Windows 11 & Server 2025 - Microsoft Blocks RCE Vulnerability
Basically, Microsoft found a serious flaw that lets hackers take control of computers during setup.
Microsoft is disabling hands-free deployment in Windows 11 and Server 2025 due to a critical RCE vulnerability. This flaw allows attackers to execute arbitrary code, posing serious risks. Administrators must act quickly to secure their systems before the April deadline.
The Flaw
Microsoft has uncovered a critical remote code execution (RCE) vulnerability in Windows Deployment Services (WDS), tracked as CVE-2026-0386. This vulnerability arises from improper access control, allowing attackers on the same network to intercept sensitive configuration files. Specifically, the issue lies in how the Unattend.xml file is transmitted over an unauthenticated channel, making it vulnerable to interception. This flaw could enable attackers to execute arbitrary code during OS deployments, potentially leading to SYSTEM-level privileges and lateral movement across networks.
The vulnerability affects various versions of Windows Server, including Server 2008 through Server 2025. Security researchers emphasize that a successful exploit could allow attackers to not only steal embedded credentials but also inject malicious code. This poses a significant risk to enterprise environments, as it could compromise the integrity of OS deployment images, representing a supply chain-level risk.
Two-Phase Hardening Timeline
To address this vulnerability, Microsoft has initiated a two-phase plan. In Phase 1, which began on January 13, 2026, the hands-free deployment feature remains operational but can be disabled by administrators. Microsoft introduced new Event Log alerts and registry key controls to enforce secure behavior. Administrators are encouraged to set AllowHandsFreeFunctionality = 0 in the registry to mitigate risks.
Phase 2 will commence in April 2026, when the hands-free deployment feature will be entirely disabled by default. Administrators who have not adjusted their registry settings will find this feature blocked post-April security update. For those who require the feature temporarily, it can be re-enabled, but Microsoft warns this should only be a short-term solution due to security concerns.
What You Should Do
Organizations using Windows Deployment Services must take immediate action to safeguard their systems. Here are some recommended steps:
- Review all WDS configurations for Unattend.xml usage.
- Apply the latest Windows security updates released after January 13, 2026.
- Set
AllowHandsFreeFunctionality = 0to enforce secure behavior before April 2026. - Monitor Event Viewer for any warnings regarding insecure access to Unattend.xml.
- Consider migrating to alternative deployment methods like Microsoft Intune or Windows Autopilot, which are not affected by this vulnerability.
Acting promptly is crucial to prevent disruption in deployment processes and to enhance security across enterprise environments. Microsoft has provided detailed guidance in their KB article 5074952 for impacted organizations.
Conclusion
The discovery of CVE-2026-0386 highlights the importance of robust security measures in deployment services. As attackers become more sophisticated, organizations must stay vigilant and proactive in addressing vulnerabilities. Microsoft’s phased approach to disabling the hands-free deployment feature is a critical step in mitigating the risks associated with this flaw. Administrators are urged to implement the recommended actions to protect their systems effectively.
Cyber Security News