Windows file servers commonly hold sensitive files, databases, passwords and more. Which of the following choices would be a common vulnerability that usually exposes them?

Cross-site scripting is a web application vulnerability targeting browser-rendered content and is not a threat vector applicable to Windows file server infrastructure.

SQL injection exploits database-driven web application query handling and has no relevance to file server operation or exposure.

Missing patches are the most prevalent vulnerability for Windows file servers because unpatched systems retain known security flaws in the OS, SMB services, and third-party software that attackers routinely exploit. Patch management is a foundational security control specifically because its absence directly enables the majority of server compromises via publicly disclosed CVEs. Unpatched Windows services like SMB have historically been the entry point for widespread attacks such as WannaCry and NotPetya.

CRLF injection is an HTTP protocol attack that manipulates headers or log entries in web applications, not a mechanism that targets Windows file servers.