Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network, giving the attacker full control of the affected server. This flaw directly enables remote code execution and can result in complete compromise of the host and any services running on it.

Affected Windows Server products include Windows Server 2008 R2 Service Pack 1 and Server Core, Windows Server 2008 Service Pack 2 and Server Core, Windows Server 2012 and Server Core, Windows Server 2012 R2 and Server Core, Windows Server 2016 and Server Core, Windows Server 2019 and Server Core, Windows Server 2022, Windows Server 2022 23H2 Edition and Server Core, Windows Server 2025 and Server Core, and the Windows Server 23H2 release. All of these versions are vulnerable when the Windows Deployment Services role is installed.

The vulnerability carries a CVSS score of 7.5, indicating high severity. EPSS indicates a very low but non-zero exploitation likelihood (<1%), and it is not listed in the CISA KEV catalog. The attack vector is network-based, requiring an attacker to reach the Windows Deployment Services on the target network. If exploited, an attacker could execute arbitrary code with system privileges, potentially compromising the entire network segment.