CVE-2026-68820 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2026-08-11

Added to CISA KEV: 2026-08-11 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unusual privilege escalation, unexpected SYSTEM-level processes, and afd.sys crash/exploitation artifacts.
Apply the August 2026 Patch Tuesday updates immediately across all Windows client and server systems. CISA BOD 26-04 mandates prioritized remediation within 3-14 days.
Monitor for post-exploitation behavior: this LPE is typically chained after an initial remote access foothold (e.g., following an RCE or phishing-delivered payload). Harden initial access vectors and deploy EDR to detect privilege escalation attempts.
Patch priority: URGENT — despite LOCAL vector, active exploitation and SYSTEM-level impact make this a top remediation priority as a privilege-escalation link in attack chains.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-68820 is a high-severity use-after-free vulnerability located in the Windows Ancillary Function Driver for WinSock (`afd.sys`), a critical kernel-mode component responsible for networking operations. The vulnerability allows an authorized local attacker to manipulate kernel data structures, enabling them to execute arbitrary code or elevate their privileges to SYSTEM level. Because `afd.sys` is present on virtually all Windows systems, this flaw represents a significant risk for security compromise across the Windows ecosystem ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and is included in CISA’s Known Exploited Vulnerabilities (KEV) Catalog ^[1]^[4].
Threat Actors: While specific threat actor attribution may vary, its inclusion in the KEV catalog indicates usage in real-world malicious campaigns ^[1].
Proof-of-Concept: Public proof-of-concept (PoC) material and research-related repositories are available, which may be leveraged for further development of exploit tools ^[5].
Attack Prerequisites: Exploitation is local, meaning the attacker must already have authorized access to the system. It does not require user interaction, but authentication on the target machine is necessary ^[2]^[3].

Affected Products & Patches

Affected Products: The vulnerability affects the Windows Ancillary Function Driver for WinSock (`afd.sys`), impacting a broad range of supported Windows versions ^[1]^[6].
Patch Availability: Microsoft addressed this vulnerability as part of the August 2026 Patch Tuesday updates ^[4].
Mitigations: Organizations are advised to apply the security updates immediately. Due to its presence in the KEV catalog, CISA Binding Operational Directive (BOD) 26-04 mandates prioritized remediation within a short timeframe (ranging from 3 to 14 days) ^[1].

Impact

Access & Capability: Successful exploitation grants an attacker local privilege escalation, allowing them to gain elevated permissions—typically up to SYSTEM level—which provides full control over the compromised machine ^[2]^[4].
Business Risk: For internet-facing deployments, this vulnerability is critical because, if combined with a remote code execution (RCE) flaw, it can be used to escalate privileges after an initial breach, facilitating full system compromise, data theft, and long-term persistent access within the network ^[2].

Sources

CVE-2026-68820 Is in KEV. What BOD 26-04 Requires Now
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). It sits on every Windows ... Executive Summary CVE-2026-68820 is an actively exploited Windows vulnerability listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, with a remedia…
CVE-2026-68820 - Vulnerability Details - OpenCVE
Use‑after‑free in the Windows Ancillary Function Driver for WinSock allows a local attacker with authorization to gain higher privileges. The flaw occurs when the driver deallocates memory that remains referenced, enabling the attacker to manipulate kernel data structures to execute arbitrary code o…
NVD-CVE-2026-68820 - National Vulnerability Database
Description. Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-68820: Actively Exploited Windows Kernel Driver EoP ...
Microsoft's August 2026 Patch Tuesday fixes 398 flaws — including CVE-2026-68820, a Windows kernel socket driver bug already exploited in the wild for SYSTEM escalation. Patch now.
HORKimhab/CVE-2026-68820
Purpose. This repository is for educational and authorized security research only. It is designed to help users learn about: Security vulnerabilities; Sandbox ...

🟢 CVE-2026-68820