What is the CVSS score of CVE-2026-25176?

CVE-2026-25176 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-25176?

CVE-2026-25176 is a local privilege escalation vulnerability in Windows that allows authenticated users to gain elevated system access.. A patch is available.

How to fix or mitigate CVE-2026-25176?

Within 24 hours: Inventory all Windows systems running affected Ancillary Function Driver versions and assess exposure in high-value environments (servers, administrative workstations, privileged access workstations). Within 7 days: Implement application whitelisting to restrict execution of exploitation vectors and enforce principle of least privilege across user accounts to minimize privilege escalation opportunities. Within 30 days: Monitor vendor advisories for patch availability and prepare deployment procedures; conduct security awareness training on lateral movement risks and credential hygiene for at-risk user populations.

Windows CVE-2026-25176

HIGH

Improper Access Control (CWE-284)

2026-03-10 secure@microsoft.com

Windows Authentication Bypass Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2022 23h2 Windows Server 2025

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.8

DescriptionCVE.org

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Windows Ancillary Function Driver for WinSock in Windows 10 (all versions) and Windows 11 contains an access control weakness that enables authenticated local attackers to escalate privileges to system level. An attacker with standard user credentials can exploit this flaw to gain elevated rights on affected systems. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.