CVE-2026-50462

What it actually does

This vulnerability is a local privilege escalation flaw in the Windows Ancillary Function Driver for WinSock, commonly associated with afd.sys. The issue involves external control of a file name or path, allowing a locally authenticated low-privileged attacker to manipulate driver-handled path or object resolution in a way that can result in elevated privileges. Successful exploitation can allow code running as a standard user to gain high-integrity or SYSTEM-level privileges, leading to full compromise of confidentiality, integrity, and availability on the affected Windows host. The vulnerability requires local access or prior code execution, has low attack complexity, requires no user interaction, and affects multiple supported Windows client and server releases.

Why it matters to the business

An attacker who already has a foothold on an affected Windows workstation or server could use this flaw to take full control of the system, disable security tools, access sensitive data, install persistence, or move laterally. Because the affected product set spans widely deployed Windows desktop and server versions, exposure may be broad across enterprise environments. Although there is no current KEV listing, no known ransomware association, and no reported mature public exploit in the provided data, the high impact and low-complexity local exploitation profile make timely patching important, especially on internet-facing servers, shared workstations, VDI hosts, jump servers, domain administration systems, and servers where untrusted users or services can execute code.

How an attack unfolds

An attacker first needs local authenticated access to an affected Windows system, typically obtained through phishing, stolen credentials, exploitation of another vulnerability, abuse of a low-privileged service account, or execution of malware under a standard user context. The attacker then runs a crafted local exploit that interacts with the Windows Ancillary Function Driver for WinSock. By supplying attacker-controlled file name or path data to vulnerable driver functionality, the exploit attempts to influence privileged file or object handling performed by the kernel-mode component. If successful, the attacker causes privileged operations to occur under attacker-controlled conditions and escalates from a low-privileged account to a highly privileged context such as SYSTEM. Once elevated, the attacker can dump credentials, install persistence, tamper with endpoint defenses, access protected files, create privileged accounts, deploy additional payloads, and use the host as a staging point for lateral movement.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions, including Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 24H2, 25H2, and 26H1; Windows Server 2012, 2016, 2019, 2022, and 2025. No exact fixed build numbers were provided in the input, so use Microsoft Update, Windows Server Update Services, Microsoft Configuration Manager, Intune, or the Microsoft Update Catalog to deploy the cumulative update that contains the fix for this vulnerability. Prioritize systems where local code execution by non-administrators is possible, including multi-user servers, RDS/terminal servers, VDI pools, developer workstations, jump hosts, and systems exposed to untrusted workloads. If immediate patching is not possible, reduce risk by enforcing least privilege, removing unnecessary local logon rights, restricting interactive access to servers, applying application control rules, monitoring for suspicious local exploit behavior, and ensuring endpoint detection and response controls are active. Because this is a kernel-mode local privilege escalation issue, configuration-only mitigations should be treated as temporary risk reduction rather than a substitute for patching.

How to confirm the fix worked

Confirm that affected Windows systems have received the Microsoft cumulative security update that remediates this vulnerability. Validate through centralized patch management reporting, Windows Update history, installed hotfix inventory, or Microsoft Defender Vulnerability Management where available. On representative systems, verify the operating system build and installed update level against Microsoft’s official security update guidance for this vulnerability. Confirm that afd.sys has been updated to the patched version distributed with the relevant Windows cumulative update. Perform exposure checks across all supported Windows client and server versions listed as affected, including legacy server platforms that may require special servicing workflows. Where operationally feasible, test that standard users cannot execute unapproved binaries from writable directories and cannot obtain administrative tokens through local privilege escalation validation tooling in a controlled lab environment. Do not validate by running untrusted public exploit code on production systems.

Typical attack path

1. Gain initial low-privileged access to an affected Windows workstation or server.
2. Transfer or generate a local privilege escalation exploit on the host.
3. Execute the exploit from the low-privileged user context without requiring user interaction.
4. Interact with vulnerable Windows Ancillary Function Driver for WinSock functionality using crafted file name or path inputs.
5. Trigger privileged driver behavior that results in elevation to an administrative or SYSTEM-level context.
6. Use elevated privileges to disable defenses, access sensitive data, dump credentials, install persistence, or move laterally.

How to detect it

Detection should focus on evidence of local privilege escalation and post-exploitation rather than a single reliable exploit signature, because no mature public exploit or known exploitation campaign was provided. Collect and review Windows Security logs, Sysmon logs, Microsoft Defender for Endpoint alerts, EDR telemetry, PowerShell logs, service control manager events, process creation events, driver access telemetry where available, and file system activity involving Windows driver paths. Look for low-privileged users spawning high-integrity or SYSTEM processes unexpectedly, unusual child processes of command interpreters, suspicious service creation, scheduled task creation, security product tampering, credential dumping attempts, and unexpected access patterns involving the Ancillary Function Driver. Useful Windows events include process creation events, logon events, privilege assignment events, service installation events, scheduled task events, Defender tamper or malware detections, and security log clearing. Correlate activity around the time a low-privileged account first obtained administrative privileges or spawned SYSTEM-level processes. On servers, pay particular attention to web service, application pool, database service, build agent, or automation accounts that unexpectedly create local administrator users, start command shells, modify services, or run credential access tools. For forensic review, compare timestamps and versions of afd.sys, inspect prefetch and shimcache/amcache artifacts for suspicious recently executed binaries, review temporary and user-writable directories for dropped exploit tools, and examine EDR process ancestry for local binaries that quickly transition from a standard user context to SYSTEM followed by discovery, defense evasion, or credential access behavior.

• C:\Windows\System32\drivers\afd.sys
• \Device\Afd
• \Device\Afd\Endpoint
• sc.exe create
• New-Service
• schtasks /create
• whoami /priv
• whoami /groups
• net localgroup administrators
• net user /add
• Event ID 7045
• Event ID 4697
• Event ID 4672
• Event ID 4688
• Event ID 1102
• Event ID 7036
• vssadmin delete shadows
• wevtutil cl Security
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• cmd.exe /c whoami
• powershell.exe -ExecutionPolicy Bypass
• rundll32.exe
• regsvr32.exe
• certutil.exe -urlcache
• bitsadmin /transfer
• procdump.exe -ma lsass.exe
• comsvcs.dll, MiniDump

What your security team should do

• Prioritize patch deployment to Windows servers and workstations that allow local or interactive access by non-administrative users, including RDS, VDI, jump hosts, developer machines, and shared systems.
• Include this vulnerability in near-term Windows cumulative update compliance dashboards because it has high confidentiality, integrity, and availability impact despite requiring local access.
• Audit local administrator group membership and remove unnecessary privileged access to reduce the impact of attempted exploitation.
• Strengthen controls that limit local code execution, including application control, attack surface reduction rules, script restrictions, and least-privilege enforcement.
• Monitor for suspicious privilege escalation behavior such as unexpected SYSTEM shells, unusual service creation, security tool tampering, credential dumping, and abnormal access to afd.sys or AFD device objects.
• Hunt for signs of prior compromise on high-value systems where low-privileged users or services had code execution before patching.
• Treat any detection of post-exploitation activity after local privilege escalation as a potential full host compromise and perform credential rotation and lateral movement investigation.
• Track Microsoft advisories for updated exploitability assessment, fixed build details, or any change in known exploitation status.