The CVE-2026-68820 vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) component is being actively exploited by attackers. According to the Microsoft advisory, this use-after-free bug allows an authenticated attacker to perform local privilege escalation. The vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog with a remediation due date of August 25, 2026 — this deadline has already passed. All organizations using Windows must ensure the corresponding update is installed.
Technical details
The vulnerability belongs to the use-after-free class — a memory management error where a program continues to access a memory area after it has been freed. In this case, the issue affects the afd.sys driver, a Windows system component that supports the WinSock network stack. To exploit it, an attacker needs local access to the system and an authenticated account, after which they can escalate their privileges.
The metadata of the Microsoft advisory contains the following flags: the vulnerability is marked as exploited, and the status for supported software versions is listed as “Exploitation Detected.” According to Microsoft, there was no public disclosure before the patch was released (Publicly Disclosed: No). An entry in the NVD is also available.
It should be noted that the provided data does not include a CVSS score, a list of affected Windows versions, or a severity rating according to Microsoft’s classification. Specific versions and configurations affected by the vulnerability must be clarified in the vendor’s full advisory.
Exploitation status and deadlines
CVE-2026-68820 was added to the CISA KEV catalog on August 11, 2026, with a remediation deadline of August 25, 2026. At this point, that deadline has passed, which means any organization subject to CISA requirements (primarily U.S. federal agencies, as well as organizations that treat KEV as a priority list) should already have deployed the fix. Systems without the patch are in a state of overdue risk.
Information on attack attribution, specific campaigns, indicators of compromise, or MITRE ATT&CK techniques used is not present in the available data. It is unknown which threat actors are exploiting the vulnerability and in what context — for initial foothold, lateral movement, or other objectives.
Context: afd.sys as a recurring target
The afd.sys driver is an attractive target for attackers: it runs in kernel mode, is present on all Windows installations, and handles network operations. Privilege escalation through a vulnerability in such a component allows an attacker who has already obtained initial access to the system (for example, via phishing or exploitation of a web application) to move from limited privileges to full control over the host. We have already analyzed this vulnerability in the context of the August 2026 Patch Tuesday, and also mentioned it in our piece on bypassing the Microsoft Defender patch.
Impact assessment
A privilege escalation vulnerability with confirmed exploitation poses a serious threat to any organization using Windows. The main risks are:
- Attack escalation: an attacker who has obtained initial access with limited rights can use CVE-2026-68820 to gain SYSTEM-level privileges, opening the way to full host compromise.
- Exploit chains: kernel privilege escalation vulnerabilities are often used in combination with remote code execution vulnerabilities, amplifying the overall impact of an attack.
- Broad attack surface: afd.sys is present in both server and client versions of Windows, potentially affecting infrastructures of any scale.
Recommendations
- Install the security update for CVE-2026-68820 from the Microsoft advisory. The CISA KEV deadline has expired — the patch must be applied immediately.
- Verify deployment status of the update on all Windows hosts in your infrastructure, including servers, workstations, and virtual machines.
- Strengthen monitoring of events related to privilege escalation: anomalous access to afd.sys, and the creation of SYSTEM-privileged processes from atypical contexts.
- Restrict local access: since exploitation requires authenticated local access, minimizing the number of accounts and enforcing the principle of least privilege reduces the likelihood of the vulnerability being used.
CVE-2026-68820 is a confirmed zero-day with active exploitation and an expired CISA KEV deadline. The absence of public attribution does not lower its priority: deploying the patch from the Microsoft advisory is a mandatory and urgent action for all Windows-based systems.
