CVE-2026-62893 lets an unauthenticated attacker take over any exposed Windows Deployment Services box — and admins who patched it are now watching PXE boot and MDT deployments break instead.
Microsoft's August 2026 Patch Tuesday fixed a critical, unauthenticated remote-code-execution hole in Windows Deployment Services — the built-in tool IT departments use to image new PCs over the network — and the patch is now breaking the exact feature it was protecting. If you manage WDS and you're seeing PXE boot loops or corrupted deployment files since applying August's updates, this is why, and there's a specific setting to change.
A bug in a protocol with no password, by design
TFTP — Trivial File Transfer Protocol — is decades old and has zero authentication built in, on purpose: a bare-metal machine that hasn't booted an OS yet can't log into anything. WDS's TFTP server listens on UDP port 69 to serve boot images to exactly those machines. If that port is reachable, so is the bug. Microsoft's had a run of these zero-interaction flaws lately — barely a week before this patch, it rushed out fixes for three separate perfect-10 bugs in Azure and Teams.
The mechanics are a use-after-free: the server acts on a piece of memory without first checking it's still valid. An attacker sends a timed sequence of crafted packets to land in that gap and gets code execution as the WDS service account — typically SYSTEM — without ever presenting a credential.
9.8
CVSS score
Critical — network vector, no auth, no user interaction
UDP/69
Port exposed
TFTP has no authentication mechanism
More Likely
Exploitability rating
Microsoft's own assessment, not yet confirmed exploited
4
Affected OS versions
Windows 10 1809, Server 2019/2022/2025
The fix broke the feature it was fixing
Since applying the update, admins have reported machines PXE-booting off WDS servers hitting repeated reboot loops, with Event ID 4101 — "a client failed a TFTP download" — showing up in logs. Separately, Microsoft Deployment Toolkit's Boot Configuration Data files inside remote install folders have reportedly been getting modified after reboot, breaking deployment workflows beyond just the affected host.
1
Confirm whether your WDS servers actually serve TFTP publicly, or only on an isolated deployment VLAN — exposure surface is the whole risk model here.
2
Patch first, then test one PXE boot in a controlled environment before rolling the update fleet-wide.
3
If you hit Event ID 4101 or PXE boot loops, disable 'Enable Variable Window Extension' in WDS TFTP settings and restart the WDS service.
4
If WDS/TFTP isn't in active use, block UDP port 69 at the network perimeter — Zero Day Initiative's own mitigation guidance for this CVE.
Who actually needs to worry
Most exposure risk sits with enterprise networks running PXE imaging fleets — schools, large offices, MSPs — not typical home users. But a WDS server reachable from a flat internal network, or from a segment an attacker has already compromised, is squarely in scope. This is a lateral-movement multiplier once someone's already inside, not just a perimeter bug.
Vulnerable vs. fixed
Vulnerable
Detail
Windows 10 1809, Server 2019/2022/2025 with WDS TFTP enabled, unpatched
WDS servers reachable from a flat internal network are in scope even without any internet exposure. · Unsplash
What does CVE-2026-62893 actually let an attacker do?
Send crafted UDP packets to an exposed Windows Deployment Services TFTP server and get remote code execution with no credentials, no user interaction, and no prior access — a full unauthenticated takeover of the box.
Is this being exploited right now?
Microsoft assesses it as 'Exploitation More Likely' rather than confirmed in-the-wild exploitation as of this writing. That rating is Microsoft's own signal that a working exploit is a near-term risk, not a hypothetical one.
My PXE boot broke after patching — is that this bug or something else?
Multiple admins have reported PXE boot failures and Event ID 4101 after applying the August 2026 update. The documented workaround is disabling 'Enable Variable Window Extension' in WDS TFTP settings and restarting the WDS service.
Do I need WDS/TFTP exposed to the internet for this to matter?
No — internal exposure is enough. Anyone already inside your network segment, including a compromised device or a lateral-moving attacker, can reach an internal WDS server the same way a legitimate PXE-booting machine does.
This is the second Windows Server networking component patched this year with the exact wormable-adjacent profile — no auth, no interaction, remote — after the DNS Server RCE Microsoft fixed in June. My honest take: legacy protocols with zero built-in authentication, TFTP and DNS before it, keep being where this class of bug lands, because the protocol itself was never designed to resist a hostile network. If you're still running WDS in 2026, this is a good prompt to ask whether it needs to be reachable from anywhere except the exact VLAN doing the imaging. It shipped the same Patch Tuesday as the Lazarus-exploited WinSock zero-day and the ShieldBreak Defender bypass saga — patch the whole batch, not just the headline bug.
