Loading story…
Microsoft's Security Update Guide lists CVE-2026-26168, an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for Winsock (AFD). Public reporting indicates the issue was not a newly disclosed flaw at the time of later attention, but rather one that had been historically omitted from Microsoft's April 2026 release materials and subsequently appeared in the advisory portal.
The vulnerability was reported in part by Frederica of Tencent Xuanwu Lab using the Atuin Automated Vulnerability Discovery System, according to attribution in Microsoft's advisory, with Microsoft also noting that other researchers reported the flaw. External coverage stressed that the attribution reflects participation in discovery or reporting of CVE-2026-26168, not exclusive credit for finding the bug.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft's Security Update Guide lists CVE-2026-26168, an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for Winsock. The advisory credits Frederica of Tencent Xuanwu Lab using the Atuin Automated Vulnerability Discovery System, while also noting additional reporters.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed **CVE-2026-25179**, an **elevation of privilege** vulnerability in the **Windows Ancillary Function Driver for WinSock** (`afd.sys`), the kernel component that supports Windows socket operations. The issue was published through Microsoft's Security Update Guide and affects a privileged part of the Windows networking stack, meaning successful exploitation could allow an attacker to gain higher permissions on a targeted system. The newly listed flaw aligns with Microsoft's earlier disclosure of **CVE-2023-35632**, which affected the same **Windows Ancillary Function Driver for WinSock** component and was also classified as an elevation of privilege bug. The repeated appearance of privilege-escalation vulnerabilities in `afd.sys` highlights continued security risk around this Windows driver and reinforces the need for organizations to prioritize Microsoft security updates for systems exposed to local compromise or post-exploitation activity.
Jul 12, 2026
Microsoft disclosed and fixed multiple elevation-of-privilege vulnerabilities in the **Windows Ancillary Function Driver for WinSock (AFD.sys)**, including **`CVE-2026-34344`** and **`CVE-2026-34345`**, which could allow a low-privileged local attacker to gain **SYSTEM** privileges. `CVE-2026-34344` is a **type confusion** issue tracked as **CWE-843** with a **CVSS 7.8** rating, while `CVE-2026-34345` involves a **race condition** and **use-after-free** weakness tracked as **CWE-362** and **CWE-416**, with a **CVSS 7.0** rating. Microsoft said both flaws require local access and no user interaction, and credited **Puponia Angelboy (@scwuaptx) of DEVCORE** with reporting them through coordinated disclosure. Microsoft assessed exploitation of both newly detailed flaws as **less likely** and said neither had been publicly disclosed nor exploited in the wild at the time of publication. The disclosures add to a broader pattern of AFD.sys privilege-escalation fixes listed in Microsoft’s Security Update Guide, including **`CVE-2025-49661`**, **`CVE-2025-54099`**, **`CVE-2025-58714`**, **`CVE-2026-25176`**, and **`CVE-2026-25178`**, indicating continued security hardening around the Windows WinSock ancillary driver. Official patches are available through Microsoft’s security updates.
Jun 29, 2026
Microsoft released fixes for several **Windows elevation-of-privilege vulnerabilities** affecting **Win32k**, **Windows Telephony Service**, **Desktop Window Manager**, and the **Windows Cloud Files Mini Filter Driver**. The disclosed flaws include `CVE-2026-34347`, `CVE-2026-42825`, `CVE-2026-27923`, and `CVE-2026-35418`, and are all tied to **use-after-free** conditions, with some cases also involving race conditions such as time-of-check time-of-use behavior. Microsoft said successful exploitation could let a locally authenticated attacker with low privileges gain **SYSTEM** access without user interaction. The vulnerabilities were rated **Important** with **CVSS 3.1 scores ranging from 7.0 to 7.8**, and Microsoft assessed exploitation as **less likely or unlikely** because several attacks require winning a race condition. At the time of disclosure, Microsoft reported **no public disclosure and no evidence of active exploitation** for the documented 2026 flaws, and stated that official security updates were available. Additional Microsoft advisories also reference related Windows and Microsoft Brokering File System elevation-of-privilege issues, including `CVE-2026-24285`, `CVE-2025-32712`, `CVE-2025-21372`, `CVE-2025-21315`, and `CVE-2025-59189`, though public technical details for those entries were limited.
Jun 29, 2026