CVE-2026-33099

What it actually does

CVE-2026-33099 is a local privilege escalation vulnerability caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. An attacker who already has low-privileged local code execution can manipulate WinSock/AFD kernel interactions to trigger memory corruption after an object has been freed. If successfully exploited, the attacker can execute code in kernel context or otherwise gain elevated privileges, typically resulting in SYSTEM-level control. The CVSS vector indicates local access, low privileges required, no user interaction, high confidentiality, integrity, and availability impact, and high attack complexity.

Why it matters to the business

Successful exploitation can turn an initial foothold on a Windows workstation or server into full administrative control of that system. This increases the risk of credential theft, security tool tampering, lateral movement, data access, ransomware deployment, and persistence. The vulnerability affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2022, so exposure may be broad in organizations with mixed Windows fleets. It is not currently listed in CISA KEV, has no known ransomware association, and has a low EPSS score with a flat 30-day trend, but privilege escalation vulnerabilities are commonly chained with phishing, malware, remote code execution, or stolen credentials once exploit code becomes available.

How an attack unfolds

An attacker must first obtain the ability to run code locally on an affected Windows system, such as through malware execution, abuse of a low-privileged account, exploitation of a separate remote vulnerability, or interactive access. The attacker then runs a specially crafted program that interacts with WinSock/AFD kernel interfaces in a way that triggers the use-after-free condition in the Ancillary Function Driver. By shaping kernel memory and exploiting the freed object reuse, the attacker attempts to gain control over execution flow or corrupt security-relevant kernel structures. If successful, the attacker elevates from a low-privileged context to SYSTEM or equivalent local administrative privileges. From there, the attacker may dump credentials, disable endpoint defenses, install persistence, access sensitive files, or move laterally. No public exploit maturity or named threat actor activity is currently indicated in the provided data.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-33099 for all affected Windows versions, including Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2; Windows Server 2012, 2016, 2019, 2022, and Windows Server 2022 23H2. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Endpoint Configuration Manager, Intune, or the Microsoft Update Catalog to identify and deploy the applicable cumulative update for each OS release. Prioritize internet-facing servers, administrator workstations, domain-joined systems, remote access hosts, jump servers, and systems where untrusted users can run code. Where immediate patching is not possible, reduce risk by enforcing least privilege, limiting interactive logon rights, restricting software execution with App Control or similar allowlisting, hardening EDR tamper protection, and monitoring for suspicious local privilege escalation behavior. Because this is a kernel driver vulnerability, practical mitigation without patching is limited; disabling WinSock/AFD functionality is generally not operationally viable on Windows systems.

How to confirm the fix worked

Confirm that each affected Windows system has installed the Microsoft cumulative/security update that supersedes the vulnerable afd.sys version for its OS release. Validate through Windows Update history, installed hotfix inventory, endpoint management compliance reports, or file version checks of %SystemRoot%\System32\drivers\afd.sys against Microsoft’s fixed version for the relevant build. Reboot systems where required, because kernel driver updates may not be fully active until restart. Confirm that vulnerability scanners no longer report CVE-2026-33099 on the host. For representative systems, verify OS build and patch level using supported Microsoft tooling such as winver, systeminfo, Get-HotFix, Windows Update compliance reporting, or enterprise patch management inventory. Also validate that low-privileged users cannot write to privileged execution paths or run unapproved binaries, since those controls reduce exploitation opportunities even after patching.

Typical attack path

1. Gain initial low-privileged access to an affected Windows workstation or server.
2. Transfer or stage a local exploit binary or script designed to exercise vulnerable AFD/WinSock behavior.
3. Execute the exploit from the low-privileged user context.
4. Trigger the use-after-free condition in the Windows Ancillary Function Driver for WinSock.
5. Achieve kernel-level code execution or corrupt kernel structures to obtain elevated privileges.
6. Spawn a SYSTEM-level shell, service, scheduled task, or injected process.
7. Use elevated access to dump credentials, disable defenses, persist, access protected data, or move laterally.

How to detect it

There are no unique public exploit indicators provided for this vulnerability, so detection should focus on behavioral evidence of local privilege escalation and post-exploitation activity. Review endpoint telemetry, EDR alerts, Windows Security logs, Sysmon logs, PowerShell logs, service control manager events, scheduled task logs, and process creation data around the time of suspected compromise. Look for low-privileged user processes that unexpectedly spawn SYSTEM-level command interpreters, PowerShell, rundll32, regsvr32, mshta, wscript, cscript, or custom binaries. Investigate new or modified services, scheduled tasks, drivers, local administrators group membership changes, credential dumping attempts, LSASS access, security product tampering, and log clearing. Kernel exploitation may crash systems during failed attempts, so also review System event logs, bugcheck events, Windows Error Reporting artifacts, and memory dump creation around suspicious activity. Because this issue involves the Windows Ancillary Function Driver for WinSock, suspicious custom binaries making unusual high-volume or malformed socket/AFD interactions followed by privilege changes should be treated as high priority. Correlate any suspected activity with patch status: exploitation is more plausible on systems missing the relevant Microsoft security update.

What your security team should do

• Prioritize patch deployment across affected Windows client and server versions, especially systems that handle privileged administration, remote access, sensitive data, or multi-user workloads.
• Inventory all Windows 10, Windows 11, and Windows Server systems listed as affected and map them to the applicable Microsoft cumulative update baseline.
• Treat this as a post-compromise privilege escalation risk: combine patching with controls that reduce initial code execution, such as application control, phishing-resistant authentication, endpoint protection, and least privilege.
• Monitor for suspicious low-privileged processes spawning SYSTEM-level shells, services, scheduled tasks, or security tooling modifications.
• Hunt for signs of recent local privilege escalation attempts on high-value systems, even though no public exploit maturity, KEV listing, ransomware usage, or named threat actor activity is currently indicated.
• Ensure endpoint detection and response tools have tamper protection enabled and alert on attempts to disable logging, antivirus, EDR services, or credential protection features.
• Track Microsoft advisories for the exact fixed build numbers and any future exploitability assessment changes, especially if public proof-of-concept code appears.