Windows file servers commonly hold sensitive files, databases, passwords and more. Which of the following choices would be a common vulnerability that usually exposes them?

Cross-site scripting is a web application vulnerability that requires a browser and HTTP context, not applicable to file server services.

SQL injection targets database query parsing and is not a relevant attack surface for a Windows file server's core function.

Windows file servers that lack current patches are exposed to publicly known vulnerabilities in the operating system and services such as SMB, which have been exploited by attacks like WannaCry and NotPetya. Patch management is consistently identified by CISA and NIST as the top mitigation for server compromises. Unpatched systems give attackers reliable, well-documented attack paths that require minimal sophistication.

CRLF injection exploits improper handling of carriage return and line feed characters in web or application responses, not a file server vulnerability.