# Microsoft's MDASH AI Scanning Harness Uncovers 16 Windows CVEs, Including Four Critical RCE Flaws in TCP/IP, IKEv2, Netlogon, and DNS

> Microsoft's Multi-Model Agentic Scanning Harness (MDASH), a 100+ agent AI pipeline that discovers, debates, and proves Windows kernel/service vulnerabilities, surfaced 16 previously unknown CVEs across the April and May 2026 Patch Tuesdays, including four unauthenticated critical RCE flaws in tcpip.sys, ikeext.dll, netlogon.dll, and dnsapi.dll. The disclosures fed a record 200+ patched vulnerabilities in the June 2026 Patch Tuesday and preceded MDASH's transition into production across Windows, Azure, and identity engineering on June 17, 2026.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1184
- **ID:** TL-2026-1184
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33827, CVE-2026-33824, CVE-2026-41089, CVE-2026-41096

## Description

Microsoft's Security Response Center (MSRC) and Microsoft Research disclosed MDASH (Multi-Model Agentic Scanning Harness), an AI-driven vulnerability-discovery pipeline that orchestrates more than 100 specialized agents across an ensemble of frontier and distilled language models. MDASH runs a five-stage workflow: Prepare (builds language-aware code indices and threat models via commit analysis), Scan (auditor agents flag candidate vulnerabilities with supporting evidence), Validate (debater agents argue for and against exploitability and reachability), Dedupe (collapses semantically equivalent findings), and Prove (constructs and executes triggering inputs to confirm exploitability with a working proof-of-concept). The system uses a configurable model panel — a state-of-the-art model as the heavy reasoner, distilled models as cost-effective high-volume debaters, and a second independent SOTA model as a counterpoint — explicitly to avoid the blind spots of any single-model approach. Domain-specific plugins inject expertise the base models otherwise lack, such as Windows kernel calling conventions, lock invariants, and IPC trust boundaries.

Microsoft reported MDASH scored 88.45% on the CyberGym benchmark of 1,507 real-world vulnerabilities (the top score on the public leaderboard, ahead of Anthropic's Mythos Preview at 83.1% and OpenAI's GPT-5.5 at 81.8%), detected 21 of 21 planted vulnerabilities in an internal StorageDrive test with zero false positives, and demonstrated 96% historical recall against MSRC's known clfs.sys corpus (28 cases) and 100% recall against tcpip.sys (7 cases).

Applied against live Windows source, MDASH surfaced 16 previously unknown CVEs spanning the Windows networking and authentication stack — 10 kernel-mode and 6 user-mode vulnerabilities — the majority reachable from an unauthenticated network position. Four are rated CRITICAL remote code execution:

1. **CVE-2026-33827** (tcpip.sys, CVSS 3.1 8.1, CWE-362 Race Condition): an unsynchronized reference-count decrement in the Windows TCP/IP stack's handling of IPv4 packets carrying the Strict Source and Record Route (SSRR) option leads to a use-after-free. MDASH's own writeup notes the bug spans non-trivial control flow where 'the reference count might reach zero at the earlier release point,' a pattern difficult for single-model auditors lacking cross-file comparison. Published April 14, 2026.
2. **CVE-2026-33824** (ikeext.dll, CVSS 3.1 9.8, CWE-415 Double Free): an unauthenticated attacker who sends a crafted IKEv2 SA_INIT exchange with malformed fragmentation to a host with the IKE Extension service enabled (affecting RRAS VPN, DirectAccess, and Always-On VPN deployments) triggers a double-free spanning six source files; MDASH identified the flaw by contrasting the vulnerable path against a correctly implemented shallow-copy pattern elsewhere in the codebase. Published April 14, 2026.
3. **CVE-2026-41089** (netlogon.dll, CVSS 3.1 9.8, CWE-121 Stack-based Buffer Overflow): an unauthenticated CLDAP request with a crafted User= filter overflows a stack buffer in Netlogon, allowing remote code execution on a domain controller with no user interaction — assessed by researchers as wormable and the highest-urgency bug in the batch given that 'a compromised domain controller is a compromised domain.' Published May 12, 2026.
4. **CVE-2026-41096** (dnsapi.dll / Windows DNS Client, CVSS 3.1 9.8, CWE-122 Heap-based Buffer Overflow): a heap overflow triggered by a crafted UDP DNS response allows an attacker positioned to respond to DNS queries (rogue server or on-path/MitM) to achieve remote code execution on essentially any Windows host, since the DNS Client component runs on virtually every Windows machine. Published May 12, 2026.

The remaining 12 MDASH-discovered flaws are rated Important and span tcpip.sys, http.sys, ikeext.dll, and telnet.exe, covering denial-of-service, privilege-escalation, information-disclosure, and security-feature-bypass classes. All 16 CVEs were patched across Microsoft's April and May 2026 Patch Tuesday cycles. Microsoft framed the June 2026 record of 200+ patched vulnerabilities as partly attributable to MDASH's expanded scanning coverage, and moved MDASH from research project to production status on June 17, 2026, integrating it into Windows, Azure, and identity engineering workflows and extending Microsoft Defender integration to eligible enterprise customers in an expanded preview. No public evidence of in-the-wild exploitation of any of the four critical RCEs had been reported as of the reporting window; all four require only network reachability and no authentication or user interaction, making rapid patching the primary mitigation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1588 Obtain Capabilities
- T1587 Develop Capabilities
- T1190 Exploit Public-Facing Application
- T1210 Exploitation of Remote Services
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1499 Endpoint Denial of Service
- T1489 Service Stop

## Sources

- [Defense at AI speed: Microsoft's new multi-model agentic security system tops leading industry benchmark](https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-tops-leading-industry-benchmark/)
- [Microsoft Adopts AI-Powered Scanning to Find Vulnerabilities Before Attackers](https://cybersecuritynews.com/microsoft-adopts-ai-vulnerability-scanning/)
- [Microsoft's MDASH AI System Finds 16 Windows Flaws Fixed in Patch Tuesday](https://thehackernews.com/2026/05/microsofts-mdash-ai-system-finds-16.html)
- [Microsoft's new AI system finds 16 Windows flaws, including four critical RCEs](https://www.csoonline.com/article/4170785/microsofts-new-ai-system-finds-16-windows-flaws-including-four-critical-rces.html)
- [Microsoft expects more Windows security updates from AI-discovered flaws](https://www.bleepingcomputer.com/news/microsoft/microsoft-expects-more-windows-security-updates-from-ai-discovered-flaws/)
- [CVE-2026-33827 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-33827)
- [CVE-2026-33824 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-33824)
- [CVE-2026-41089 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-41089)
- [CVE-2026-41096 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-41096)
- [The May 2026 Security Update Review](https://www.thezdi.com/blog/2026/5/12/the-may-2026-security-update-review)
- [Microsoft MDASH in Production: AI Agents Are Finding Real Windows CVEs](https://byteiota.com/microsoft-mdash-in-production-ai-agents-are-finding-real-windows-cves/)
- [GitHub - securin-public/frontier-ai-cve-tracker: Tracking CVEs discovered by AI systems](https://github.com/securin-public/frontier-ai-cve-tracker)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1184