CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CSIRTS triage
- What
- Use-after-free in Windows Ancillary Function Driver for WinSock allows local privilege elevation by an authorized attacker.
- Who is affected
- Windows systems where users have local access and the vulnerable driver is present.
- Urgency
- High priority; actively exploited with CVSS 7 score.
- Action
- Install Windows security patches addressing CVE-2026-68820.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Windows Ancillary Function Driver for WinSock
Get an email when a new Windows Ancillary Function Driver for WinSock advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-68820Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 26% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-68820 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedMicrosoft Monthly Security Update (August 2026)hkcert
- unknownexploitedSecurity Alert: Microsoft Releases August 2026 Security Updatesjpcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (August 12, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0284 [1.00] [M/H] Vulnerabilities patched in Microsoft Windowsncsc-nl
- highexploitedCVE-2026-68820: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker …nvd
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabilitycisa-kev
More from Microsoft Security Response Center
- highCVE-2026-70354: .NET Core Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-68792: Microsoft Office Elevation of Privilege Vulnerability2026-08-11
- highCVE-2026-64909: Microsoft Office Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-70130: Microsoft Office Remote Code Execution Vulnerability2026-08-11
- highCVE-2026-66807: Microsoft Office Graphics Component Remote Code Execution Vulnerability2026-08-11