CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Description
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
In plain language
AI Act nowCVE-2026-68820 is a Windows local privilege bug (a “use-after-free” issue) that has confirmed real-world exploitation, so typical small businesses should patch immediately on any affected Windows devices.
CVE-2026-68820 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (CWE-416 “use-after-free”), with confirmed exploitation listed in CISA KEV; successful abuse requires an attacker to gain local/authorized access conditions before triggering the flaw.
What to do now
- Check which Windows versions you run (Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025).
- Verify whether each device is already at or above the fixed build for its version (see the exact fixed versions below).
- Install the Microsoft updates covering CVE-2026-68820 on all affected devices as soon as possible.
- If you cannot patch right away, follow the Microsoft guidance referenced from the CVE entry and reduce the chance of an attacker gaining the required access on that machine until patching is complete.
- Confirm after patching that the OS build number matches the fixed version for that branch and keep the device updated going forward.
CVSS Vector Breakdown
AV:LAttack VectorAC:HAttack ComplexityPR:LPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:HAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- Microsoft Entra ID Flaw (CVSS 10.0) Exploited in Wild, Allows Remote Code Executionen·The Hacker News·
- CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Nowen-us·Qualys Security Blog· Exploited Windows privilege-escalation
- 17th August – Threat Intelligence Reporten-us·Check Point Research· Exploited Windows ransomware
- ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and Moreen·The Hacker News· Exploited Lazarus Group ransomware
- Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-dayen-us·Help Net Security· Exploited Salesforce data-breach
- Microsoft выпустила патчи более чем для 400 уязвимостейru-ru·Хакер (xakep.ru)· Exploited Windows Lazarus
- Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdooren·The Hacker News· Exploited Windows Lazarus Group
- Lazarus hackers exploited Windows zero-day to target defense firmsen-us·BleepingComputer· Exploited Windows Lazarus Group
- Lazarus hackers pair fake job offers with Windows zero-day exploiten-us·Help Net Security· Exploited Windows AFD.sys Lazarus Group
- Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)en-us·Help Net Security· Exploited Windows Lazarus Group
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-68820 and every CVE in our database. Create a free account — no credit card required.
Create Free Account