Vulnerable third-party modem drivers exploited to gain admin privileges. Microsoft has removed agrsm64.sys and agrsm.sys in January 2026 update.