CVE-2026-45603

What it actually does

This vulnerability is a local privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, commonly exposed through the kernel driver afd.sys. The issue is caused by a use-after-free race condition: under specific timing conditions, a low-privileged local attacker can cause kernel memory associated with socket operations to be freed and then reused in an unsafe way. Successful exploitation can allow attacker-controlled code or data to influence kernel execution, resulting in SYSTEM-level privileges. Because the CVSS vector requires local access and low privileges, this is not an initial remote entry vulnerability, but it can be highly valuable after phishing, malware execution, stolen credentials, or exploitation of another service has already provided a foothold.

Why it matters to the business

An attacker who already has limited access to a Windows workstation or server could use this flaw to gain full control of the system. That can enable credential theft, disabling of security tools, lateral movement, tampering with business applications, data theft, ransomware staging, and persistence. The exploit currently has no known public maturity, is not listed in CISA KEV, and has a low EPSS score, which lowers immediate widespread exploitation likelihood; however, Windows kernel privilege escalation flaws are routinely weaponized after initial access, so unpatched internet-facing, shared, VDI, developer, and server systems still represent meaningful operational risk.

How an attack unfolds

An attacker first obtains local code execution as a standard user, such as through phishing, malware, abuse of a valid account, exploitation of an application, or interactive access to a shared system. They then run a purpose-built exploit that repeatedly performs WinSock or AFD-related operations to trigger a race condition in the Windows Ancillary Function Driver. By carefully controlling timing and memory reuse, the exploit attempts to access or manipulate an object after it has been freed. If successful, the attacker escapes the restrictions of the low-privileged account and executes code with kernel or SYSTEM privileges. With elevated privileges, the attacker can dump credentials, create or modify administrator accounts, disable endpoint protection, install services or drivers, move laterally, or deploy additional payloads. The high attack complexity means exploitation may require system-specific reliability work and repeated attempts, but successful exploitation has severe confidentiality, integrity, and availability impact.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45603 for all affected Windows client and server versions, including Windows 10, Windows 11, Windows Server 2012, 2016, 2019, 2022, and 2025. Because no fixed version list was provided, use the relevant Microsoft Security Update Guide entry and Windows Update, WSUS, Microsoft Configuration Manager, Intune, or equivalent patch management tooling to deploy the applicable cumulative update for each OS build. Prioritize systems where local compromise is more likely or more damaging, including domain controllers, jump servers, VDI hosts, multi-user servers, developer workstations, help desk systems, and servers running exposed applications. If immediate patching is not possible, reduce risk by enforcing least privilege, removing unnecessary local administrator rights, restricting interactive logon, hardening application control, enabling endpoint protection tamper protection, monitoring for suspicious privilege escalation behavior, and isolating high-value systems. There is no safe configuration-only workaround that should be considered equivalent to patching a Windows kernel driver vulnerability.

How to confirm the fix worked

Confirm remediation by verifying that each affected Windows asset has installed the Microsoft cumulative security update that supersedes the vulnerable afd.sys version for its OS build. Use enterprise patch inventory, Windows Update compliance reporting, WSUS, Configuration Manager, Intune, or vulnerability scanning to confirm the update state. On individual systems, review installed hotfixes and cumulative updates with tools such as Settings > Windows Update > Update history, Control Panel installed updates, DISM, PowerShell Get-HotFix, or Microsoft Defender Vulnerability Management where available. Validate that the file version and signing date of %SystemRoot%\System32\drivers\afd.sys match the patched Microsoft release for that platform. Exposure remains if a host is one of the affected Windows versions and has not received the relevant June 2026 or later cumulative security update containing the fix.

Typical attack path

1. Gain local access to a vulnerable Windows workstation or server using malware, stolen credentials, phishing, or exploitation of another vulnerability.
2. Confirm the host is running an affected Windows version and lacks the relevant security update.
3. Execute a local exploit that abuses WinSock/AFD socket operations to trigger the use-after-free race condition.
4. Manipulate kernel memory reuse so the freed object is accessed in an attacker-controlled way.
5. Escalate from a low-privileged user context to SYSTEM or equivalent local administrative privileges.
6. Use elevated privileges to disable defenses, harvest credentials, establish persistence, move laterally, or stage additional payloads.

How to detect it

Look for evidence of local privilege escalation after initial access rather than remote exploitation. Useful sources include Windows Security logs, Sysmon, Microsoft Defender for Endpoint, EDR telemetry, PowerShell logs, service control manager events, driver load telemetry, process creation logs, and endpoint protection tamper alerts. Focus on sequences where a low-privileged user runs an unusual executable followed shortly by activity as NT AUTHORITY\SYSTEM, new local administrator membership, service creation, scheduled task creation, credential dumping, or security control modification. Kernel use-after-free exploitation may not produce a clean application log entry, so detection should be behavior-based. Review process ancestry for suspicious binaries launched from user-writable paths such as Downloads, Temp, AppData, or Public directories, followed by SYSTEM-level shells, service installation, or LSASS access. Search for anomalous or repeated socket-heavy local processes immediately before privilege changes where EDR telemetry supports it. Also look for attempts to load unsigned or unusual drivers, crashes or bugchecks around afd.sys, and endpoint alerts referencing privilege escalation or kernel exploit behavior. No public exploit-specific indicators were provided, so detections should rely on suspicious post-exploitation artifacts and Windows privilege escalation patterns.

• %SystemRoot%\System32\drivers\afd.sys
• NT AUTHORITY\SYSTEM
• C:\Windows\System32\drivers\afd.sys
• C:\Users\*\AppData\Local\Temp\*.exe
• C:\Users\*\Downloads\*.exe
• C:\Users\Public\*.exe
• Event ID 7045
• A service was installed in the system
• Event ID 4697
• A service was installed in the system
• Event ID 4672
• Special privileges assigned to new logon
• Event ID 4732
• A member was added to a security-enabled local group
• Event ID 4688
• New Process Created
• Event ID 1
• Process Create
• Event ID 10
• ProcessAccess
• lsass.exe
• net localgroup administrators
• sc.exe create
• schtasks.exe /create
• powershell.exe -ExecutionPolicy Bypass
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} recoveryenabled no
• wevtutil.exe cl
• Set-MpPreference -DisableRealtimeMonitoring
• afd.sys

What your security team should do

• Patch affected Windows clients and servers through standard monthly cumulative update channels, prioritizing high-value servers, shared systems, VDI, developer workstations, and systems used by privileged administrators.
• Use vulnerability management or patch compliance tooling to identify affected Windows 10, Windows 11, and Windows Server assets that have not installed the applicable Microsoft security update.
• Treat exploitation as post-compromise activity: investigate any endpoint where a low-privileged account unexpectedly gains SYSTEM or local administrator capabilities.
• Harden least privilege by removing unnecessary local admin rights, limiting interactive logon to servers, and applying application control to prevent untrusted local executables from running.
• Monitor for suspicious creation of services, scheduled tasks, new local administrators, credential dumping tools, security tool tampering, and abnormal child processes spawned under SYSTEM context.
• Ensure endpoint detection and response sensors are healthy and tamper protection is enabled before and after patch rollout.
• For systems that cannot be patched quickly, isolate them, restrict user access, increase monitoring, and prioritize compensating controls until updates can be applied.
• Because the vulnerability is not currently in CISA KEV, has no known exploit maturity, and has low EPSS, handle as important rather than emergency internet-wide exploitation, but do not defer indefinitely because Windows privilege escalation flaws are commonly chained with initial access techniques.