CVE-2026-32093

What it actually does

This is a local privilege escalation vulnerability in the Windows Function Discovery Service component, specifically involving fdwsd.dll. The flaw is a race condition caused by improper synchronization of a shared resource during concurrent execution. An attacker who already has low-privileged local access can attempt to win the race and cause the service or related privileged operation to act on attacker-influenced state. Successful exploitation can allow elevation to a higher-privileged security context, potentially including SYSTEM-level control, with high impact to confidentiality, integrity, and availability. The CVSS vector indicates local access is required, user interaction is not required, and exploitation complexity is high.

Why it matters to the business

If exploited, this vulnerability can turn a compromised standard user account or foothold into full administrative control of a Windows workstation or server. That can enable credential theft, security tool tampering, lateral movement, data access, persistence, and ransomware staging. The issue affects many supported Windows desktop and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025, so organizations with broad Windows estates should treat it as an important post-compromise escalation risk. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported public exploit maturity in the provided data, which lowers immediate internet-scale urgency but does not reduce the need to patch during the normal Windows security update cycle.

How an attack unfolds

An attacker must first obtain the ability to run code locally on an affected Windows system, such as through stolen credentials, malware execution, malicious insider activity, or exploitation of a separate vulnerability. From that low-privileged context, the attacker targets the Function Discovery Service behavior implemented through fdwsd.dll. The exploit repeatedly triggers a timing-sensitive concurrent operation and attempts to manipulate the shared resource at the exact moment the service performs a privileged action. If the attacker wins the race, the privileged component may use attacker-controlled or attacker-influenced state, allowing the attacker to elevate privileges. After elevation, the attacker can execute commands with elevated rights, dump credentials, disable defenses, install persistence, access sensitive files, or pivot to other systems. Because exploitation complexity is high, reliable exploitation may require repeated attempts and system-specific timing, and failures may leave traces such as unusual process creation, service interaction, crashes, or repeated access to Function Discovery components.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32093 for all affected Windows versions. Because no exact fixed build numbers were provided, use the relevant Microsoft cumulative security update released on or after the vendor fix date for each affected platform, including Windows 10 1607/1809/21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2012/2016/2019/2022/2022 23H2, and Windows Server 2025. Prioritize servers, administrator workstations, shared jump hosts, VDI images, and endpoints where lower-privileged users can log on interactively. For systems that cannot be patched immediately, reduce local attack opportunities by limiting interactive logon and RDP access, removing unnecessary local admin rights, enforcing application control, monitoring suspicious local privilege escalation behavior, and ensuring endpoint protection is active. Disabling or restricting Function Discovery-related services should only be considered as a temporary mitigation after testing, because it may affect network discovery, device discovery, and dependent Windows functionality.

How to confirm the fix worked

Confirm that each affected Windows system has installed the applicable cumulative security update released on or after the Microsoft fix for this vulnerability. Validate through centralized patch management, Windows Update compliance reporting, vulnerability scanner authenticated checks, or host-based inventory of Windows build and patch level. On representative systems, verify that the vulnerable fdwsd.dll version has been replaced by the patched Microsoft-signed version. Confirm that Windows servers and endpoints no longer appear as vulnerable in authenticated vulnerability scans. For compensating controls, validate that non-administrative users cannot log on interactively to high-value servers unless required, that application control or EDR policy is active, and that privileged group membership has not expanded unexpectedly.

Typical attack path

1. Gain initial local code execution on an affected Windows host using credentials, malware, phishing, remote access, or another vulnerability.
2. Run a low-privileged process capable of interacting with Windows Function Discovery functionality or the affected service behavior.
3. Trigger concurrent Function Discovery operations repeatedly to create the race condition window in fdwsd.dll.
4. Manipulate the shared resource during the vulnerable timing window so the privileged operation acts on attacker-influenced data or state.
5. Obtain an elevated token, privileged process execution, or equivalent administrative control if the race is won.
6. Use elevated privileges to dump credentials, disable security controls, create persistence, access protected data, or move laterally.

How to detect it

There are no provided public exploit indicators, known threat actors, ransomware associations, or mature exploit artifacts for this vulnerability, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation. Review Windows Security logs for suspicious low-privileged logons followed by privileged activity, especially Event ID 4688 process creation, 4672 special privileges assigned, 4624 logons, 4648 explicit credential use, and 4732/4738 privileged group changes. Review System logs for Event ID 7045 service installation and service control activity. If Sysmon is deployed, review Event ID 1 process creation, 7 image loaded, 10 process access, 11 file creation, and 13 registry value set events around suspicious privilege transitions. Look for repeated or anomalous interaction with Function Discovery components, crashes or hangs involving fdwsd.dll, unexpected SYSTEM-level command shells, unusual service creation, credential dumping tools, or security tool tampering shortly after a standard-user process runs. Correlate EDR alerts for token theft, privilege escalation, suspicious service execution, LSASS access, and defense evasion. Because this is a high-complexity race condition, failed exploitation attempts may manifest as repeated service activity, application errors, or Windows Error Reporting events tied to Function Discovery components before a successful privilege escalation.

What your security team should do

• Patch affected Windows systems through the normal or accelerated monthly security update process, prioritizing servers, administrator workstations, jump hosts, and multi-user systems.
• Run an authenticated vulnerability scan or patch compliance query to identify Windows hosts still missing the relevant cumulative update.
• Review systems where low-privileged users have interactive access, because this vulnerability requires local execution but can convert that access into administrative control.
• Monitor for suspicious local privilege escalation behavior, including unusual child processes spawned from service contexts, unexpected SYSTEM shells, abnormal service creation, and credential dumping following low-privileged logon.
• Harden post-compromise controls: remove unnecessary local admin rights, enforce least privilege, enable attack surface reduction rules where applicable, and restrict RDP/local logon to approved users.
• Ensure EDR/Sysmon or equivalent telemetry captures process creation, service creation, privilege assignment, module load, and crash events on high-value Windows systems.
• Do not treat the low EPSS and lack of KEV listing as a reason to ignore the issue; local privilege escalation vulnerabilities are commonly chained after initial access.