Loading story…
Microsoft disclosed CVE-2026-25179, an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that supports Windows socket operations. The issue was published through Microsoft's Security Update Guide and affects a privileged part of the Windows networking stack, meaning successful exploitation could allow an attacker to gain higher permissions on a targeted system.
The newly listed flaw aligns with Microsoft's earlier disclosure of CVE-2023-35632, which affected the same Windows Ancillary Function Driver for WinSock component and was also classified as an elevation of privilege bug. The repeated appearance of privilege-escalation vulnerabilities in afd.sys highlights continued security risk around this Windows driver and reinforces the need for organizations to prioritize Microsoft security updates for systems exposed to local compromise or post-exploitation activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published a Security Update Guide entry for CVE-2026-25179, another Windows Ancillary Function Driver for WinSock elevation of privilege vulnerability.
Microsoft published security guidance for CVE-2023-35632, a Windows Ancillary Function Driver for WinSock elevation of privilege vulnerability.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourceportal.msrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and fixed multiple elevation-of-privilege vulnerabilities in the **Windows Ancillary Function Driver for WinSock (AFD.sys)**, including **`CVE-2026-34344`** and **`CVE-2026-34345`**, which could allow a low-privileged local attacker to gain **SYSTEM** privileges. `CVE-2026-34344` is a **type confusion** issue tracked as **CWE-843** with a **CVSS 7.8** rating, while `CVE-2026-34345` involves a **race condition** and **use-after-free** weakness tracked as **CWE-362** and **CWE-416**, with a **CVSS 7.0** rating. Microsoft said both flaws require local access and no user interaction, and credited **Puponia Angelboy (@scwuaptx) of DEVCORE** with reporting them through coordinated disclosure. Microsoft assessed exploitation of both newly detailed flaws as **less likely** and said neither had been publicly disclosed nor exploited in the wild at the time of publication. The disclosures add to a broader pattern of AFD.sys privilege-escalation fixes listed in Microsoft’s Security Update Guide, including **`CVE-2025-49661`**, **`CVE-2025-54099`**, **`CVE-2025-58714`**, **`CVE-2026-25176`**, and **`CVE-2026-25178`**, indicating continued security hardening around the Windows WinSock ancillary driver. Official patches are available through Microsoft’s security updates.
Jun 29, 2026
Microsoft's Security Update Guide lists **CVE-2026-26168**, an elevation-of-privilege vulnerability in the Windows **Ancillary Function Driver for Winsock (AFD)**. Public reporting indicates the issue was not a newly disclosed flaw at the time of later attention, but rather one that had been historically omitted from Microsoft's April 2026 release materials and subsequently appeared in the advisory portal. The vulnerability was reported in part by **Frederica of Tencent Xuanwu Lab** using the **Atuin Automated Vulnerability Discovery System**, according to attribution in Microsoft's advisory, with Microsoft also noting that other researchers reported the flaw. External coverage stressed that the attribution reflects participation in discovery or reporting of `CVE-2026-26168`, not exclusive credit for finding the bug.
Jul 20, 2026
Microsoft disclosed and patched several Windows elevation-of-privilege vulnerabilities affecting networking-related components, including **Windows Remote Access Connection Manager**, **Windows SMB Server**, and **Network Connection Status Indicator (NCSI)**. The issues tracked as `CVE-2025-62474`, `CVE-2025-62472`, `CVE-2025-47955`, `CVE-2025-59201`, and `CVE-2025-58726` could allow attackers with limited access to gain higher privileges on targeted systems, extending a pattern of privilege-escalation risk previously seen in the same Remote Access Connection Manager component with `CVE-2022-21914`. Among the disclosed flaws, Microsoft provided additional detail for **`CVE-2025-58726`**, describing an **Important** improper access control issue in **Windows SMB Server** that can let an authorized low-privilege attacker elevate to **SYSTEM** over the network by coercing a victim machine to authenticate to an attacker-controlled SMB server using a specially crafted script. Microsoft assigned the bug **CWE-284** and a **CVSS v3.1 score of 7.5**, said exploitation required specific conditions involving an unused or nonexistent Service Principal Name on the target, and stated that the vulnerability was neither publicly disclosed nor exploited in the wild at publication and that a security fix was available.
Jun 29, 2026