{"id":"CVE-2026-118140","aliases":[],"cve":{"records":[{"id":"CVE-2026-118140","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-27T17:35:36.727Z","published":"2026-11-10T18:20:18.771Z","modified":"2026-11-13T18:09:06.903Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-13T18:09:06.903Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-10T19:49:02.819Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118140","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-284","description":"CWE-284: Improper Access Control","source":"microsoft"},{"id":"CWE-497","description":"CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.14393.0","versionEndExcluding":"10.0.14393.9688"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.17763.0","versionEndExcluding":"10.0.17763.9487"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.20348.0","versionEndExcluding":"10.0.20348.5870"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"},{"vulnerable":true,"criteria":"cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.26100.0","versionEndExcluding":"10.0.26100.33822"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-10T19:47:27.504918Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Server for NFS Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Improper access control in Windows Server for NFS allows an authorized attacker to disclose information locally.","score":5.5,"severity":"medium","published":"2026-11-10T18:20:18.771Z","modified":"2026-11-13T18:09:06.903Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Windows Server 2016","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2016 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.14393.0","status":"affected","lessThan":"10.0.14393.9688","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2019","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2019 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.17763.0","status":"affected","lessThan":"10.0.17763.9487","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2022","platforms":["x64-based Systems"],"versions":[{"version":"10.0.20348.0","status":"affected","lessThan":"10.0.20348.5870","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2025","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"},{"vendor":"Microsoft","name":"Windows Server 2025 (Server Core installation)","platforms":["x64-based Systems"],"versions":[{"version":"10.0.26100.0","status":"affected","lessThan":"10.0.26100.33822","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118140"],"sources":[{"name":"CVE","id":"CVE-2026-118140","modified":"2026-11-13T18:09:06.903Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.5}],"sourceAffected":[],"observedAt":"2026-11-13T18:33:53.063Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:10:34.932Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T07:05:33.199Z","attemptedAt":"2026-11-12T07:05:33.199Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T07:05:34.096Z","attemptedAt":"2026-11-12T07:05:34.096Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T07:05:33.199Z","attemptedAt":"2026-11-12T07:05:33.199Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T07:05:34.096Z","attemptedAt":"2026-11-12T07:05:34.096Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-118140","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118140","modified":"2026-11-10T20:18:13.090","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T07:05:33.199Z"},{"source":"ENISA EUVD","id":"EUVD-2026-122092","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-122092","modified":"Nov 11, 2026, 5:15:42 PM","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-12T07:05:33.199Z"},{"source":"GitHub Advisory Database","id":"GHSA-686q-vm73-893h","url":"https://github.com/advisories/GHSA-686q-vm73-893h","modified":"2026-11-10T21:33:05Z","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-12T07:05:34.096Z"}],"aiSummary":{"text":"Windows Server for NFS has an improper access control vulnerability, allowing an authorized attacker to disclose information locally, affecting versions 10.0.14393.0 to 10.0.14393.9688, 10.0.17763.0 to 10.0.17763.9487, 10.0.20348.0 to 10.0.20348.5870, and 10.0.26100.0 to 10.0.26100.33822.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T03:01:19.411Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118140"}]}}