CVE-2026-70585Critical

Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability

Assessment

Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.

Severity: Critical
CVSS base score: 7.0CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Impact: Remote Code Execution
EPSS, next 30 days: 0.3%Higher than 16.4% of scored CVEs · FIRST model run 26 Sep 2026 · about EPSS
Exploitability: Exploitation More Likely
Publicly disclosed: No
Customer action: Required: apply the update
Component: Windows Services for NFS ONCRPC XDR Driver
Weakness: CWE-416: Use After Free
Issued by: Microsoft
Published: 8 Sep 2026 · September 2026
Last revised: 8 Sep 2026

6 KBs

KB	Type	Restart	Applies to	Other CVEs
KB5122871	Security Update	Required	Windows Server 2025, Windows Server 2025 (Server Core installation)	All CVEs in KB5122871
KB5122876	Security Update	Required	Windows Server 2019, Windows Server 2019 (Server Core installation)	All CVEs in KB5122876
KB5122882	Security Update	Required	Windows Server 2022, Windows Server 2022 (Server Core installation)	All CVEs in KB5122882
KB5123065	Monthly Rollup	Required	Windows Server 2012, Windows Server 2012 (Server Core installation)	All CVEs in KB5123065
KB5123066	Monthly Rollup	Required	Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation)	All CVEs in KB5123066
KB5123099	Security Update	Required	Windows Server 2016, Windows Server 2016 (Server Core installation)	All CVEs in KB5123099

ESU, Windows

12 affected products