CISA added CVE-2026-68820, a use-after-free privilege-escalation flaw in the Windows Ancillary Function Driver for WinSock, to the Known Exploited Vulnerabilities catalog on 2026-08-11.
What Is It
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock. Per Microsoft's description, the flaw "allows an authorized attacker to elevate privileges locally." It carries a CVSS 3.1 base score of 7.0 (HIGH), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, local attack vector, high attack complexity, low privileges required, no user interaction, with high impact to confidentiality, integrity, and availability.
Why It Matters
CISA's inclusion of this CVE in the KEV catalog on 2026-08-11 confirms it is being actively exploited. Known ransomware campaign use is listed as Unknown. No public reporting details how the flaw is being used in the observed activity. That said, the requirement for only low existing privileges and no user interaction fits the profile of a second-stage component, the kind of local escalation an intruder who already has a foothold would plausibly chain toward SYSTEM, so defenders should treat it as a post-compromise escalation risk pending further detail. The driver ships on effectively every supported Windows client and server build, so the exposed footprint is wide.
What's Vulnerable
Microsoft lists a broad affected range, patched at these build numbers:
- Windows 10 1607 / Server 2016; before 10.0.14393.9418
- Windows 10 1809 / Server 2019; before 10.0.17763.9115
- Windows 10 21H2 and 22H2; before 10.0.19044.7663 / 10.0.19045.7663
- Windows 11 23H2; before 10.0.22631.7517
- Windows 11 24H2 and 25H2; before 10.0.26100.9168 / 10.0.26200.9168
- Windows 11 26H1; before 10.0.28000.2704
- Windows Server 2012 / 2012 R2 (incl. Server Core), before 6.2.9200.26280 / 6.3.9600.23338
- Windows Server 2022; before 10.0.20348.5499
- Windows Server 2025 (incl. Server Core), before 10.0.26100.9168 (Server 2025 shares the 26100 servicing branch with Windows 11 24H2; confirm the exact revision against the MSRC advisory before validating patch state)
32-bit, x64, and ARM64 platforms are affected depending on the release.
Patch Status
Fixed builds are published by Microsoft; the NVD record was published 2026-08-11 and remains in "Undergoing Analysis." CISA's required action: apply mitigations per vendor instructions in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements," follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure. Due date: 2026-08-25.
Sources
- Microsoft Security Response Center advisory; https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820
- NVD, https://nvd.nist.gov/vuln/detail/CVE-2026-68820
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements; https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk