What is the CVSS score of CVE-2026-32093?

CVE-2026-32093 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Function Discovery Service are affected by CVE-2026-32093?

CVE-2026-32093 is a local privilege escalation in Windows Function Discovery Service affecting Windows 10, Windows 11, and Server 2012-2025, allowing authenticated low-privilege users to gain SYSTEM…. A patch is available.

How to fix or mitigate CVE-2026-32093?

Within 24 hours: Inventory all Windows 10, Windows 11, and Windows Server (2012-2025) systems in your environment. Within 7 days: Deploy Microsoft patches for Windows 11 (build 10.0.28000.1836 or later) and Server 2025 (build 10.0.26100.32690 or later); prioritize servers and administrative workstations. Within 30 days: Complete patching across all remaining Windows systems; validate patch application via Windows Update compliance reporting or SCCM/Intune dashboards.

Function Discovery Service CVE-2026-32093

EUVD-2026-22532 HIGH

Race Condition (CWE-362)

2026-04-14 microsoft

Information Disclosure Race Condition

7.0

CVSS 3.1 · NVD

Temporal: 6.1

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.1 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:19 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22532

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

Patch released

Apr 14, 2026 - 17:46 nvd

Patch available

CVE Published

Apr 14, 2026 - 16:57 nvd

HIGH 7.0

DescriptionCVE.org

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in Microsoft Windows Function Discovery Service (fdwsd.dll) allows authenticated low-privilege attackers to gain SYSTEM-level access via race condition exploitation across all supported Windows 10, Windows 11, and Windows Server versions (2012-2025). The vulnerability requires local access and low privileges (CVSS PR:L) with high attack complexity (AC:H), yielding complete system compromise (C:H/I:H/A:H). Microsoft released patches addressing build versions up to 10.0.26100.32690 (Server 2025) and 10.0.28000.1836 (Windows 11 26H1). EPSS data not available; no public exploit identified at time of analysis.

Technical ContextAI

The Function Discovery Service (fdwsd.dll) is a Windows component enabling automatic discovery and enumeration of network devices and resources. This vulnerability stems from CWE-362 (concurrent execution using shared resource with improper synchronization), commonly known as a Time-of-Check to Time-of-Use (TOCTOU) race condition. The flaw allows multiple threads to access shared resources without proper locking mechanisms, creating a timing window where an attacker can manipulate security-critical data between validation and use. Since fdwsd.dll operates with elevated SYSTEM privileges to manage network discovery operations, winning the race condition enables privilege boundary crossing from low-privileged user context to SYSTEM. The local attack vector (AV:L) and high complexity (AC:H) indicate successful exploitation requires precise timing and potentially multiple attempts to win the race window.

RemediationAI

Apply Microsoft security updates immediately from the March 2026 Patch Tuesday release. Vendor-released patches: Windows 10 Version 1607 to build 10.0.14393.9060, Windows 10 Version 1809 to 10.0.17763.8644, Windows 10 21H2 to 10.0.19044.7184, Windows 10 22H2 to 10.0.19045.7184, Windows 11 22H3/23H2 to 10.0.22631.6936, Windows 11 24H2 to 10.0.26100.32690, Windows 11 25H2 to 10.0.26200.8246, Windows 11 26H1 to 10.0.28000.1836, Windows Server 2012 to 6.2.9200.26026, Windows Server 2012 R2 to 6.3.9600.23132, Windows Server 2016 to 10.0.14393.9060, Windows Server 2019 to 10.0.17763.8644, Windows Server 2022 to 10.0.20348.5020, Windows Server 2022 23H2 to 10.0.25398.2274, and Windows Server 2025 to 10.0.26100.32690. Download patches via Windows Update, WSUS, or Microsoft Update Catalog at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32093. No effective workarounds exist; patching is the only mitigation. Prioritize domain controllers, Remote Desktop servers, and systems with multiple user accounts.