CVE-2026-68820

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Exploited in the wild. In CISA KEV since 2026‑08‑11. A vendor fix is available.

CVSS 3.17.0High EPSS percentile24th0.3% chance in 30 days CISA KEVListedsince 2026-08-11, due 2026-08-25
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-11Updated 2026-08-16Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check which Windows versions you run (Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025).
Verify whether each device is already at or above the fixed build for its version (see the exact fixed versions below).
Install the Microsoft updates covering CVE-2026-68820 on all affected devices as soon as possible.
If you cannot patch right away, follow the Microsoft guidance referenced from the CVE entry and reduce the chance of an attacker gaining the required access on that machine until patching is complete.
Confirm after patching that the OS build number matches the fixed version for that branch and keep the device updated going forward.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

In plain language

Written by AI from the record

CVE-2026-68820 is a Windows local privilege bug (a “use-after-free” issue) that has confirmed real-world exploitation, so typical small businesses should patch immediately on any affected Windows devices.

CVE-2026-68820 is a local privilege escalation vulnerability in the Windows Ancillary Function Driver for WinSock (CWE-416 “use-after-free”), with confirmed exploitation listed in CISA KEV; successful abuse requires an attacker to gain local/authorized access conditions before triggering the flaw.

If you're affected

Full admin privilege takeover
Complete control of the device
Malware installation and persistence
Loss of data confidentiality

What is it

Imagine a piece of Windows code that mistakenly keeps using a memory area it has already freed. If someone can reach the right local execution conditions, that mistake can be turned into a way to gain higher privileges—effectively moving from “normal user access” to “admin-level control.”

Who is affected

This matters if you run Windows 10, Windows 11, or Windows Server 2012/2012 R2/2016/2019/2022/2025 on business machines. Because this is real-world exploited and is listed in CISA KEV, you should treat any exposed or reachable devices you manage as candidates for compromise.

The known trigger requires an attacker to be “authorized” and to reach local access conditions—so it’s most relevant if an attacker can get onto the machine (for example via a compromised account, remote access, or another foothold), not just by scanning the network.

How urgent is it

This is RED because it’s confirmed in CISA KEV as exploited in the real world (added 2026-08-11). Since it enables privilege elevation, attackers who reach the required access conditions can quickly turn an initial foothold into full control.

What to do — in detail

Asset inventory and build check
- Identify every endpoint and server running: Windows 10, Windows 11, and Windows Server 2012/2012 R2/2016/2019/2022/2025.
- For each device, capture the current OS build number.
Determine whether each device is already fixed
- Compare each device’s current build to the fixed builds below for its edition/version branch:
  - Windows 10:
    - fixed in 10.0.14393.9418
    - fixed in 10.0.17763.9115
    - fixed in 10.0.19044.7663
    - fixed in 10.0.19045.7663
  - Windows 11:
    - fixed in 10.0.22631.7517
    - fixed in 10.0.26100.9168
    - fixed in 10.0.26200.9168
    - fixed in 10.0.28000.2704
  - Windows Server 2012:
    - fixed in 6.2.9200.26280
  - Windows Server 2012 R2:
    - fixed in 6.3.9600.23338
  - Windows Server 2016:
    - fixed in 10.0.14393.9418
  - Windows Server 2019:
    - fixed in 10.0.17763.9115
Patch rollout (priority ordering)
- Prioritize systems that are most likely to be reached by attackers (systems with remote access, business-critical servers, and devices with privileged accounts).
- Use Microsoft’s update guidance for CVE-2026-68820 from the MSRC Update Guide (linked in the findings).
- Apply updates and reboot as required.
Temporary containment if patching is delayed
- Follow Microsoft’s vendor remediation instructions from the CVE’s MSRC page.
- Reduce the risk of an attacker reaching the “authorized/local access” conditions required for exploitation by tightening access paths (especially remote access and account hygiene) until you can patch.
Post-patch verification
- Confirm each machine’s build number matches a fixed value listed above.
- Verify update installation logs indicate successful completion.
Follow CISA KEV expectations
- CISA remediation due date: 2026-08-25.
- Ensure your patching/mitigation workflow aligns with CISA guidance referenced in KEV (and the referenced CISA BOD 26-04 prioritization guidance).
What to monitor
- If you have security tooling, look for signs of attempted privilege escalation or unusual admin-level activity around the time of any incident.
- Treat any “unknown” local access events as potential precursors, given the real-world exploitation status.

Technical context

Severity is assessed as HIGH (CVSS 7 in the prompt) with a weakness of CWE-416 (use-after-free). Mechanism: the Windows Ancillary Function Driver for WinSock has a memory-lifetime flaw that can be triggered in local contexts where the attacker meets the “authorized attacker” requirement described in the backstop.

Exploitation status: confirmed real-world exploitation via CISA KEV (added 2026-08-11) with a CISA remediation due date of 2026-08-25; therefore this is treated as actively exploited rather than theoretical.

Exploit maturity: no public exploit code is recorded, but exploitation is still confirmed, indicating attacker capability exists without needing public PoC.

EPSS: not provided in the findings; do not rely on EPSS for decision-making here because KEV exploitation is confirmed.

KEV meaning: CISA KEV is the catalog of vulnerabilities known to be exploited or actively exploited; listing indicates defenders should prioritize remediation per CISA guidance.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS24th

CISA KEV

Listed as exploited in the wild since 2026-08-11.

US federal agencies must remediate by 2026-08-25.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.3% chance of exploitation activity in the next 30 days, which ranks it in the 24th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

13 events over 7 days, from the signal feeds we watch.

2026-08-18Analysis publishedLazarus Just Exploited the Same Windows Driver It Weaponized Two Years Ago
2026-08-16Patch availablerecord updated
2026-08-13OpenVAS check added
2026-08-12Patch availablerecord updated, record updated
2026-08-11Added to CISA KEVpublished, weakness classified, att&ck mapped, record updated, record updated

Affected products

Microsoftcommercial · US

And 25 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.0 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable