A weakness in the authentication controls of Microsoft Windows Server’s Network Device Enrollment Service allows an attacker to execute arbitrary code from outside the host. The flaw is classified as CWE‑1390, which indicates that an attacker could gain access to critical system resources without proper authentication, leading to potential compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is limited to code execution – no information disclosure or denial‑of‑service is documented in the description.

The vulnerability applies to Windows Server releases starting with 2012 through the latest 2025 editions, including both full and Server Core installations. The affected platforms receive a list of CPEs that cover 64‑bit versions of each Windows Server iteration, indicating that any server running these operating systems and exposing the NDES service is at risk.

The CVSS score of 8.1 denotes high severity. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified, but the flaw is listed outside the CISA KEV catalog. The likely attack vector is an unauthenticated or weakly authenticated connection to the NDES endpoint over a network, which an attacker can use to induce remote code execution. Because the vulnerability requires network interaction with NDES, systems exposing this service to untrusted networks are the most vulnerable.