A public proof-of-concept exploit for CVE-2023-21768 shows how attackers with local access can gain SYSTEM privileges through the Windows Ancillary Function Driver for WinSock.

Researchers Valentina Palmiotti, known as chompie, and Ruben Boonen published the code. Their complete exploit targets vulnerable Windows 11 22H2 systems.

The release concerns a vulnerability patched in January 2023, not a newly disclosed Windows flaw. IBM published the researchers’ technical analysis on March 21, 2023.

The vulnerability carries a CVSS score of 7.8 and requires low-level local privileges, with no user interaction. It does not provide a direct route into a computer over the internet. The flaw sits in afd.sys, a Windows kernel driver that handles requests from the WinSock networking interface.

According to IBM’s technical analysis, the researchers compared driver versions from December 2022 and January 2023 to understand Microsoft’s fix. Only one function, AfdNotifyRemoveIoCompletion, appeared to have changed, helping them narrow their investigation.

The older code failed to check a memory pointer supplied from a user application. That missing check let a local attacker write to kernel memory, where Windows stores sensitive system data.

Microsoft’s updated code added validation to ensure that pointers from user mode reference suitable user-space memory rather than protected kernel addresses.

POC for Windows WinSock Ancillary Vulnerability

The researchers said they diagnosed, reproduced, and turned the flaw into a working exploit in about one day, despite having no previous experience with this driver.

Their findings show how comparing patched and unpatched software can reveal enough detail to build an attack quickly.

The public GitHub repository describes the code as a demonstration. Its complete privilege escalation chain works on vulnerable Windows 11 22H2 installations, while the underlying memory-write capability works across vulnerable systems.

These are separate claims, and the repository does not promise full exploit compatibility with every affected Windows version. To move from a limited memory write to broader control, the exploit changes Windows I/O ring objects. These objects support queued input and output work.

The technique builds on research by Yarden Shafir and enables kernel memory reads and writes. The exploit then replaces a target process’s security token with one carrying SYSTEM privileges.

IBM also reported that 360 IceSword Lab found a different exploit in the wild in January 2023. That sample used the ProcessSocketNotifications interface rather than the researchers’ direct driver approach. This report does not establish that attackers used the published GitHub code.

Administrators should verify that affected devices received Microsoft’s fix or later applicable updates. IBM’s demonstration also worked without being blocked by HVCI, showing why that protection should not replace patching.

Related coverage includes CVE-2024-38193 exploitation and the CVE-2025-32709 WinSock zero-day. Both involve the same driver, but are separate flaws with different causes and patches.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post POC Released for Windows WinSock Ancillary Privilege Escalation Vulnerability appeared first on Cyber Security News.

Microsoft has introduced a new command-line tool that gives IT admins a faster way to check and manage OneDrive sync across company devices. Microsoft introduced the OneDrive Sync Client Command Line Interface (CLI) at the OneDrive + Copilot event held today. It is aimed at teams that look after large Microsoft 365 setups.

The tool runs with a simple command called odsync and can be used from PowerShell. In the live demo, Microsoft’s Andrey Esipov showed how admins can pull detailed device health information without clicking through settings screens or digging through log files.

According to the demo, the CLI lists every OneDrive account set up on a device, including machines with more than one account, and it can narrow the results down to a single account. It also shows the version of both the sync client and the CLI, whether OneDrive is running, and how it was installed on the system.

Admins can also see Folder Backup settings, including which folders are being backed up to the cloud. One of the most useful features for security teams is the ability to view the Group Policy settings applied to the sync client. This helps confirm that a device actually follows company rules.

The tool also reports overall status at the client, account, and Folder Backup level. When something goes wrong, admins can switch on verbose output for deeper troubleshooting.

Built for Scripts, Automation and AI Agents

A key detail is that the CLI can return results in JSON format. This makes it easy to plug the output into scripts, Microsoft Intune remediation jobs, or reporting tools. Microsoft says the tool works in both interactive and non-interactive modes. It is designed for admins, developers, scripts, and AI agents such as GitHub Copilot CLI.

For example, an admin could run a script across many devices to spot machines where Folder Backup is turned off or where OneDrive is not running at all. Until now, this kind of check often needed custom scripts, registry checks, or third-party utilities.

OneDrive sync is a common blind spot in many companies. Settings that drift away from policy can leave sensitive files outside approved storage or sync them to places they should never reach.

Cyber Security News has earlier reported how OneDrive auto-sync exposed enterprise secrets in SharePoint Online, showing how small sync mistakes can grow into real data leaks. Threat actors have also abused the sync client itself, as seen when hackers exploited OneDrive.exe through DLL sideloading to run malicious code.

A tool that quickly shows the sync client’s real state on each device gives defenders better visibility. It also helps them catch weak setups before they turn into security incidents.

The OneDrive Sync CLI is not yet generally available. Microsoft says it is coming soon to private preview. The company has not shared a public release date, the supported platforms, or a full list of commands. Based on what has been shown so far, the tool focuses on reading and reporting device state rather than changing settings.

Admins who want to get ready can review Microsoft’s guidance on planning file sync for SharePoint and OneDrive and watch the official OneDrive sync release notes for updates.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Unveils New OneDrive Command-Line Tool to Manage Sync Deployments appeared first on Cyber Security News.

Microsoft fixed a Windows 11 update issue that could leave users staring at a black screen after signing in or cause Windows Explorer to crash.

The problem mainly affected Azure Virtual Desktop hosts using FSLogix, and some existing user profiles were more likely to fail to load the desktop. Microsoft marked the issue as resolved on October 13, 2026.

The fix is included in KB5127646 for Windows 11 version 26H1 and later updates. Microsoft recommends installing the latest available update on each device. Systems running the October 13 update or later no longer need the temporary workarounds for this issue.

According to Microsoft’s Windows release health notice, the problem began after the August 2026 non-security preview update, KB5120996. It continued through subsequent updates for Windows 11 version 26H1; that originating update carried OS Build 28000.2804.

Affected users could sign in but found their desktop session did not load automatically. Instead, a black screen appeared, leaving them unable to access the desktop until they started the session manually. Application event logs could also show Windows Explorer crashes, giving administrators a useful sign when checking affected systems.

Microsoft Fixes Windows 11 Update Issue

Microsoft lists Windows 11 versions 26H2, 26H1, 25H2, and 24H2 as affected client platforms. This issue does not affect Windows Server. Although reports mainly involved Azure Virtual Desktop environments using FSLogix, Microsoft did not describe every device running those Windows versions as affected.

Cybersecurity News previously covered the Windows 11 update bug causing black screens, including the temporary recovery steps available before this fix. The new resolution removes the need to rely on those measures once an affected device receives the appropriate update.

Users still running an update released before October 13 can temporarily restore desktop access by pressing Ctrl+Shift+Esc to open Task Manager. They can then select Run new task, enter explorer.exe, and choose OK. Microsoft provides this method as a workaround, not a replacement for installing the fix.

For enterprise-managed devices, administrators can also use Known Issue Rollback, or KIR, through a special Group Policy. The supplied notice identifies KB5124006 260924_20071 for Windows 11 26H1 and KB5124010 260924_20021 for Windows 11 26H2, 25H2, and 24H2.

Administrators must install and configure the policy that matches their Windows version, then restart affected devices. This turns off the change responsible for the issue.

Cybersecurity News also reported on another Windows 11 update fix that replaced a temporary rollback, showing why a workaround and a permanent update aren’t the same.

First, match the symptoms to Microsoft’s health notice and confirm the installed Windows version and update level. Reported signs include a black screen after sign-in, failure to load the desktop, and Windows Explorer crashes. The notice does not identify malware or an attack as the cause.

Microsoft’s Windows 11 release information lists KB5127646 as the October 13 security update for version 26H1, bringing it to Build 28000.3231. Administrators should use the update appropriate for each supported Windows release rather than assume the same package applies across every affected version

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Fixes Windows 11 Update Issue that Causes Black Screen Errors or Windows Explorer crash appeared first on Cyber Security News.

Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025.

Corelight researchers reported the issue after finding it while testing Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces. The company said it had not seen signs of active exploitation when it disclosed the flaw on October 13, 2026.

The vulnerability poses a denial-of-service risk, not server takeover. An attacker needs network access to make the target connect to a malicious SMB server, which returns a malformed DFS referral that crashes the service a process Corelight says can take seconds.

Windows uses DFS to direct users and systems to files stored across a network. When a Windows Server resolves a DFS path, a component called mup.sys requests referral information over SMB. Corelight found that a crafted response can reach a vulnerable code path while the driver processes a DFS referral.

The reported cause is a missing length check. In a particular NameList referral, an offset can point to an empty string. The server code does not reject that value before processing it, and the kernel can hit an invalid memory reference. The result is a blue screen and an unexpected reboot.

Corelight reproduced the crash 11 out of 11 times on Windows Server 2022 and 3 out of 3 times on Server 2019. Those results show the issue was repeatable in the researchers’ lab.

Microsoft Windows Server 0-Day Flaw

However, they don’t show how often organizations use it. Corelight said Windows 10 is not affected because it retains checks absent from the affected Server builds.

Windows Server may restart automatically after a kernel fault, which can limit the length of a single disruption. However, an attacker who can repeatedly trigger the flaw may keep a system offline.

The impact depends on which servers are reachable and targeted. Repeated crashes of important systems, such as domain controllers, could disrupt key services across an organization.

Corelight says reboots may leave little evidence beyond Windows System log Event IDs 41 and 6008, which indicate an unexpected shutdown without explaining the cause, making network monitoring essential to identify activity before and after the crash.

Microsoft’s October 2026 security update, released October 13, addresses CVE-2026-70111 on Windows Server 2019, 2022, and 2025. Organizations should apply the relevant update and prioritize servers that actively use DFS.

Corelight advises monitoring internal, or “east-west,” SMB traffic between servers and domain controllers, not only traffic crossing the perimeter.

Its researchers say Zeek connection logs may show sessions going silent during a crash and reset activity after the server returns. A sudden cluster of connection states such as S1, RSTR, or RSTRH involving the same Server may merit investigation. However, those signs alone do not prove exploitation.

For more background on Windows authentication coercion, see Cyber Security News’ coverage of Windows authentication coercion attacks.

Its earlier report on Windows denial-of-service vulnerabilities offers related context on service availability risks. CVE-2026-70111 shows how an overlooked input check in a kernel driver can turn a network response into a server outage.

Patching affected systems and monitoring internal SMB transactions are key steps to reduce the risk. The technical findings and patch details are described in Corelight’s disclosure.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet appeared first on Cyber Security News.

Microsoft has released fixes for a Windows SmartScreen vulnerability that allows an attacker with local access to gain higher privileges.

Tracked as CVE-2026-85851, the flaw was disclosed on October 13, 2026, and carries a CVSS base score of 7.8. Microsoft rates it Important. The issue involves a use-after-free memory error and affects several Windows 11 releases and Windows Server 2025.

According to the supplied Microsoft advisory, successful exploitation lets an attacker move from a low integrity level to a medium integrity level. This is a specific increase in access, not a confirmed path to administrator or SYSTEM privileges. The attacker must already have low privileges on the affected device, but the attack requires no user interaction.

The flaw falls under CWE-416, use-after-free. This error occurs when software continues to access memory after that memory has been released. Another operation may reuse the same memory, leaving the original code working with data that no longer belongs to it. Such errors can cause memory corruption, crashes, or other security problems.

Microsoft identifies local privilege escalation as the impact for this vulnerability. Its CVSS vector lists low attack complexity, low privileges required, and no user interaction. Those conditions describe an attacker who already has a foothold on the device, not someone exploiting SmartScreen directly over the internet.

Windows SmartScreen Vulnerability

Microsoft credits researcher yhw with reporting the issue. At publication, the advisory marked it as neither publicly disclosed nor exploited and assessed exploitation as “Exploitation Less Likely.” Those findings do not remove the need to patch, but they do not support describing this flaw as an actively exploited zero-day.

Earlier SmartScreen attacks involved different weaknesses. Cyber Security News previously covered SmartScreen bypass attacks delivering malware through CVE-2024-21412 and Water Hydra’s SmartScreen zero-day campaign. Those reports concern bypassing security warnings and should not be confused with the newly disclosed local privilege escalation flaw.

Microsoft also disclosed CVE-2026-83504, a Windows SmartScreen information disclosure flaw rated CVSS 4.7 and classified as a time-of-check-to-time-of-use (TOCTOU) race condition.

An attacker who successfully exploits this second flaw could view heap memory from a privileged process. Exploitation requires winning a race condition, which explains its high attack complexity.

It also requires local access and low privileges and needs no user interaction. Microsoft credits its Offensive Research & Security Engineering team and reports no exploitation at publication. The supplied material does not establish an exploit chain between the two flaws.

For CVE-2026-85851, the supplied update list covers Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2 across x64 and ARM64 systems. Windows Server 2025, including Server Core, is also listed.

The listed fixes are KB5126653 for Windows 11 23H2, KB5127648 for 24H2, 25H2, and 26H2, KB5127646 for 26H1, and KB5126646 for Windows Server 2025.

Administrators should match each device to its release and architecture, then verify installation against Microsoft’s update records. The two advisories list different update packages, so check their patch details separately before deploying across affected systems.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Windows SmartScreen Vulnerability Enables Privilege Escalation Attacks appeared first on Cyber Security News.

Microsoft has confirmed a Windows 11 audio decoding bug that can cause some productivity apps, games, and media players to close without warning.

The issue follows installation of KB5124010, released on September 22, 2026, or later Windows updates, and affects applications that depend on Windows to decode AC-3 (Dolby Digital) audio.

The problem affects Windows 11 versions 26H2, 25H2, and 24H2. Microsoft lists no affected Windows Server platforms. Although several types of software may experience crashes, the company says the issue is more likely to affect older applications that rely on the operating system’s built-in audio decoding component.

Windows 11 AC-3 Crash Details

Microsoft opened the issue on October 2 at 15:06 PT and updated its advisory at 15:41 PT that day. Its status remains “Confirmed,” with a fix planned for a future Windows update. The Windows release health advisory identifies OS build 26300.9550 as the originating build for Windows 11 26H2.

For Windows 11 25H2 and 24H2, the affected update corresponds to builds 26200.9550 and 26100.9550. Microsoft’s KB5124010 support page describes the package as a non-security preview update containing quality improvements. The audio bug is therefore an update-related reliability issue, rather than a disclosed security vulnerability in the advisory.

The symptoms depend on what an application is doing. Some affected programs may fail to open, while others launch successfully but close without warning. In another scenario, an application works normally until the user starts a feature that needs audio decoding, such as music playback.

This feature-based behavior is important when investigating crashes. A program that opens correctly is not necessarily unaffected. For example, a media player could appear stable during normal navigation but close when playback reaches a function that uses the affected Windows decoding component. Microsoft has not named specific affected products.

The key factor is how an application handles AC-3 audio, not simply whether it plays sound. Microsoft says the code component involved is most commonly used by legacy applications that still depend on Windows for built-in audio decoding. That shared dependency explains why the same issue can affect otherwise unrelated software categories.

Many modern applications do not use Windows for this task and will not encounter the problem. Others support the legacy codec but include their own audio decoding components. Microsoft’s explanation narrows the scope: the advisory does not mean every Windows game, media player, or productivity tool will crash after installing KB5124010.

The issue also differs from the USB audio failures covered in Cyber Security News’ report on Microsoft’s emergency Windows 11 update. Those failures involved devices producing no sound or displaying Code 10 errors. The newly confirmed AC-3 issue concerns applications closing during audio processing, rather than the same hardware startup failure

As of the October 2 advisory update, Microsoft has not published a dedicated AC-3 workaround or a release date for the fix. It says a resolution will arrive in a future Windows update. The notice provides no named application list, crash error code, or technical explanation of the underlying fault. Those details remain unavailable while Microsoft works on the correction.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post Windows 11 KB5124010 Update Crashes Productivity Apps, Games and Media Players appeared first on Cyber Security News.

Microsoft has confirmed a Windows 11 issue that can leave users staring at a black screen after signing in, with the desktop shell failing to start automatically.

The problem emerged after installation of the August 27, 2026 non-security preview updates and later cumulative updates. Microsoft lists the incident as “mitigated,” while engineers continue developing a permanent correction for a future Windows update.

The failure has been observed primarily on Azure Virtual Desktop hosts using FSLogix, particularly when sessions load certain existing user profiles. Affected users may authenticate but never reach a usable desktop.

In some cases, they can regain access only by starting the desktop session manually, while Windows Application event logs may record crashes involving Windows Explorer.

Windows 11 Update Bug Causing Black Screens

For Windows 11 version 26H1, Microsoft traces the regression to KB5120996, released as an optional preview update with OS Build 28000.2804. Windows 11 versions 25H2 and 24H2 are also affected, with Microsoft’s dashboard identifying KB5120998 as the originating August update for those releases. No Windows Server platform is currently listed as affected.

Users who encounter the black screen can apply an immediate workaround without removing the update. Press Ctrl+Shift+Esc to open Task Manager, choose “Run new task,” enter “explorer.exe,” and select OK. This manually launches the Windows shell and should restore access to the desktop for the session, although it does not eliminate the underlying update regression.

Microsoft has issued a more scalable Known Issue Rollback, or KIR, for enterprise-managed environments. Administrators managing Windows 11 26H1 should deploy the KB5124006 260924_20071 rollback policy, while Windows 11 25H2 and 24H2 environments require KB5124010 260924_20021.

Install the matching policy, configure it under Computer Configuration > Administrative Templates, and then restart the device.

KIR is designed to reverse only the problematic non-security change while preserving the remainder of the installed update. Microsoft’s deployment guidance says administrators can distribute the policy through Group Policy in Active Directory or hybrid Microsoft Entra ID environments; managed devices ordinarily refresh policy within 90 to 120 minutes, while gpupdate can accelerate retrieval. Every affected endpoint must restart after applying the setting.

For IT teams operating pooled or multi-session AVD infrastructure, the incident warrants validation before broad update deployment. Administrators should identify hosts running the affected Windows 11 builds, correlate sign-in failures with Explorer crash events, test the correct KIR against representative FSLogix profiles, and monitor session recovery after reboot.

Microsoft cautions that the rollback simply disables the offending change until a durable fix arrives, so organizations should retain the policy and track Windows release-health updates rather than treating the workaround as final remediation.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Microsoft Confirms Windows 11 Update Bug Causing Black Screens and Loading Issues appeared first on Cyber Security News.

Security researcher MSNightmare, also known as Nightmare-Eclipse, has released BigDiskBuster, a proof-of-concept denial-of-service technique designed to stop Microsoft Defender Antivirus from completing platform and security-intelligence updates. The project is presented as a successor to UnDefend.

The researcher claims it works across all supported Windows versions, although the experimental code remains buggy; compatibility has not been independently verified.

BigDiskBuster does not directly switch off Defender. Instead, it watches the C: volume for changes involving Defender’s Platform and Definition Updates directories. When a new update directory appears, the program checks available disk capacity and creates a hidden, delete-on-close file under the user’s temporary directory, requesting the remaining free space.

If files are modified or removed during the update attempt, additional worker threads try to reclaim newly available capacity, repeatedly starving the installer of storage.

The PoC also opens Windows’ Malicious Software Removal Tool binary, MRT.exe, with restrictive sharing permissions. This can prevent another process from obtaining write or delete access while the handle remains open.

Together, disk exhaustion and file locking interfere with update staging, installation, and rollback operations. Once the monitored Defender update directory disappears, the program interprets that event as a failed update, closes its temporary-file handles, and releases the allocated disk space.

A screenshot supplied with the disclosure shows Windows Security reporting “Protection definition update failed,” error code 0x80070643, and a fatal installation error while the console logs BigDiskBuster detecting an update and allocating temporary files.

This shows the researcher’s test, not independent confirmation. Error 0x80070643 is also a generic installation failure with several possible causes, so defenders should not treat that code alone as proof of exploitation.

The security impact is significant because Defender depends on separate security-intelligence, engine, and platform updates. Microsoft says intelligence packages deliver current detection content, while platform and engine releases maintain supported antivirus components.

Blocking these channels could leave an endpoint running apparently active protection while its ability to recognize emerging malware steadily deteriorates.

Administrators should monitor free-space collapses, unusual hidden files created in user Temp directories, persistent handles to MRT.exe, and repeated Defender update failures.

Microsoft documents update events in Applications and Services Logs under Microsoft, Windows, Windows Defender, Operational; Event ID 2000 records a successful signature update, making missing successes and recurring failures useful hunting signals.

Because the repository describes an experimental PoC, organizations should avoid treating every Defender update error as an attack. Validate affected hosts, preserve process and file-handle telemetry, terminate the suspicious process, recover disk capacity, and force a trusted update.

Microsoft supports updates through Windows Update, WSUS, the Windows Security app, and MpCmdRun.exe; compromised systems should also receive broader incident-response review.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post MSNightmare Releases New PoC for DoS Vulnerability in Windows Defender appeared first on Cyber Security News.

Microsoft has confirmed that the September 8, 2026 Excel security update KB5002914 can silently break copy and paste in Excel 2016, 2019, 2021, and 2024.

Microsoft added the defect to the update’s known issues after Patch Tuesday users reported that paste, autofill, and formula dragging failed with no error.

Microsoft’s advisory says the paste operation might fail silently. A user copies a cell or range, then pastes, but the source remains selected, and the destination never changes.

No beep or error message appears, so finance and operations staff may believe data transferred when the sheet is still empty. That lack of feedback is what makes the bug so easy to miss during routine spreadsheet work.

Reports on Reddit and Microsoft Q&A described the same behavior after the September 9 install wave, including broken drag-fill, with some teams already fully patched before anyone noticed.

Typing a few values, copying them, and pasting nearby is enough to confirm the bug. KB5002914 is a security release for Excel 2016 that addresses remote code execution

and information disclosure, tying to September CVEs such as CVE-2026-81399, CVE-2026-81390, and CVE-2026-81954. The standalone Microsoft Download Center packages apply only to MSI-based Office 2016, not Click-to-Run editions such as Microsoft 365 Home.

The update is also available from Microsoft Update and the Microsoft Update Catalog, and it replaces security update 5002886.

That mix of serious Excel flaws and a core productivity break is why administrators are now stuck between keeping the patch and keeping spreadsheets usable.

The public KB is written for Excel 2016, yet Microsoft’s known-issue note names Excel 2024, 2021, 2019, and 2016. Field reports also cover MSI and Click-to-Run installs and Office LTSC Standard 2021, pointing to a broader September Office servicing problem rather than a single 2016 MSI package.

Microsoft says it is researching the issue and will post more information when it becomes available, as detailed in the support advisory published by Microsoft. No hotfix date has been published as of September 15, 2026.

Until an official repair ships, the only widely confirmed recovery is to uninstall or roll back KB5002914. MSI customers say removal restores paste, while Click-to-Run sites have used XML or Group Policy to revert the Office build. Both moves drop the month’s Excel security fixes.

Replacing the updated excel.exe with an older binary is an unsupported folk workaround and can leave mixed files that create new security and stability gaps.

Teams that must restore Excel should document the exception, treat untrusted workbooks as high risk, and watch Microsoft’s KB5002914 advisory for an out-of-band fix.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Confirms KB5002914 Update Breaks Copy and Paste on Excel appeared first on Cyber Security News.