Microsoft MDASH Security AI Finds Windows Vulnerabilities

Introduction

Microsoft is pushing AI deeper into its internal security engineering with codename MDASH, a multi-model agentic scanning system designed to find and help remediate software vulnerabilities at enterprise scale. For IT and security leaders, the announcement matters because it shows how Microsoft is using AI not just for detection, but to shift vulnerability discovery earlier into the software development lifecycle.

What’s new with MDASH

Since its initial launch, Microsoft says MDASH is now being used in active engineering workflows across:

• Windows
• Azure core infrastructure
• Identity systems
• Hyper-V and the Windows kernel
• Active Directory Domain Services

Rather than acting as a standalone scanner, MDASH integrates into existing security and DevSecOps tools:

• GitHub Advanced Security for inline code scanning alerts and pull request visibility
• Azure DevOps for build gating and remediation work items
• Microsoft Defender for prioritization alongside threat intelligence and runtime signals

Microsoft also shared that the latest MDASH version reached 96.5% on the CyberGym benchmark for “any crash,” reflecting improvements in the early prepare and scan phases of the pipeline.

Vulnerabilities Microsoft says MDASH helped uncover

Microsoft highlighted multiple Patch Tuesday discoveries across critical Windows components, including:

• Hyper-V remote code execution flaws
• Windows kernel remote code execution vulnerabilities
• Active Directory Domain Services vulnerabilities
• HTTP.sys and Remote Desktop Client flaws
• DNS Client elevation of privilege issues
• DHCP Client information disclosure bugs

Several listed CVEs carry high severity scores, including CVE-2026-45657 and CVE-2026-47291, both rated 9.8 CVSS.

Why this matters for IT administrators

For security teams and administrators, the biggest takeaway is not just the benchmark score. It is that Microsoft is embedding AI-driven vulnerability discovery into the same pipelines developers already use, making findings more actionable and less likely to sit in backlogs.

This approach could improve:

• Faster identification of exploitable flaws before release
• Better prioritization of code-level security issues
• Tighter integration between development, security, and operations teams
• More proactive protection for platforms many enterprises depend on

Next steps

IT pros should:

1. Review this month’s Patch Tuesday updates, especially for Windows, Hyper-V, AD DS, and HTTP.sys.
2. Track Microsoft’s MDASH preview and related security tooling announcements.
3. Consider how AI-assisted code scanning and DevSecOps workflows could fit into internal application security programs.

Microsoft’s broader message is clear: security teams need to operate at AI speed, and vulnerability management is becoming more integrated, automated, and pipeline-driven.