What is the CVSS score of CVE-2026-32086?

CVE-2026-32086 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Function Discovery Service are affected by CVE-2026-32086?

CVE-2026-32086 is a privilege escalation vulnerability in Windows Function Discovery Service affecting all supported Windows 10, 11, and Server versions that allows authenticated local users to gain…. A patch is available.

How to fix or mitigate CVE-2026-32086?

Within 24 hours: Inventory all Windows 10, 11, and Server 2012-2025 systems in your environment and confirm current patch levels. Within 7 days: Deploy Microsoft's May 2026 Patch Tuesday security updates containing fixes for CVE-2026-32086 to all affected systems using your standard patch management process, prioritizing servers and sensitive workstations. Within 30 days: Achieve 95%+ patch coverage across the estate and validate via vulnerability scanning that fdwsd.dll versions have been updated to patched builds.

Function Discovery Service CVE-2026-32086

EUVD-2026-22520 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

Information Disclosure Race Condition

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:32 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22520

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:58 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Windows Function Discovery Service (fdwsd.dll) allows authenticated local attackers to gain SYSTEM-level access by exploiting a race condition during shared resource handling. Affects all supported Windows 10/11 client versions and Windows Server 2012 through 2025. Vendor-released patches are available per Microsoft's May 2026 Patch Tuesday. No public exploit identified at time of analysis, but CVSS 7.0 reflects high complexity local attack requiring low privileges.

Technical ContextAI

The Function Discovery Service (fdwsd.dll) is a Windows component responsible for discovering network resources and devices. The vulnerability stems from CWE-362 (concurrent execution using shared resource with improper synchronization). This race condition class occurs when multiple threads or processes access shared memory or file system resources without adequate locking mechanisms, creating a time-of-check-time-of-use (TOCTOU) window. An attacker with low-privilege local access can manipulate the timing of concurrent operations to cause the service (which runs with elevated privileges) to perform unintended actions, ultimately granting the attacker SYSTEM-level privileges. The fdwsd.dll component operates in the context of a Windows service, making successful exploitation particularly impactful as it bridges the gap between standard user and administrative control.

RemediationAI

Apply Microsoft's May 2026 security updates immediately through Windows Update or WSUS. Patched versions: Windows 10 1607/Server 2016 build 10.0.14393.9060, Windows 10 1809/Server 2019 build 10.0.17763.8644, Windows 10 21H2 build 10.0.19044.7184, Windows 10 22H2 build 10.0.19045.7184, Windows 11 22H3/23H2 build 10.0.22631.6936, Windows 11 24H2/Server 2025 build 10.0.26100.32690, Windows 11 25H2 build 10.0.26200.8246, Windows 11 26H1 build 10.0.28000.1836, Server 2012 build 6.2.9200.26026, Server 2012 R2 build 6.3.9600.23132, Server 2022 build 10.0.20348.5020, Server 2022 23H2 build 10.0.25398.2274. No effective workarounds exist as the Function Discovery Service is integral to Windows networking features. Prioritize patching multi-user systems and servers where authenticated local access is granted to untrusted users. Download patches from https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32086.