CVE-2023-24941: Windows Network File System uninitialized resource remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with a network, unauthenticated, no-interaction vector and a very high EPSS score make this a top remediation priority despite the absence of KEV listing or confirmed public exploit.

What it is

CVE-2023-24941 is a remote code execution flaw in the Windows Network File System (NFS) service, rooted in use of an uninitialized resource (CWE-908). It affects Windows Server 2012, 2016, 2019 and 2022, and because the service is network reachable and the flaw is pre-authentication, it is a serious exposure for any host running the NFS server role. The record gives no further technical detail on the exact trigger.

Impact

A remote, unauthenticated attacker can execute arbitrary code in the context of the NFS service, which on Windows Server typically runs with high privileges. That can lead to full host compromise, data theft or lateral movement.

Attack surface

Reached over the network via the NFS service on affected Windows Servers, per the AV:N vector. No authentication (PR:N) and no user interaction (UI:N) are required, so any host exposing the NFS server role is directly reachable.

Exploitation

The record does not list this CVE in CISA KEV and documents no ransomware use. EPSS is very high (0.947, 99.85th percentile), indicating strong predicted exploitation activity, but the references carry only vendor patch and mitigation tags, so no public exploit is confirmed here.

What to do

• Apply the Microsoft security update for CVE-2023-24941 as the first action, per the vendor advisory.
• If NFS is not required, disable or uninstall the NFS server role and related services.
• Restrict network access to NFS ports (TCP/UDP 2049 and related RPC ports) to trusted hosts only.
• Apply the vendor mitigations in the MSRC update guide where patching cannot be done immediately.
• Monitor for and remove unnecessary NFS shares and exposed instances.

Detection

• Monitor NFS service crashes or unexpected restarts on Windows Servers, which can indicate exploitation attempts.
• Alert on anomalous or unexpected processes spawned by the NFS service (nfsd/nfssvc) or its host process.
• Baseline and alert on inbound connections to NFS/RPC ports from untrusted or unusual source addresses.
• Review Windows event logs and EDR telemetry for suspicious activity on servers running the NFS role.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.