What is the CVSS score of CVE-2026-26173?

CVE-2026-26173 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Microsoft are affected by CVE-2026-26173?

A local privilege escalation vulnerability in Windows AFD.sys driver (CVE-2026-26173) allows authenticated users to gain SYSTEM-level access across Windows 10, 11, and Server 2012-2025.. A patch is available.

How to fix or mitigate CVE-2026-26173?

Within 24 hours: Inventory all Windows 10, Windows 11, and Server 2012-2025 systems in your environment and identify current patch levels. Within 7 days: Deploy Microsoft-released patches for AFD.sys across all affected operating system versions (specific KB articles and patch versions available from Microsoft Security Updates portal). Prioritize Server and domain-joined endpoints. Within 30 days: Complete patching of all remaining systems, verify patch application via Windows Update compliance reporting, and review access controls to limit local execution privileges where feasible.

Microsoft CVE-2026-26173

EUVD-2026-22408 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

Information Disclosure Race Condition Microsoft

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:27 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22408

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) across Windows 10, 11, and Server 2012-2025 allows low-privileged authenticated attackers to gain SYSTEM-level access via race condition exploitation. The vulnerability affects widespread Windows deployments spanning a decade of operating system versions, from Server 2012 (6.2.9200.0) through Windows 11 26H1 and Server 2025. Microsoft has released patches for all affected versions. No public exploit identified

Technical ContextAI

The Windows Ancillary Function Driver for WinSock (AFD.sys) is a kernel-mode driver that provides low-level networking services for Windows Sockets API. This CWE-362 race condition vulnerability stems from improper synchronization when multiple threads concurrently access shared resources within the driver. Race conditions in kernel drivers occur when the security state of a resource can change between time-of-check and time-of-use (TOCTOU), allowing attackers to manipulate resource states during the window between validation and use. AFD.sys operates at ring 0 with SYSTEM privileges, making race condition exploitation particularly severe as successful exploitation grants full kernel-level access. The vulnerability spans CPE products from legacy Windows Server 2012 (NT 6.2) through modern Windows 11 26H1 and Server 2025 (NT 10.0.26100+), indicating a longstanding code defect in the WinSock driver subsystem maintained across major Windows architecture revisions.

RemediationAI

Apply Microsoft's security updates immediately through Windows Update or WSUS. Fixed versions include Windows Server 2012 6.2.9200.26026+, Windows 10 1607/Server 2016 10.0.14393.9060+, Windows 10 1809/Server 2019 10.0.17763.8644+, Windows 10 21H2 10.0.19044.7184+, Windows 10 22H2 10.0.19045.7184+, Windows 11 22H3/23H2 10.0.22631.6936+, Windows Server 2022 10.0.20348.5020+, Windows Server 2022 23H2 10.0.25398.2274+, Windows 11 24H2/Server 2025 10.0.26100.32690+, Windows 11 25H2 10.0.26200.8246+, Windows 11 26H1 10.0.28000.1836+, and Windows Server 2012 R2 6.3.9600.23132+. No workarounds are documented for this kernel driver vulnerability. Organizations using extended security update (ESU) programs should verify patch availability for legacy systems. Vendor patch information is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26173. Prioritize patching on multi-user systems, terminal servers, and environments where local user access presents elevated risk.