Microsoft’s May 12, 2026 security bulletin pulled back the curtain on CVE-2026-35416, an elevation-of-privilege vulnerability lodged deep inside the Windows Ancillary Function Driver (AFD.sys). The bug allows an attacker who has already gained a foothold on a machine to vault from a mundane user account to the all-powerful SYSTEM account. In practical terms, that means full control over the operating system—the ability to install rootkits, disable defenses, and ransack sensitive data. The fix landed with the May 2026 Patch Tuesday cycle, and every Windows administrator should treat this update as urgent.

What Makes AFD.sys So Critical

The Ancillary Function Driver is the kernel-mode backstage crew for Windows Sockets (WinSock). Every time an application—be it a web browser, email client, or enterprise database—sends or receives data over TCP/IP, it talks to AFD.sys. The driver translates high-level socket calls from user mode into the low-level I/O request packets (IRPs) that travel through the network stack. Because it runs with kernel privileges, any flaw in AFD.sys can be catastrophic. An attacker who can bend the driver’s logic can execute arbitrary code at the most trusted level, bypassing all user-mode security boundaries.

CVE-2026-35416 resides in the driver’s handling of certain crafted requests. Microsoft hasn’t published the exact mechanics—a sensible move to slow down exploit writers—but historically, these vulnerabilities involve improper validation of input buffers or a failure to lock memory correctly. A local attacker could trigger a buffer overflow, a use-after-free, or a race condition that corrupts kernel memory. The result is code execution in kernel context, elevating privileges from “Authenticated User” to “NT AUTHORITY\SYSTEM.” In the cybersecurity world, that’s game over.

Who Is Affected

The advisory tersely states that the vulnerability hits “supported Windows client and server releases.” By May 2026, that umbrella covers a broad fleet: Windows 10 (versions 22H2 and later), Windows 11 (including 24H2 and any newer feature updates), Windows Server 2019, Windows Server 2022, and possibly Windows Server 2025 if it has shipped. LTSC editions and Windows 10 IoT are also in the line of fire. Essentially, if your device still gets cumulative updates, it needs this patch. Microsoft’s security update guide will eventually list exact build numbers and KB articles, but in the early hours after disclosure, the safest assumption is universal impact.

Impact: More Than Just a Privilege Boost

Elevation-of-privilege bugs are force multipliers. They don’t give an attacker initial access, but they supercharge whatever access the attacker already has. A phishing victim who clicks a malicious document might only compromise a low‑privileged account. With CVE-2026-35416, that limited breach instantly becomes a total system takeover. Ransomware gangs adore such vulnerabilities because they let them kill endpoint protection services and encrypt files without interference. Advanced persistent threat (APT) actors use them to burrow into critical infrastructure undetected.

Microsoft hasn’t assigned a public CVSS score at this writing, but based on the impact, the Common Vulnerability Scoring System would likely peg this as “Important” or “Critical.” The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has not yet added it to the Known Exploited Vulnerabilities catalog—though that could change if exploitation is spotted in the wild.

A Recurring Bug Pattern

AFD.sys is no stranger to the security spotlight. The driver has been a repeat offender, with a string of high‑severity CVEs over the past few years:

  • CVE-2021-34483 (August 2021): An elevation‑of‑privilege flaw actively exploited as a zero‑day.
  • CVE-2022-24488 (January 2022): Another local privilege escalation that allowed a standard user to gain SYSTEM rights.
  • CVE-2023-21818 (February 2023): Yet another AFD.sys EoP, patched in a routine update.

Each of these followed a similar blueprint: specially crafted IOCTL calls that tripped a memory handling bug in the driver. The recurrence hints at a fundamental brittleness in the codebase, likely a legacy from earlier Windows networking architectures. Security researchers have long urged Microsoft to rewrite high‑risk kernel drivers in memory‑safe languages like Rust, but short of that, rigorous fuzzing and code audits remain essential.

How to Patch CVE-2026-35416

The fix is bundled into the May 2026 cumulative update for each affected Windows edition. Deployment steps differ depending on your environment.

For Individual Users and Small Businesses

  1. Open Settings → Windows Update.
  2. Click Check for updates.
  3. Allow the system to download and install any pending updates. Look for a cumulative update with a “May 2026” date stamp.
  4. Restart your computer when prompted.

After rebooting, validate the installation by going to Settings → Windows Update → Update history and confirming the presence of the latest cumulative update.

For Enterprise IT Administrators

Large environments should leverage managed deployment tools:

  • Windows Server Update Services (WSUS): Synchronize and approve the security update for the relevant products. The update will appear under the “Security Updates” classification.
  • Microsoft Endpoint Configuration Manager: Import the update from the catalog and create a deployment package. Test on a pilot group before broad rollout.
  • Microsoft Intune: For cloud‑managed devices, deploy the latest quality update via an update ring policy.
  • Azure Update Manager: For virtual machines running in Azure, schedule the update installation.

The specific KB number varies by Windows version. You can locate the correct KB by visiting the Microsoft Security Update Guide for CVE-2026-35416 and selecting your product. For example, Windows 11 24H2 might receive KB503921X, while Windows 10 22H2 gets KB503922Y—but always verify against official guidance.

Offline or Air‑Gapped Systems

Download the standalone update package from the Microsoft Update Catalog. Search for the KB number or “May 2026 Security Update” for your operating system. Transfer the .msu file via removable media and install it manually.

Verification Techniques

Beyond checking Windows Update history, system administrators can verify the patch with PowerShell:

Get-HotFix | Where-Object {$_.HotFixID -like "KB*" -and $_.InstalledOn -gt [datetime]"2026-05-10"}

This lists all updates installed after May 10, 2026. For a more targeted check, confirm that the file version of C:\Windows\System32\drivers\afd.sys has changed. Right‑click the file, select Properties → Details, and compare the build number with a known vulnerable version—though Microsoft has not published baseline build numbers at this time. As a rule of thumb, any afd.sys dated after May 2026 contains the fix.

Workarounds and Mitigation

No practical workaround exists. AFD.sys is a core networking component; disabling it would immediately break all TCP/IP functionality, effectively rendering the machine a digital paperweight. Microsoft’s advisory does not list any registry‑based mitigation or feature‑flag to toggle.

Organizations that cannot patch immediately should double down on defense‑in‑depth measures:

  • Enforce least‑privilege principles so that initial footholds are harder to gain.
  • Deploy endpoint detection and response (EDR) solutions that can identify anomalous access to afd.sys.
  • Enable attack surface reduction rules that block common exploit techniques.

Detecting Exploitation Attempts

While the specific exploit method for CVE‑2026‑35416 remains undisclosed, defenders can hunt generically for signs of kernel driver exploitation.

Sysmon Monitoring

Sysmon (System Monitor) can log driver loads and certain device interactions. A sample configuration rule to monitor AFD.sys access might look like this:

<Sysmon>
  <EventFiltering>
    <ProcessAccess onmatch="include">
      <TargetImage condition="contains">\afd.sys</TargetImage>
    </ProcessAccess>
  </EventFiltering>
</Sysmon>

Look for unexpected processes interacting with the driver, especially from temporary folders or low‑privilege accounts.

Windows Defender for Endpoint

Advanced hunting with KQL (Kusto Query Language) can surface suspicious behavior:

DeviceEvents
| where ActionType == "ProcessAccess"
| where FileName has "afd.sys"
| where InitiatingProcessFileName !in~ ("svchost.exe", "System", "services.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine

This query returns processes that access afd.sys but are not typical system components, warranting investigation.

Event Tracing for Windows (ETW)

Kernel‑level ETW providers can reveal IOCTL requests to the AFD driver. Security teams with deep expertise can set up trace sessions and analyze call patterns for anomalies such as unusually large buffers or unknown control codes.

The Bigger Picture: Kernel Security in 2026

CVE‑2026‑35416 is a sharp reminder that decades‑old kernel code remains a fertile hunting ground for attackers. The Windows NT kernel and its drivers, written largely in C and assembly, are monumentally complex. Even well‑fuzzed interfaces can hide corner‑case flaws that slip past testing. The industry’s gradual shift toward Rust and other memory‑safe languages for new kernel components is promising, but retrofitting the entire legacy stack is a generational project.

In the meantime, Patch Tuesday remains the front line. The May 2026 update should be applied without delay—not just for this CVE, but for the dozens of other fixes it contains. Set Windows Update to automatic if you haven’t already, and consider moving to a modern patch management solution that shortens the window between release and deployment.

For now, the message is uncomplicated: patch your systems, verify the fix, and keep an eye on the advisory for any post‑release intelligence. The attackers are certainly doing the same.