CVE-2023-21768: Windows Ancillary Function Driver for WinSock elevation of privilege

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityLocal privilege escalation to SYSTEM with a 7.8 CVSS and very high EPSS, though not in KEV and requiring existing local access.

What it is

The Windows Ancillary Function Driver for WinSock (afd.sys) contains an elevation of privilege flaw. A local attacker with low privileges can exploit it to gain full control of the affected system. The record gives no root-cause detail beyond a CWE-822 (untrusted pointer dereference) mapping and an NVD no-info entry, so the exact defect is not described.

Impact

An attacker gains high confidentiality, integrity and availability impact, effectively SYSTEM-level control over the host. This enables credential theft, disabling of security controls and lateral movement from an already-compromised account.

Attack surface

Reached locally (AV:L) with low privileges required (PR:L) and no user interaction (UI:N). The attacker must already have code execution on the target Windows 11 or Windows Server 2022 host.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high at 0.654 (99.2nd percentile), indicating strong likelihood of exploitation activity. The two references are both the Microsoft update guide with no exploit tags.

What to do

• Apply the Microsoft January 2023 security update for CVE-2023-21768 on Windows 11 and Windows Server 2022.
• Prioritize patching of endpoints and servers where untrusted or low-privileged users can run code.
• Enforce least privilege and remove unnecessary local admin rights to reduce the pool of accounts that can reach the driver.
• Monitor for suspicious afd.sys-related activity and unexpected SYSTEM-level process creation from low-privileged contexts.

Detection

• Alert on process creation where a low-privileged parent spawns a SYSTEM-integrity child, especially involving afd.sys or WinSock-related handles.
• Track EDR telemetry for anomalous driver interaction and token manipulation on Windows 11 and Server 2022 hosts.
• Correlate local privilege escalation attempts with subsequent credential access or defense-evasion behavior.
• Audit patch state of Windows 11 and Windows Server 2022 assets against the January 2023 update.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.