CVE-2022-34715

What it actually does

This is a network-reachable remote code execution flaw in Microsoft Windows Network File System handling. A vulnerable Windows host running the NFS server role can be attacked remotely without authentication or user interaction by sending crafted NFS/RPC traffic, potentially allowing attacker-controlled code to run with the privileges of the NFS service, commonly a highly privileged local service context. Successful exploitation can lead to full confidentiality, integrity, and availability compromise of the affected server. The supplied package metadata lists jenkinsci/jenkins fixed at commit 721f445841ca8c6f29cb314e2dedddf0949461ed, but that product metadata is inconsistent with the CVE title and description, which identify the vulnerable component as Windows NFS.

Why it matters to the business

A remotely exploitable, unauthenticated server-side vulnerability with a 9.8 CVSS score and high EPSS probability represents a high-priority operational risk for any Windows server exposing NFS. If exploited, an attacker could take control of file-serving infrastructure, steal or alter shared data, deploy malware, interrupt file access for dependent applications, or use the server as a foothold for broader internal compromise. Although it is not listed in CISA KEV and no ransomware use is indicated in the provided data, the age of the vulnerability and high EPSS score mean internet-facing or broadly reachable NFS services should be treated as likely discoverable by opportunistic scanning.

How an attack unfolds

An attacker first identifies Windows systems exposing NFS/RPC services, typically by scanning for NFS-related ports such as TCP/UDP 2049 and RPC endpoint mapper activity. If the Windows NFS server role is enabled and the host is unpatched, the attacker sends a malformed or specially crafted NFS request that triggers unsafe handling inside the NFS service. Because the flaw requires no credentials and no user interaction, exploitation can be attempted directly against the network service. On success, the attacker gains code execution on the server, after which they may deploy a payload, create persistence, access shared files, harvest credentials or tokens available on the host, and pivot to other systems reachable from that server.

How to fix it

Apply the Microsoft security updates that address CVE-2022-34715 on all affected Windows systems, prioritizing servers with the NFS server role enabled or network exposure beyond tightly controlled segments. If NFS is not required, remove or disable the Windows NFS server role/service. If immediate patching is not possible, restrict access to NFS/RPC services to trusted hosts only using host firewalls, network ACLs, VPN-only access, and segmentation; block unnecessary external access to TCP/UDP 2049 and associated RPC services. Review NFS exports/shares and ensure least-privilege access controls. The supplied fixed-version metadata for jenkinsci/jenkins states fixed commit 721f445841ca8c6f29cb314e2dedddf0949461ed; because that metadata does not align with the Windows NFS vulnerability description, validate product applicability before using it as a remediation reference.

How to confirm the fix worked

Confirm that the relevant Microsoft security update level is installed on all Windows systems that have the NFS server role enabled. Inventory hosts for the Services for NFS / NFS Server role and verify that unnecessary instances are removed or disabled. Validate network exposure with internal and external scans for NFS/RPC ports, especially TCP/UDP 2049, and confirm only approved management or client networks can reach them. Where source-code or package tracking is used, verify the product mapping is correct; do not treat the listed Jenkins commit as proof that Windows NFS exposure is remediated. After patching or disabling NFS, perform a controlled vulnerability scan or configuration assessment to confirm the vulnerability is no longer reported.

Typical attack path

1. Scan networks for systems exposing NFS/RPC services, especially TCP/UDP 2049 and related RPC endpoints.
2. Fingerprint the target to determine whether it is a Windows server running the NFS server role.
3. Send crafted NFS traffic designed to trigger the vulnerable code path.
4. Achieve remote code execution in the context of the vulnerable service if the host is unpatched.
5. Run post-exploitation commands or payloads to establish persistence, collect data, or move laterally.
6. Use the compromised file server to access sensitive shares, tamper with stored data, or disrupt dependent business services.

How to detect it

To determine whether exploitation may already have occurred, review Windows servers running NFS for unusual inbound NFS/RPC traffic, especially from untrusted or unexpected sources, around and after the public disclosure date. Correlate firewall, NetFlow, IDS/IPS, and packet-capture data for spikes or malformed traffic to TCP/UDP 2049 and RPC endpoint mapper services. On hosts, examine Windows System, Security, PowerShell, Sysmon, and EDR telemetry for service crashes, unexpected process creation by NFS-related service processes, new local users, suspicious scheduled tasks, newly installed services, abnormal PowerShell or cmd.exe execution, credential dumping tools, web shells or arbitrary binaries in temporary directories, and unusual access to NFS-exported data. Pay particular attention to post-exploitation indicators rather than exploit strings, because reliable public exploit-specific payload markers are not provided in the input. If available, compare NFS client access patterns against baselines and investigate first-time clients, high-volume reads/writes, failed malformed RPC attempts, or connections from non-NFS client subnets.

• tcp/2049
• udp/2049
• port 2049
• Services for NFS
• Server for NFS
• nfs.exe
• nfssvc.exe
• rpcbind
• portmap
• Event ID 7031
• Event ID 7034
• Event ID 7045
• Event ID 4688
• Event ID 4698
• Event ID 4104
• Set-NfsServerConfiguration
• Get-NfsServerConfiguration

What your security team should do

• Immediately inventory Windows servers running the NFS server role and rank them by internet exposure, cross-segment reachability, and business criticality.
• Patch affected Windows NFS servers with the applicable Microsoft security update as a high priority due to unauthenticated remote code execution risk and high EPSS probability.
• Disable the NFS server role wherever it is not explicitly required.
• Restrict NFS/RPC access to known client systems only; block broad access to TCP/UDP 2049 and related RPC services at network boundaries.
• Review recent NFS server logs, Windows event logs, EDR telemetry, and network flow records for suspicious NFS traffic or post-exploitation behavior.
• Hunt for unexpected child processes, new services, scheduled tasks, or dropped binaries originating from the NFS service context.
• Validate the apparent product metadata mismatch before assigning remediation work to Jenkins owners; the vulnerability described is Windows NFS, not a Jenkins application flaw.