Microsoft Windows: Local privilege escalation in Ancillary Function Driver for WinSock

Summary

The Windows Ancillary Function Driver for WinSock (afd.sys), a kernel-mode component, contains a type confusion flaw (CWE-843). A local user with low privileges can exploit it to gain elevated (SYSTEM) privileges. An attacker needs a foothold on the machine first, for example a malicious local account or code already running. The official CVSS base score is 7.0 (High).

Affected

• Windows 10 Version 1607 (build 10.0.14393.0 before 10.0.14393.9612)
• Windows Server 2016 (build 10.0.14393.0 before 10.0.14393.9612)
• Other affected Windows 10, Windows 11 and Windows Server 2012/2012 R2 builds are listed in the MSRC advisory.

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 10.0.14393.9612 or later (KB5126868, October 2026)
• Microsoft release information also lists build 14393.9615 from the October 2026 out-of-band update.
• Windows 10 Version 1607 is end of servicing. The fix is only available to devices enrolled in Extended Security Updates (ESU).

Workaround

Unknown. No Microsoft-documented mitigation was found.

Exploitation

• Microsoft rates exploitation as less likely. Publicly disclosed: No. Exploited: No.
• The CVE is not listed in CISA KEV.
• No public proof of concept was found. This does not rule out that one exists.
• CISA SSVC: not automatable, total technical impact.

Our recommendation

• Confirm that all Windows 10 1607 / LTSB 2016 and Windows Server 2016 systems run build 14393.9612 or later.
• For devices that cannot be updated, enrol them in ESU or plan an upgrade. Microsoft recommends Windows 11 Enterprise LTSC 2024 for LTSB 2016 devices.
• Prioritise shared, multi-user, kiosk, POS and HMI systems, because local users or malware could exploit this flaw there.
• Verify version details on the MSRC page before communicating them to customers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft MSRC Security Update Guide msrc.microsoft.com
• Microsoft Windows 10 1607 and Server 2016 release health learn.microsoft.com
• Microsoft release information learn.microsoft.com
• Enable ESU for Windows 10 LTSB 2016 learn.microsoft.com
• OpenCVE CVE-2026-70205 app.opencve.io
• Vulners NVD record CVE-2026-70205 vulners.com
• Windows Server 2016 (Wikipedia) en.wikipedia.org

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:04.