CVE-2026-32073

What it actually does

CVE-2026-32073 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock, afd.sys. A low-privileged authenticated user or process on an affected Windows workstation or server may be able to manipulate AFD socket-related kernel objects after they have been freed, potentially leading to arbitrary kernel memory manipulation and execution with NT AUTHORITY\SYSTEM privileges. The flaw is local-only, requires prior access to the system, and is assessed as higher complexity, but successful exploitation provides full confidentiality, integrity, and availability impact on the affected host.

Why it matters to the business

An attacker who already has a foothold on an affected Windows system could use this flaw to gain full control of that machine, disable security tools, steal credentials, move laterally, deploy malware, or tamper with business-critical workloads. Although the issue is not currently listed in CISA KEV, has low EPSS, and has no public exploit maturity reported, Windows local privilege escalation bugs are commonly chained with phishing, stolen credentials, browser exploits, or remote code execution vulnerabilities, so unpatched endpoints and servers remain valuable targets over time.

How an attack unfolds

Exploitation begins after an attacker obtains code execution as a standard local user, such as through phishing, malware, a compromised account, or another vulnerability. The attacker runs a local exploit that interacts with WinSock/AFD kernel interfaces and attempts to trigger a use-after-free condition in afd.sys. If the exploit successfully controls the freed kernel object at the right time, it can alter kernel memory or process security context to elevate the attacker's process to SYSTEM. With elevated privileges, the attacker can dump credentials, install persistence, disable endpoint protections, access sensitive files, create privileged accounts, or use the host as a staging point for lateral movement. Because exploitation is local and complex, evidence is more likely to appear as suspicious post-exploitation activity after a privilege jump than as a clear network-based signature.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32073 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Where systems cannot be patched immediately, reduce exposure by enforcing least privilege, removing local administrator rights where not required, restricting interactive logon to servers, enabling endpoint detection and response, blocking untrusted executable content, and prioritizing patching for internet-facing servers, jump hosts, developer workstations, domain administration workstations, and systems that process untrusted files or user sessions. No fixed package versions were provided in the input, so remediation should be validated against Microsoft’s official security update guidance, cumulative update level, OS build number, and afd.sys file version for each supported platform.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows host has installed the Microsoft cumulative security update that includes the fix for CVE-2026-32073. Check OS build numbers, installed hotfixes, Windows Update compliance reports, vulnerability scanner results, and the version/signing timestamp of %SystemRoot%\System32\drivers\afd.sys against Microsoft’s fixed version guidance for the specific OS release. Re-scan with an authenticated vulnerability scanner after patching. For high-value systems, validate that patch installation did not fail or roll back, that the device has rebooted if required, and that afd.sys loaded from the expected Microsoft-signed system path. Exposure should be considered unresolved on unsupported or end-of-life Windows builds unless an applicable extended security update is installed.

Typical attack path

1. Gain initial access to an affected Windows workstation or server as a low-privileged authenticated user or process.
2. Execute a local privilege escalation tool or malware component on the host.
3. Interact with Windows socket/AFD functionality to trigger the use-after-free condition in the Ancillary Function Driver for WinSock.
4. Attempt to corrupt or influence kernel memory in a way that changes the attacker's security context.
5. Spawn or inject into a process running as NT AUTHORITY\SYSTEM.
6. Use elevated privileges to disable defenses, dump credentials, install persistence, access protected data, or move laterally.

How to detect it

There is no reliable network-only indicator for this vulnerability because exploitation is local and occurs in a Windows kernel driver. To assess possible prior exploitation, review endpoint and Windows telemetry for suspicious privilege transitions and post-exploitation behavior around the time a low-privileged user or unknown process gained SYSTEM-level execution. Relevant sources include Windows Security logs, Sysmon, EDR process and token telemetry, PowerShell logs, Windows Defender/antivirus events, service control manager logs, scheduled task logs, crash dumps, Windows Error Reporting, and kernel bugcheck events. Hunt for Event ID 4688 process creation where a process originally associated with a standard user leads to cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, wscript.exe, mshta.exe, or another utility running as SYSTEM; Event ID 4672 special privileges assigned to a logon unexpectedly following standard user activity; Event ID 7045 new service installation; Event ID 4698 scheduled task creation; suspicious LSASS access; tampering with security services; or unexpected modification of local administrator membership. Kernel instability, bugchecks, or WER reports involving afd.sys may indicate failed exploitation attempts, though these events are not conclusive. Because no public exploit-specific artifact is provided, detections should focus on behavioral evidence of local privilege escalation and subsequent actions rather than a single definitive IOC.

What your security team should do

• Prioritize patch deployment to Windows servers, privileged access workstations, shared workstations, VDI pools, and endpoints used by administrators or developers.
• Use authenticated vulnerability scanning and patch management telemetry to identify affected Windows versions and confirm successful installation of the relevant Microsoft security update.
• Treat this as a post-compromise privilege escalation risk: pair patching with controls that reduce initial access, including phishing resistance, application control, endpoint protection, and least privilege.
• Hunt for signs of recent local privilege escalation, especially low-privileged user processes spawning SYSTEM shells, creating services, modifying security tools, or accessing credential stores.
• Review local administrator group membership, service account privileges, and interactive logon rights on servers to limit the value of successful exploitation.
• Monitor for exploit development even though current EPSS is low, the 30-day EPSS trend is flat, the issue is not in KEV, and no mature public exploit is currently reported.
• Ensure systems that cannot be patched promptly have compensating controls such as application allowlisting, EDR enforcement, restricted PowerShell, and tight server logon restrictions.