CVE-2023-24941

What it actually does

CVE-2023-24941 is a critical unauthenticated remote code execution vulnerability in the Windows Network File System server component. A remote attacker with network access to the NFS service can send specially crafted NFS traffic to trigger memory corruption or unsafe request handling and execute code on the affected Windows Server. The CVSS vector indicates exploitation is network-accessible, low-complexity, requires no privileges, requires no user interaction, and can compromise confidentiality, integrity, and availability of the affected server.

Why it matters to the business

Organizations running the Windows Server NFS role on affected versions face a high-risk remote compromise scenario. Successful exploitation could allow an attacker to take control of file-serving infrastructure, steal or alter shared data, deploy malware, pivot deeper into the network, or disrupt business operations that depend on NFS-backed storage. Although this CVE is not listed in CISA KEV and no mature public exploit is indicated in the provided data, the EPSS score is very high, meaning exploitation likelihood should be treated as significant for any internet-exposed or broadly reachable NFS service.

How an attack unfolds

An attacker first identifies Windows Server systems exposing the NFS service, typically on TCP or UDP port 2049 and sometimes through related RPC/portmapper discovery. If the NFS role is enabled and the server is missing the relevant Microsoft security update, the attacker sends crafted NFS protocol requests designed to trigger the vulnerable code path. Because the vulnerability requires no authentication or user interaction, exploitation can occur before normal access controls meaningfully limit the attack. Successful exploitation may give the attacker code execution in the context of the vulnerable NFS service or associated system process, enabling command execution, payload deployment, credential access, lateral movement, or destructive actions against shared data.

How to fix it

Apply the Microsoft security updates that address CVE-2023-24941 for all affected Windows Server versions, including Windows Server 2012, 2016, 2019, and 2022. If immediate patching is not possible, disable the Windows Server NFS role where it is not required, restrict NFS access to trusted hosts only, block inbound NFS traffic from untrusted networks, and ensure TCP/UDP 2049 and related RPC/NFS ports are not exposed to the internet. Place NFS servers behind firewalls or segmentation controls, enforce least-privilege access to file shares, and monitor for abnormal NFS traffic until patching is complete.

How to confirm the fix worked

Confirm that the appropriate Microsoft security update from May 2023 or later is installed on each affected Windows Server. Validate whether the NFS role is enabled by checking installed roles/features and running services for Server for NFS. Confirm exposure by testing whether TCP/UDP 2049 and related NFS/RPC ports are reachable only from approved networks. Use vulnerability scanning or authenticated configuration assessment to verify that affected Windows Server versions are no longer reported as vulnerable. After remediation, perform a controlled port scan and review firewall rules to ensure untrusted access paths to NFS are closed.

Typical attack path

1. Scan for hosts exposing Windows Network File System services, especially TCP/UDP 2049 and related RPC service discovery ports.
2. Fingerprint the target to determine whether it is a Windows Server NFS implementation and whether the NFS role is enabled.
3. Send specially crafted NFS requests to the vulnerable service without authenticating.
4. Achieve remote code execution on the affected server if it has not been patched.
5. Establish persistence, run commands, access or modify NFS-shared files, collect credentials, and pivot to other internal systems.

How to detect it

To determine whether exploitation may already have occurred, review network telemetry for unexpected inbound NFS traffic to Windows Server systems, especially TCP/UDP 2049 from untrusted or unusual sources. Examine Windows event logs, NFS operational logs, service control events, crash reports, and EDR telemetry for signs of the NFS service crashing, restarting, spawning unusual child processes, or being followed by suspicious command execution. Useful log sources include Windows Security logs, System logs, Service Control Manager events, Windows Defender/EDR alerts, firewall logs, NetFlow, IDS/IPS telemetry, and NFS Server operational logs where enabled. Look for suspicious post-exploitation behaviors such as PowerShell, cmd.exe, wscript.exe, rundll32.exe, certutil.exe, bitsadmin.exe, or mshta.exe launched by service processes; unexpected new services or scheduled tasks; abnormal access to NFS-shared data; archive creation; credential dumping indicators; and outbound connections from NFS servers to unfamiliar external infrastructure. There are no universally reliable exploit-specific strings for this CVE in the provided data, so detection should combine exposure validation, anomalous NFS traffic, process behavior, service instability, and post-compromise indicators.

• tcp/2049
• udp/2049
• port 2049
• NfsService
• Server for NFS
• nfssvc.exe
• C:\Windows\System32\nfssvc.exe
• Microsoft-Windows-ServicesForNFS-Server
• ServicesForNFS-Server
• Microsoft-Windows-NFS-Server
• NFS-Server
• Service Control Manager
• cmd.exe
• powershell.exe
• wscript.exe
• cscript.exe
• rundll32.exe
• regsvr32.exe
• certutil.exe
• bitsadmin.exe
• mshta.exe
• schtasks.exe

What your security team should do

• Prioritize patching any Windows Server with the NFS role enabled, especially systems reachable from the internet, partner networks, VPN address ranges, or large internal network segments.
• Immediately restrict TCP/UDP 2049 and related NFS/RPC access to explicitly trusted hosts while patching is underway.
• Inventory all Windows Server 2012, 2016, 2019, and 2022 systems to identify where Server for NFS is installed or running.
• Disable Server for NFS on systems where it is not business-critical.
• Hunt for abnormal NFS traffic, service crashes, unexpected child processes, and post-exploitation activity on NFS servers.
• Increase monitoring priority despite non-KEV status because the provided EPSS score indicates high likelihood of exploitation.
• Validate that backups of NFS-hosted data are current, recoverable, and protected from modification by compromised servers.