microsoft patched a critical bug in the tool that images every PC in your office — then the fix broke it

CVE-2026-62893 is a CVSS 9.8 use-after-free in the WDS TFTP server, exploitable by an unauthenticated attacker sending crafted UDP packets — no login, no user click required.

It affects Windows 10 version 1809 and Windows Server 2019, 2022 and 2025 running WDS with TFTP enabled for PXE network boot.

Microsoft rates it 'Exploitation More Likely' rather than confirmed active exploitation — patch before that changes, not after.

The August patch itself is causing PXE boot failures and Microsoft Deployment Toolkit (MDT) file corruption for some admins, logged as Event ID 4101.

The documented workaround is disabling the WDS 'Enable Variable Window Extension' setting and restarting the WDS service.

If you manage WDS, read this before you patch fleet-wide

Microsoft's official line frames some reboot behavior as expected: multiple reboots happen when new Secure Boot certificates are staged, written to firmware, and applied alongside a newly-signed…