A critical use-after-free vulnerability, identified as CVE-2026-68820, in the Windows Ancillary Function Driver for WinSock (afd.sys) is currently under active exploitation and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability allows a low-privilege local attacker to escalate privileges to SYSTEM without requiring user interaction.
Microsoft released a fix for CVE-2026-68820 on August 11, 2026, as part of its cumulative updates. CISA added the vulnerability to its KEV Catalog on the same day, triggering remediation requirements under CISA Binding Operational Directive (BOD) 26-04.
BOD 26-04 mandates risk-based remediation timelines. For CVE-2026-68820, publicly exposed Windows systems, such as internet-facing servers, have a strict 3-day deadline, making their due date August 14, 2026. Internal or non-exposed Windows endpoints are subject to a 14-day deadline, with a due date of August 25, 2026.
The vulnerability resides in afd.sys, a kernel driver present on all Windows endpoints and accessible from any low-privilege account. An attacker with an existing foothold can execute a specially crafted application to exploit the race condition and achieve SYSTEM-level privileges. Microsoft has rated the vulnerability as "Important" with a CVSS score of 7.0.
The fix for CVE-2026-68820 is included in the August cumulative updates: KB5121003 for Windows 11 (bringing builds to 26200.9168 and 26100.9168) and KB5120249 for Windows 10 systems under Extended Security Updates. There is no known workaround for this vulnerability, as afd.sys cannot be disabled or firewalled.
A critical aspect of the remediation process is the requirement for a system reboot. Because the fix involves replacing a kernel driver, the vulnerable driver remains active and loaded in memory until the endpoint restarts. Consequently, simply installing the update does not complete the remediation; endpoints with the patch installed but a pending reboot remain fully exposed to exploitation.
Organizations are strongly advised to deploy the relevant patches, KB5121003 and KB5120249, immediately and ensure that all affected endpoints are rebooted to fully complete the remediation process and meet the CISA BOD 26-04 deadlines.
