VulnerabilityPublished
ZDI-26-275: Microsoft Qlib _mount_nfs_uri Command Injection Remote Code Execution Vulnerability
Source Zero Day Initiative
0
Severity
HighRated High by Zero Day Initiative
Data as of 26 May 2026, 20:33 UTC
What to do
AI-suggested
An official patch addressing this vulnerability was released by Microsoft on May 31, 2025. Users and administrators should apply this update immediately to remediate the issue. Since this is not a cloud service, remediation depends on applying the vendor-provided fix. No additional mitigation steps are indicated in the advisory.
Description
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Microsoft Qlib. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8.
References
Community reviews
Loading reviews…