Windows AFD.sys EUVD-2026-29623

Apply the vendor-released patches immediately through Windows Update or Microsoft Update Catalog as documented in Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35416. Organizations should prioritize patching for systems where local user access is granted to untrusted or semi-trusted users, including terminal servers, jump boxes, development environments, and contractor-accessible workstations. For systems that cannot be immediately patched, implement compensating controls including restricting local logon rights to only essential administrative accounts via Group Policy (Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Allow log on locally), enabling and monitoring Windows Defender Exploit Guard's Arbitrary Code Guard feature, and deploying enhanced logging for AFD.sys driver activity through Sysmon Event ID 6 (driver loaded) and Event ID 3 (network connections). Note that disabling AFD.sys is not feasible as it would break all WinSock networking functionality. Monitor for unusual privilege escalation attempts via Security Event IDs 4672 (special privileges assigned to new logon) and 4673 (privileged service called) from low-privilege user contexts.