CVE-2026-68820
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 11, 2026
- US federal agencies must remediate it by Aug 25, 2026 (BOD 22-01)
- Attacked 1 day before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 17, 2026 Sep 8, 2026 Sep 3, 2026 Sep 3, 2026 Sep 2, 2026 Aug 21, 2026
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9418 |
| microsoft | windows 10 1809 | < 10.0.17763.9115 |
| microsoft | windows 10 21h2 | < 10.0.19044.7663 |
| microsoft | windows 10 22h2 | < 10.0.19045.7663 |
| microsoft | windows 11 23h2 | < 10.0.22631.7517 |
| microsoft | windows 11 24h2 | < 10.0.26100.9106 |
| microsoft | windows 11 25h2 | < 10.0.26200.9106 |
| microsoft | windows 11 26h1 | < 10.0.28000.2704 |
| microsoft | windows server 2012 | - |
| microsoft | windows server 2016 | < 10.0.14393.9418 |
| microsoft | windows server 2019 | < 10.0.17763.9115 |
| microsoft | windows server 2022 | < 10.0.20348.5440 |
| microsoft | windows server 2025 | < 10.0.26100.33222 |
Related articles
VulnerabilitiesMicrosoft Fixes 421 Vulnerabilities, Including an Exploited Zero-Day in `afd.sys`
On August 11, 2026, Microsoft released security updates addressing 421 vulnerabilities. One of them is CVE-2026-68820 , a high-severity flaw actively
VulnerabilitiesCISA Adds Three Exploited Vulnerabilities to the KEV Catalog
CISA adds three exploited vulnerabilities to KEV catalog: CVEs in Cisco ASA/FTD, Windows, and Metabase. Organizations must prioritize remediation.
VulnerabilitiesShieldBreak: PoC Bypasses Microsoft Defender Patch and Targets SYSTEM Privileges
ShieldBreak PoC bypasses MS Defender patch for CVE-2026-50656, granting SYSTEM access. Tested on Win11 25H2 & Server 2025. Update systems promptly.
APTLazarus Exploits a Windows Zero-Day in a Fake Job Offer Campaign
Lazarus group exploits Windows zero-day in fake job campaign targeting defense. Microsoft patched CVE-2026-68820; update now.
APTLazarus Exploits a Windows Zero-Day to Gain SYSTEM Privileges
Check Point Research attributes a cyber-espionage campaign targeting defense and aerospace companies in France, Germany, Brazil, and India to the Lazarus
VulnerabilitiesFour Critical Vulnerabilities Exploited Against macOS, SharePoint, VMware vCenter, and Windows
CISA has added four actively exploited critical vulnerabilities to its Known Exploited Vulnerabilities KEV catalog. The flaws affect Apple macOS,
VulnerabilitiesCVE-2026-69836: Critical Vulnerability Exploited in Microsoft Entra ID, but Customers Need Take No Action
Microsoft fixes critical CVE-2026-69836 in Entra ID, fully mitigated. No patches needed. Exploited in attacks but resolved.
VulnerabilitiesBTR Reforged: Microsoft Defender’s Driver Can Be Weaponized Against Windows Security
BTR Reforged: Abusing Defender's driver to bypass Windows security. Requires admin access, affects Windows 7-11. Presented at Black Hat 2026.
VulnerabilitiesAmazon Kiro: a prompt injection exfiltrates data from the workspace with a single message
Researchers reveal a prompt injection flaw in Amazon Kiro that exfiltrates workspace data via a single message. Affects IDE versions, patched in update.
VulnerabilitiesGit Turned into a Trap: Seven AI Agents Can Execute Code from Repositories
Seven AI coding agents execute attacker code via malicious Git core.fsmonitor config when auto-running git status, bypassing trust and sandbox controls.
VulnerabilitiesFalconFlank: PoC Released for Privilege Escalation in CrowdStrike Falcon
FalconFlank PoC targets CrowdStrike Falcon Sensor privilege escalation via Office macro remediation on Windows 11 25H2 and Server 2025. No CVE yet.
VulnerabilitiesMicrosoft Fixes 398 Vulnerabilities as Exploited Windows Kernel Flaw Enters CISA KEV
Microsoft patched 398 vulnerabilities, including exploited Windows kernel flaw CVE-2026-68820 now in CISA KEV. Patch immediately.
VulnerabilitiesMicrosoft Patches 966 Flaws as Two Windows Zero-Days Come Under Active Attack
Microsoft fixed 966 flaws in record September Patch Tuesday, including two exploited Windows privilege-escalation zero-days leading to SYSTEM access.
VulnerabilitiesMicrosoft Defender ShieldCrash PoC Claims to Bypass the ShieldBreak Fix
New ShieldCrash PoC allegedly bypasses Microsoft's ShieldBreak fix (CVE-2026-69414), enabling SYSTEM file read via Defender engine.
APTBlueMoon Exploit Kit Gives Four Espionage Groups a Shared Chrome-to-Windows Attack Chain
Four espionage groups use BlueMoon exploit kit chaining Chrome V8 flaws and Windows ALPC bug to escape sandbox and deploy payloads.
VulnerabilitiesShieldCrash PoC Claims to Bypass Microsoft’s Fix for Defender Privilege Flaw
ShieldCrash PoC claims bypass of Microsoft's fix for CVE-2026-69414, enabling SYSTEM-level file reads on patched Windows via Defender.
AIAI-Orchestrated PaperCut Campaign Compromises 395 Organizations Worldwide
AI agents exploited PaperCut flaws to compromise 395 organizations in 48 countries, escalating from RCE to domain admin in minutes.
APTChina-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs
China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.
VulnerabilitiesAzure AI Foundry Authentication Failure Earns Maximum-Severity CVSS Rating
Microsoft mitigated CVE-2026-85889, a CVSS 10.0 auth flaw in Azure AI Foundry allowing remote privilege escalation, plus Copilot and Azure bugs.
VulnerabilitiesMicrosoft’s 974-Fix Security Release Forces a Triage Test for Windows Defenders
Microsoft patched 974 flaws in September, including two exploited privilege-escalation bugs and two 9.8-rated RCEs requiring urgent triage.
VulnerabilitiesSharePoint Code-Injection Flaw Opens a Low-Privilege Route to Remote Server Control
CVE-2026-65660 lets low-privilege users run code on SharePoint Server via SafeControls bypass. Learn impact, affected versions and patch steps.
This product uses the NVD API but is not endorsed or certified by the NVD.