications, and systems with access to sensitive data.

How to confirm the fix worked

Confirm that the applicable Microsoft security update level for May 2022 or later, including the fix for CVE-2022-26937, is installed on affected Windows Server systems. Validate that the NFS Server role or service is disabled where not required. Where NFS is required, verify that inbound access is restricted to authorized systems only and that TCP/UDP 2049 and related RPC/NFS services are not exposed to untrusted networks. Use vulnerability scanners, Microsoft update inventory, endpoint management tooling, and firewall configuration review to confirm remediation. A practical validation approach is to enumerate servers with the NFS role enabled, verify their patch state, and test from an untrusted network segment that NFS ports are unreachable.

Typical attack path

1. Scan networks for Windows Server systems exposing NFS services, commonly on TCP/UDP 2049 and related RPC/NFS ports.
2. Fingerprint the service to determine whether Microsoft Windows NFS is present and reachable.
3. Send specially crafted NFS traffic to trigger the remote code execution vulnerability.
4. Execute attacker-controlled code on the vulnerable server if exploitation succeeds.
5. Deploy follow-on tooling such as a command shell, loader, credential theft utility, or remote access mechanism.
6. Access, modify, or exfiltrate data available to the compromised server or NFS shares.
7. Use the compromised server as a foothold for lateral movement or operational disruption.

How to detect it

To determine whether exploitation may have already occurred, review network telemetry, firewall logs, IDS/IPS alerts, Windows event logs, and endpoint detection data for suspicious activity involving NFS services. Focus on inbound connections to NFS ports from untrusted or unusual sources, spikes in malformed or failed NFS/RPC traffic, crashes or restarts of NFS-related services, and post-exploitation behavior such as unexpected process launches, new services, credential access, or outbound connections from file servers. Useful log sources include Windows System and Application event logs, Microsoft-Windows-NFS-Server operational logs if enabled, Sysmon process/network events, EDR telemetry, firewall and NetFlow data, and IDS signatures for anomalous NFS traffic. Because public, CVE-specific exploit strings are not reliably derivable from the provided data, detection should combine NFS exposure monitoring with behavioral detections for remote code execution outcomes on Windows servers.

• TCP/2049 inbound to Windows Server from untrusted source
• UDP/2049 inbound to Windows Server from untrusted source
• Service Control Manager event indicating unexpected start or restart of NFS-related services
• Microsoft-Windows-NFS-Server
• NfsService
• Server for NFS
• mountd
• rpcbind
• portmap
• Unexpected child process spawned by NFS-related service
• cmd.exe spawned by NFS-related service
• powershell.exe spawned by NFS-related service
• wscript.exe spawned by NFS-related service
• cscript.exe spawned by NFS-related service
• rundll32.exe spawned by NFS-related service
• regsvr32.exe spawned by NFS-related service
• certutil.exe spawned by NFS-related service
• bitsadmin.exe spawned by NFS-related service
• mshta.exe spawned by NFS-related service

What your security team should do

• Immediately inventory Windows Server systems with the NFS Server role or service enabled.
• Prioritize patching for any NFS-enabled Windows Server that is internet-facing, reachable from untrusted networks, or used for sensitive file storage.
• Apply Microsoft security updates that include the CVE-2022-26937 fix across affected Windows Server versions.
• Disable NFS where it is not business-required.
• Restrict NFS access to approved hosts and network segments using host firewalls, network firewalls, and segmentation controls.
• Monitor for scanning or exploit attempts against NFS ports, especially TCP/UDP 2049 and RPC-related services.
• Review file server and endpoint telemetry for suspicious child processes, new services, unexpected administrative activity, or credential access following NFS traffic anomalies.
• If exposure existed before remediation, conduct retrospective threat hunting for anomalous NFS activity and post-exploitation behavior.