CVE-2026-71336: Windows Work Folder Service Remote Code Execution Vulnerability

Microsoft’s Security Response Center published the advisory on September 11, 2026. The issue is an integer overflow or wraparound weakness, tracked as CWE-190, in Windows Work Folder Service. Microsoft assigns CVE-2026-71336 a CVSS base score of 8.8 and a temporal score of 7.7.

The complete CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. In practical terms, the rating reflects a network-reachable service where an attacker needs valid low-level authentication but no user interaction; successful exploitation can affect confidentiality, integrity, and availability.

Microsoft’s exploitation scenario​

Microsoft describes CVE-2026-71336 as follows: “Windows Work Folder Service Remote Code Execution Vulnerability: Integer overflow or wraparound in Windows Work Folder Service allows an authorized attacker to execute code over a network.”

The official advisory provides a more useful operational boundary than the headline alone. “How could an attacker exploit this vulnerability? An authenticated attacker with low-level access to an affected server could send a specially crafted request to execute code on the server. User interaction is not required.”

That means the condition is not described as an unauthenticated internet-wide worm vector. Authentication is required. But a low-privilege account is sufficient in Microsoft’s stated scenario, so organizations should not treat ordinary user-level access as a meaningful protection for servers that expose or use Work Folders. A compromise of a lower-privilege account could become a route to server-side code execution if the vulnerable service is reachable and the attacker can deliver the crafted request.

Microsoft’s current assessment is Exploitation Unlikely. The advisory also records the following status fields:

• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Those fields support prioritizing the update as a remediation task rather than evidence of an active incident. The absence of required user interaction makes patching more important than relying on user-awareness controls, while the authentication requirement makes identity and access controls a relevant compensating measure during deployment windows.

The affected estate is weighted toward long-lived servers​

The affected-product list spans Windows Server 2012 R2 through Windows Server 2025, including Server Core installations and full x64 installations. It also includes Windows 10 Version 1607 and Windows 10 Version 1809 in both 32-bit and x64 variants.

This scope deserves attention from administrators managing older application servers and branch infrastructure. The same vulnerability maps to different cumulative updates and build targets depending on the OS servicing branch, so checking only that “September updates installed” is less useful than checking the precise KB and build that Microsoft identifies as fixed.

Windows Work Folder Service is the component named in the advisory, and CVE-2026-71336 concerns that service rather than a generic Windows networking defect. Asset owners should therefore identify systems where Work Folders is deployed, reachable, or required by an existing file-sync workflow, then reconcile those systems against the update targets below. The official affected list includes both Server Core and desktop-experience-style entries, so Server Core deployments should not be excluded from patch planning.

Required KBs and fixed builds​

Microsoft’s remediation is installation of the listed KB update for each product, followed by confirmation of the specified fixed build.

The pairing is worth calling out because it crosses product generations. KB5123099 applies to Windows 10 Version 1607 and Windows Server 2016; KB5122876 applies to Windows 10 Version 1809 and Windows Server 2019. Windows Server 2012 R2 uses KB5123066, Windows Server 2022 uses KB5122882, and Windows Server 2025 uses KB5122871.

Verification should use build targets, not update names alone​

For patch-management teams, the build number is the practical completion signal. A deployment report that merely shows a KB as approved or attempted does not establish that an endpoint reached the fixed state, particularly where installations are pending a restart or an update has failed during servicing.

The target builds are:

• Windows 10 Version 1607 and Windows Server 2016 must reach 10.0.14393.9512 through KB5123099.
• Windows 10 Version 1809 and Windows Server 2019 must reach 10.0.17763.9245 through KB5122876.
• Windows Server 2012 R2 must reach 6.3.9600.23397 through KB5123066.
• Windows Server 2022 must reach 10.0.20348.5622 through KB5122882.
• Windows Server 2025 must reach 10.0.26100.33438 through KB5122871.

Administrators should prioritize servers with Work Folders enabled and ensure that update maintenance includes the required restart and post-install verification. Where patch deployment must be staged, access to affected servers should be restricted to the smallest necessary set of authenticated users, since Microsoft’s scenario begins with an attacker who already has low-level access.

CVE-2026-71336 does not call for user action at the desktop level; it calls for server patch validation. The immediate operational milestone is straightforward: deploy the correct KB for each supported servicing branch and confirm the corresponding fixed build before treating affected Work Folder Service systems as remediated.