CVE-2026-32086

What it actually does

This is a local privilege escalation vulnerability in the Windows Function Discovery Service component, specifically involving fdwsd.dll. The flaw is a race condition caused by improper synchronization around a shared resource. A low-privileged, authenticated local attacker who can win the timing condition may cause the service to perform privileged operations in an unintended state, potentially allowing code execution or actions with elevated privileges. The CVSS vector indicates local access, low privileges required, no user interaction, high attack complexity, and potential full confidentiality, integrity, and availability impact after successful exploitation.

Why it matters to the business

Successful exploitation could allow an attacker who already has a foothold on a Windows workstation or server to become an administrator or SYSTEM-level user, enabling credential theft, security tool tampering, lateral movement, data access, or deployment of malware. Because the affected versions include many supported Windows client and server releases, exposure can be broad in mixed Windows estates. The vulnerability is not currently listed in CISA KEV, has no known mature public exploit, and has a low, flat EPSS score, so urgency is lower than actively exploited flaws; however, local privilege escalation bugs are commonly chained with phishing, browser, VPN, or remote-code-execution intrusions and should still be included in normal Windows patch SLAs.

How an attack unfolds

An attacker must first obtain local authenticated access to an affected Windows system, such as through stolen user credentials, malware execution, an exposed interactive session, or another initial-access vulnerability. From that foothold, the attacker targets the Function Discovery Service behavior exposed through fdwsd.dll and repeatedly triggers operations that contend for the vulnerable shared resource. Because the vulnerability is a race condition and the attack complexity is high, the attacker may need to run many attempts, manipulate timing, or create service load to reach the vulnerable execution window. If the race is won, privileged service logic may be made to operate on attacker-influenced state, resulting in elevation from a standard user context to a higher-privileged local context. After elevation, the attacker would typically establish persistence, dump credentials, disable defenses, access sensitive files, or move laterally using the newly obtained privileges.

How to fix it

Apply the Microsoft security update that fixes CVE-2026-32086 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025. Where exact KB or build numbers are managed centrally, ensure systems are updated to the April 2026 security update level or later for the relevant Windows release. Prioritize servers, privileged access workstations, shared workstations, jump hosts, VDI/gold images, and endpoints used by administrators. If immediate patching is not possible, reduce exposure by limiting local interactive access, enforcing least privilege, restricting untrusted code execution with application control, monitoring or limiting use of Function Discovery-related services where operationally feasible, and ensuring endpoint protection is enabled. Avoid relying on service disablement as a primary mitigation unless validated against business requirements, because Function Discovery services may support device discovery and network resource publication functionality.

How to confirm the fix worked

Confirm remediation by verifying that affected systems have installed the applicable Microsoft cumulative security update released on or after the vendor fix date. Validate Windows build and patch compliance through enterprise patch management, vulnerability scanning, or local commands such as winver, systeminfo, Get-ComputerInfo, and Get-HotFix. Confirm that C:\Windows\System32\fdwsd.dll has a file version and timestamp consistent with a patched Windows build for that operating system release. Re-run authenticated vulnerability scans after patch deployment and ensure scanners no longer report this vulnerability. For gold images, templates, and offline server images, mount or boot the image and verify the same patch level before redeployment. Where mitigation was used instead of patching, test that business functionality remains intact and that local unprivileged users cannot abuse the relevant Function Discovery service behavior.

Typical attack path

1. Gain local authenticated access to an affected Windows workstation or server.
2. Confirm the system is running a vulnerable Windows version and has the Function Discovery components present.
3. Run a local exploit or tooling that repeatedly triggers the vulnerable Function Discovery Service code path in fdwsd.dll.
4. Manipulate timing or create contention to win the race condition against the shared resource.
5. Obtain elevated local privileges if the race is successfully exploited.
6. Use the elevated context to run administrative commands, harvest credentials, modify security settings, establish persistence, or pivot to other systems.

How to detect it

There are no known public exploit-specific indicators and no reliable network indicators because exploitation is local. Detection should focus on evidence of local privilege escalation behavior and abnormal Function Discovery service activity. Review Windows Security logs for process creation events, privilege assignment, new administrative logons, new services, scheduled tasks, and account changes around the time a low-privileged user session becomes elevated. Useful Windows events include 4688 for process creation, 4672 for special privileges assigned to a new logon, 4624 for new logons, 4697 and System 7045 for service installation, 4698 for scheduled task creation, 4732/4738 for local group or account changes, and 1102 for audit log clearing. Review System logs for Function Discovery-related service crashes or restarts, especially Service Control Manager events 7031, 7034, and 7036 involving fdPHost or FDResPub. If Sysmon is deployed, examine Event ID 1 process creation, Event ID 7 image load involving fdwsd.dll, Event ID 10 process access, Event ID 11 file creation, and Event ID 13 registry modifications. Look for unusual command shells, PowerShell, rundll32, regsvr32, wmic, schtasks, sc.exe, or net.exe execution shortly after Function Discovery service activity. Because race-condition exploitation may require repeated attempts, also hunt for high-frequency service starts, stops, crashes, or repeated execution of unknown binaries by the same local user. Correlate these signals with patch state: unpatched systems with unexplained privilege changes or service anomalies deserve deeper forensic review.

• C:\Windows\System32\fdwsd.dll
• fdwsd.dll
• fdPHost
• FDResPub
• Function Discovery Provider Host
• Function Discovery Resource Publication
• Service Control Manager event 7031
• Service Control Manager event 7034
• Service Control Manager event 7036
• Windows Security Event ID 4672
• Windows Security Event ID 4688
• Windows Security Event ID 4697
• Windows Security Event ID 4698
• Windows System Event ID 7045
• sc.exe start fdPHost
• sc.exe stop fdPHost
• sc.exe start FDResPub
• sc.exe stop FDResPub
• powershell.exe
• cmd.exe
• schtasks.exe
• net.exe localgroup administrators
• wevtutil.exe cl Security

What your security team should do

• Patch affected Windows clients and servers during the next standard security update cycle, with expedited handling for high-value systems and administrator workstations.
• Use authenticated vulnerability scanning or endpoint management telemetry to identify Windows systems that remain below the April 2026 security update level or applicable fixed build.
• Prioritize remediation on systems where local compromise would have outsized impact, such as domain administration workstations, management servers, file servers, application servers, and remote access hosts.
• Harden local privilege boundaries by removing unnecessary local administrator rights, enforcing User Account Control, and limiting who can sign in interactively or via Remote Desktop.
• Enable or tune endpoint telemetry for process creation, service control activity, privilege assignment events, and suspicious child processes spawned from service-hosting processes.
• Hunt for signs of local privilege escalation attempts, especially repeated service failures, unusual process launches near Function Discovery service activity, or low-privileged users rapidly gaining administrative capabilities.
• Maintain strong controls against initial access, because this vulnerability requires an attacker to already have local authenticated access.
• Track vendor advisories for any later exploit availability or change in exploitation status, despite the currently low EPSS score and absence from CISA KEV.