Executive brief
A security bypass vulnerability exists in the Windows Filtering Platform, a set of system services used by networking software and firewalls to process network traffic. An attacker who already has basic access to a Windows machine could exploit this to circumvent certain security restrictions or filters. This could allow unauthorized network activity or the bypassing of local security policies, though it does not directly grant full administrative control.
Technical details
A security feature bypass vulnerability exists in the Windows Filtering Platform (WFP) due to improper access control (CWE-284). The vulnerability allows a locally authenticated attacker with low privileges to bypass configured security policies or network filters. Exploitation requires the attacker to execute a specially crafted application on the target system. Successful exploitation could result in a partial loss of integrity and confidentiality by circumventing intended traffic restrictions. Microsoft has addressed this issue in the May 2026 security updates.
Affected products
- Microsoft Windows
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory: Microsoft published the security advisory and update guide.