CVE-2026-96209

Executive Summary

CVE-2026-96209 is an out-of-bounds read (CWE-125) in the Microsoft Windows Network File System (NFS) implementation that permits an authorized attacker to elevate privileges locally. It carries a CVSS v3.1 base score of 7.0 (High) with a vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack vector requiring low privileges and a high degree of attack complexity. Microsoft Windows hosts running the NFS role (server or client) are the affected surface; no public proof-of-concept, exploit code, Nuclei template, or CISA KEV listing currently exists, and EPSS is low at 0.00252.

Technical Analysis

The vulnerability is classified as an out-of-bounds read (CWE-125) within Windows Network File System. Per the NVD description, the flaw "allows an authorized attacker to elevate privileges locally." No further technical detail — such as the specific function, RPC operation, file handle parsing path, or memory structure involved — is provided in the CVE record, and none is fabricated here.

The generic mechanism for an out-of-bounds read in a kernel-mode or privileged NFS component is as follows:

1. Attack surface. Windows NFS exposes file-system access over the network (historically associated with port 2049 and the portmapper/rpcbind service on 111). The local attack vector (AV:L) indicates the exploitable code path is reachable by a local user interacting with the NFS stack (for example, by processing a crafted file handle, RPC request, or NFS protocol response) rather than through direct unauthenticated network access.
2. Trigger. Because the read is out-of-bounds, the malformed input causes the NFS component to read memory beyond an allocated buffer. In a privilege-escalation context, this typically leaks adjacent kernel/privileged memory contents or corrupts control flow read-dependent state that an authorized low-privilege attacker can leverage.
3. Privilege impact. The score's C:H/I:H/A:H with S:U indicates the vulnerable component grants high confidentiality, integrity, and availability impact within the same security scope — consistent with executing code at the level of the affected NFS service context, yielding SYSTEM/privileged access.

The high attack complexity (AC:H) is consistent with the fact that the flaw requires winning a race, predicting memory layout, or crafting a highly specific malformed input, and no PoC is currently public. Specifics of the offending parser or memory structure remain undisclosed; insufficient technical detail is available to name any function, class, parameter, or file path beyond "Windows Network File System."

The absence of an affected version list and of any vendor fix indicates the vulnerable code span has not been publicly mapped by the vendor. Note also that Microsoft's NFS client historically carried a separate, unrelated CVE (CVE-2022-34715) with a similar out-of-bounds write description; that precedent confirms the NFS component is a legitimate local EoP surface, but no data connects CVE-2026-96209 to that prior issue.

Exploitation Scenarios

Reconnaissance / target identification. An attacker first needs local access to a Windows host (via valid low-privilege credentials, a phishing foothold, or an existing session) with the NFS feature installed (Client for NFS and/or Server for NFS). Discovery is passive/local: verifying that the NFS role or client is enabled and that the associated services/rpcbind (port 111) and NFS (port 2049) listeners are present.

Trigger of the flaw class. The attacker submits a crafted input to the NFS stack that the component parses incorrectly, causing an out-of-bounds read. Because the CVE names no specific operation, the attacker must rely on original research to identify which NFS input path (for example, a malformed file handle, an RPC procedure argument, or a loopback-rounded NFS reply) reaches the vulnerable read. No public PoC exists, so the exact trigger is inferred only at the vulnerability-class level — a memory-safety defect exploitable by an authorized local user.

Payload / execution. At the vulnerability-class level, an OOB read used for privilege escalation is typically chained: the leak discloses a memory address or object pointer, which is then used to defeat ASLR/KASLR or craft a follow-on primitive that redirects execution to attacker-controlled data. The report does not assert that the CVE is a combined leak-plus-write primitive — only that the assigned CW (CWE-125) is a read primitive, and any privileged code execution results from chaining.

Post-exploitation. Successful exploitation grants elevated/SYSTEM privileges on the local Windows host. From there an attacker can disable defenses, dump credentials via OS-native tooling, establish persistence, and pivot laterally (including to any network shares the host can reach). Because AC is High, reliable exploitation may require significant attacker effort and favorable memory layout; the low EPSS reflects that reliability challenge and the lack of a public exploit.

Impact Assessment

• Confidentiality: High (C:H). An OOB read can disclose privileged memory contents and is explicitly tied to privilege escalation. Once elevated, the attacker can read arbitrary protected data on the host.
• Integrity: High (I:H). Privilege escalation enables tampering with system configuration, security controls, and data.
• Availability: High (A:H), Scope: Unchanged (S:U). The vulnerable NFS component's own security scope is affected; denial of the NFS service is plausible during a crash-prone malformed-input attempt.
• Blast radius. Any Windows server or client with the NFS component enabled and used where a low-privilege local principal can reach it. Servers acting as NFS endpoints are the highest-value targets because elevation to SYSTEM on a file-serving host can expose shared datasets.
• Privileges/complexity. PR:L means only an authorized (non-admin) local user is needed; AC:H and UI:N mean no user interaction but meaningful exploitation difficulty.
• Security posture. No patch, no workaround, no affected-version enumeration, and no KEV/EPSS signal combine to a high unpatched risk profile (patch confidence 0/4) despite the modest 7.0 base score.

Detection Guidance

Detection for CWE-125 is inherently environment-dependent because the CVE supplies no IOCs, hashes, or known exploit artifacts. The rules below target anomalous local interaction with the Windows NFS stack and unexpected privileged-process activity; they are heuristic and should be tuned to the environment.

Sigma Rule

title: Suspicious Local Interaction with Windows NFS Services (Possible CVE-2026-96209)
id: 8f1c2a94-3b7d-4e6f-9a02-6c1d5e7f0b3a
status: experimental
description: Detects local processes interacting with or spawning from NFS-related Windows services, consistent with attempted privilege escalation via an out-of-bounds read in Windows Network File System.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96209
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\System32\services.exe'
  selection_nfs_child:
    Image|endswith:
      - '\nfsd.exe'
      - '\nfsclnt.exe'
  selection_susp_child:
    ParentImage|endswith:
      - '\nfsd.exe'
      - '\nfsclnt.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\whoami.exe'
      - '\net.exe'
  condition: (selection_parent and selection_nfs_child) or selection_susp_child
fields:
  - Image
  - ParentImage
  - CommandLine
  - User
falsepositives:
  - Legitimate administrative tooling managing the NFS role
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.96209

YARA Rule

rule CVE_2026_96209_Exploit_Artifact_Generic_WindowsNFS
{
    meta:
        description = "Generic heuristic for tooling that references Windows Network File System privilege-escalation exploitation (CVE-2026-96209)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96209"
        date = "2026-01-01"
        severity = "high"
    strings:
        $cve = "CVE-2026-96209" ascii wide nocase
        $nfs1 = "Windows Network File System" ascii wide nocase
        $nfs2 = "nfsd.exe" ascii wide nocase
        $nfs3 = "Client for NFS" ascii wide nocase
        $cwe = "CWE-125" ascii wide nocase
        $poc = "proof-of-concept" ascii wide nocase
    condition:
        $cve or (2 of ($nfs*) and ($cwe or $poc))
}

Suricata IDS Rule

alert tcp any any -> any 2049 (msg:"CVE-2026-96209 Possible Windows Network File System Out-of-Bounds Read - Anomalous NFS Request"; flow:established,to_server; dsize:<48; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-privilege-escalation; sid:9620901; rev:1; reference:cve,2026-96209;)

Elastic Detection

sequence by host.id, user.name with maxspan=30s
  [process where process.parent.name in ("nfsd.exe", "nfsclnt.exe") and
   process.name in ("cmd.exe", "powershell.exe")] by host.id

Alternative single-event heuristic:

process where process.name in ("nfsd.exe", "nfsclnt.exe") and
process.command_line != null

(Detects unexpected command lines associated with NFS service processes; tune to baseline.)

Splunk SPL Query

index=windows (source="XmlWinEventLog:Security" OR source="WinEventLog:Security") EventCode=4688
| eval proc=lower(Image)
| where proc LIKE "%nfsd.exe" OR proc LIKE "%nfsclnt.exe"
   OR (ParentImage LIKE "%nfsd.exe" OR ParentImage LIKE "%nfsclnt.exe")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as cmds by Computer, Account_Name, ParentImage, Image
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="windows,nfs,privilege_escalation,">
  <rule id="962090" level="10">
    <if_sid>60000</if_sid>
    <field name="win.eventdata.parentImage">nfsd\.exe|nfsclnt\.exe</field>
    <field name="win.eventdata.image">cmd\.exe|powershell\.exe|whoami\.exe|net\.exe</field>
    <description>CVE-2026-96209: Suspicious child process spawned by Windows NFS service (possible privilege escalation)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
    <group>cve_2026_96209,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround is available from any tracked source as of this report.

1. Immediate mitigations

   • Remove or disable the Windows NFS feature (Client for NFS and/or Server for NFS) on hosts that do not require it, eliminating the attack surface entirely.
   • Where NFS must remain, restrict local logon rights to trusted principals and minimize the number of authorized local users on NFS-enabled hosts, since the flaw requires an authorized local attacker.
   • Enforce least privilege and application-control policies to limit the tools a local user could use to exercise a memory-safety primitive.
   • Isolate NFS-enabled servers on segmented networks; block inbound/outbound NFS (2049) and rpcbind (111) except from strictly required peers.
   • Enable robust endpoint logging and alerting using the detection content above, given the absence of vendor signatures.

2. Patch / upgrade steps

   • No fixed version is known. Monitor the Microsoft Security Update Guide and Microsoft Security Response Center (MSRC) advisories for an update referencing CVE-2026-96209 and the Windows NFS component.
   • Establish a patch-watch process; when a fix ships, validate in a staging environment and roll out on an accelerated schedule due to the privilege-escalation impact.

3. Long-term hardening

   • Maintain a software inventory of Windows hosts with the NFS feature enabled and remove the feature where not operationally justified.
   • Apply exploit-mitigation hardening (ASLR, CFG, kernel pool protections) and keep OS builds current to raise the bar for memory-corruption exploitation.
   • Adopt network microsegmentation for file-services protocols and retire legacy/duplicative NFS stack deployments.
   • Continuously re-check EPSS and CISA KEV status; if exploitation activity emerges, escalate remediation priority immediately.

References

1. NVD — CVE-2026-96209: https://nvd.nist.gov/vuln/detail/CVE-2026-96209
2. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
3. MITRE ATT&CK — T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
4. Microsoft Security Update Guide (monitor for the vendor fix): https://msrc.microsoft.com/update-guide
5. FIRST EPSS — CVE-2026-96209 score lookup: https://api.first.org/data/v1/epss?cve=CVE-2026-96209

Threat actor / exploit-in-the-wild status: No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template are associated with CVE-2026-96209 at the time of writing. No known threat actor campaigns are attributed. EPSS is 0.00252 (~15.5th percentile), indicating a low — but non-zero — predicted likelihood of exploitation in the near term.