CVE-2022-26937: Windows Network File System remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication and no user interaction, combined with a very high EPSS percentile, makes this a top remediation priority despite the thin technical detail.

What it is

CVE-2022-26937 is a remote code execution flaw in Microsoft's Windows Network File System (NFS) implementation. It carries a critical CVSS 3.1 score of 9.8 with a network vector and no privileges or user interaction required, so an unauthenticated attacker who can reach the service can potentially execute code. The record gives no root-cause detail beyond the generic description and an uninformative CWE.

Impact

Successful exploitation could let an unauthenticated remote attacker execute arbitrary code on the target server, giving full compromise of confidentiality, integrity and availability per the CVSS vector. The record does not specify the exact code-execution context or privileges gained.

Attack surface

Reachable over the network via the NFS service on affected Windows Server versions; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed. The record does not state which NFS versions or ports are involved.

Exploitation

CISA KEV does not list this CVE and no ransomware use is documented, but EPSS is very high at 0.75974 (99.5th percentile), suggesting elevated likelihood of exploitation activity. Reference tags only cover vendor advisory, mitigation and patch, with no public exploit reference supplied.

What to do

• Apply the Microsoft security update for CVE-2022-26937 as the first action.
• If NFS is not required, disable or uninstall the Windows NFS server role.
• Restrict network access to NFS ports with host firewalls and segmentation so only trusted clients can reach the service.
• Follow the vendor advisory's mitigation guidance where patching cannot be done immediately.
• Monitor Microsoft advisories for updated guidance on this CVE.

Detection

• Monitor NFS service logs and network traffic to NFS ports for anomalous or malformed requests from untrusted hosts.
• Alert on unexpected process creation or child processes spawned by the NFS server service.
• Baseline which hosts run the Windows NFS server role and alert on new or unauthorized NFS listeners.
• Correlate NFS access with authentication and source-IP allowlists to flag connections from unexpected networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.