CVE-2026-32150

What it actually does

This is a local privilege escalation vulnerability caused by improper synchronization of shared resources in the Windows Function Discovery Service component, specifically involving fdwsd.dll. A low-privileged, authenticated local attacker who can run code on an affected Windows system may be able to win a race condition and cause the service to perform privileged operations in an unsafe state. Successful exploitation can result in execution with elevated privileges, potentially up to SYSTEM-level access, allowing the attacker to read, modify, or disrupt protected operating system resources.

Why it matters to the business

An attacker who already has basic access to a Windows workstation or server could use this flaw to gain administrative control of that system. This can turn an initial foothold, such as a compromised user account or malware running with limited rights, into full host compromise. Impacted systems include multiple supported Windows desktop and server versions, so broad enterprise exposure is possible where patching is incomplete. The issue is not currently listed in CISA KEV, has no known public exploit maturity, and has a low EPSS score with a flat 30-day trend, which lowers immediate exploitation likelihood, but local privilege escalation bugs are frequently chained with phishing, credential theft, remote code execution, and ransomware intrusions.

How an attack unfolds

An attacker first obtains the ability to execute code locally as a non-administrative user on an affected Windows system. They then interact with functionality exposed by the Windows Function Discovery Service in a way that triggers concurrent access to a shared resource inside fdwsd.dll. By repeatedly invoking the vulnerable operation and carefully timing competing requests, the attacker attempts to win the race condition and force the service into an inconsistent state. If successful, the attacker causes privileged service context to be misused, enabling elevation from a low-privileged account to a highly privileged local context. After elevation, the attacker can disable defenses, dump credentials, install persistence, move laterally, or stage additional payloads.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-32150 for all affected Windows versions, including Windows 10, Windows 11, Windows Server 2012, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025. Because no fixed version list was provided, use the applicable Microsoft cumulative update or security-only update for the affected operating system release from the relevant patch cycle. Prioritize internet-facing servers, shared administrative workstations, remote access hosts, jump servers, domain-joined servers, and systems where untrusted users can log on locally or through Remote Desktop. If immediate patching is not possible, reduce risk by limiting local interactive access, restricting RDP and remote shell access, enforcing least privilege, monitoring for suspicious privilege escalation behavior, and ensuring endpoint protection blocks unauthorized exploit tooling. Do not rely on disabling Function Discovery services as a primary mitigation unless validated against operational requirements, because service changes may affect device discovery, network discovery, and dependent Windows functionality.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft update that remediates this vulnerability for its OS build. Validate through enterprise patch management, Windows Update history, Microsoft Update Catalog KB mapping, or commands such as `winver`, `systeminfo`, PowerShell `Get-HotFix`, and endpoint management inventory. Verify that fdwsd.dll has been updated to the version delivered by the relevant security update for the platform. Confirm that no unsupported or out-of-servicing Windows releases remain in production. For exposure validation, identify systems running affected Windows versions where local non-administrative users, RDP users, service accounts, or application users can execute code. For mitigation validation, test that standard users cannot gain administrative rights, create privileged services, write to protected directories, or spawn elevated shells through Function Discovery-related activity.

Typical attack path

1. Gain local code execution on an affected Windows workstation or server using stolen credentials, malware, phishing, or another vulnerability.
2. Confirm the host is running a vulnerable Windows version and that Function Discovery-related services/components are present.
3. Run a local exploit that repeatedly triggers the vulnerable Function Discovery Service code path in fdwsd.dll.
4. Use high-frequency or concurrent operations to win the race condition and cause privileged behavior to occur in an unsafe state.
5. Obtain elevated local privileges, potentially SYSTEM-level execution.
6. Use the elevated context to access protected files, extract credentials, disable security tooling, create persistence, or support lateral movement.

How to detect it

There are no reliable public exploit-specific indicators for this vulnerability based on the provided intelligence, and exploitation of race-condition privilege escalation flaws often leaves few unique artifacts. Detection should focus on behavior before and after suspicious local privilege escalation. Collect and review Windows Security logs, Sysmon or EDR telemetry, service control events, PowerShell logs, process creation logs, Windows Defender events, and system logs around Function Discovery-related service activity. Look for low-privileged user processes repeatedly interacting with Function Discovery components, unusual bursts of svchost.exe activity hosting Function Discovery services, and immediate follow-on actions such as spawning cmd.exe, powershell.exe, or other tools as SYSTEM. Key Windows events to review include process creation, logon events, special privileges assigned, new service creation, scheduled task creation, local group membership changes, security log clearing, Defender tampering, and LSASS access. Pay special attention to sequences where an ordinary user context is followed within minutes by SYSTEM-level process execution, creation of a new administrator account, credential dumping attempts, or endpoint protection disablement. Since this flaw is not currently KEV-listed and has no known exploit maturity, absence of known IOCs does not prove absence of exploitation; prioritize behavioral correlation and endpoint forensic timelines.

What your security team should do

• Patch affected Windows desktop and server systems using the applicable Microsoft cumulative or security update, prioritizing servers, administrator workstations, shared systems, and hosts allowing RDP or local multi-user access.
• Inventory Windows 10, Windows 11, and Windows Server versions listed as affected and track remediation to completion in vulnerability management systems.
• Treat this as a post-compromise privilege escalation risk: focus monitoring on systems where low-privileged code execution is plausible, including endpoints with frequent user interaction and remote access servers.
• Hunt for suspicious elevation patterns, including low-privileged user processes spawning SYSTEM-level shells, unexpected service creation, or security control tampering after Function Discovery-related service activity.
• Review local administrator group membership, service account privileges, and RDP access rights to reduce the number of users who could benefit from local privilege escalation.
• Ensure endpoint detection and response tools alert on token theft, credential dumping, LSASS access, new privileged services, scheduled tasks, and defense evasion following local privilege changes.
• Because EPSS is currently low, not KEV-listed, and no public exploit maturity is reported, handle through normal high-priority patching rather than emergency out-of-band response unless exploit activity emerges.
• Reassess urgency if Microsoft, CISA, EDR vendors, or threat intelligence sources report public exploit code, KEV inclusion, ransomware use, or active exploitation.