VDB

CVE-2026-42987

CVE-2026-42987 PUBLISHED CVSS 8.1 HIGH

Reported by microsoft · Published June 9, 2026

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Risk Scores

CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected Products

VendorProductVersions
MicrosoftWindows Server 20126.2.9200.0
MicrosoftWindows Server 2012 (Server Core installation)6.2.9200.0
MicrosoftWindows Server 2012 R26.3.9600.0
MicrosoftWindows Server 2012 R2 (Server Core installation)6.3.9600.0
MicrosoftWindows Server 201610.0.14393.0
MicrosoftWindows Server 2016 (Server Core installation)10.0.14393.0
MicrosoftWindows Server 201910.0.17763.0
MicrosoftWindows Server 2019 (Server Core installation)10.0.17763.0
MicrosoftWindows Server 202210.0.20348.0
MicrosoftWindows Server 202510.0.26100.0
MicrosoftWindows Server 2025 (Server Core installation)10.0.26100.0
microsoftwindows_server_201610.0.14393.0, 10.0.14393.0, 10.0.14393.0
microsoftwindows_server_202210.0.20348.0, 10.0.20348.0, 10.0.20348.0
MicrosoftWindows Server 2019 (Server Core installation)10.0.17763.0, 10.0.17763.0, 10.0.17763.0
microsoftwindows_server_20126.2.9200.0, 6.2.9200.0, 6.2.9200.0
MicrosoftWindows Server 201910.0.17763.0, 10.0.17763.0, 10.0.17763.0
MicrosoftWindows Server 202510.0.26100.0, 10.0.26100.0, 10.0.26100.0
MicrosoftWindows Server 201610.0.14393.0, 10.0.14393.0, 10.0.14393.0
MicrosoftWindows Server 202210.0.20348.0, 10.0.20348.0, 10.0.20348.0
MicrosoftWindows Server 2012 R2 (Server Core installation)6.3.9600.0, 6.3.9600.0, 6.3.9600.0

…and 8 more

Timeline

  • Jun 9, 2026 CVE Published
  • Jun 10, 2026 Coalition ESS Score
  • Jun 10, 2026 Security Advisory
  • Jun 10, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›