LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
cve recordhighexploited in the wildzero day3 of 3 cataloguesexploit reported

CVE-2026-68820

Microsoft · Windows Ancillary Function Driver for WinSock · Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Published · Added to CISA KEV
CVSS7
Severityhigh
WeaknessCWE-416
EPSS0.33%25.0th percentile
Exploited3 KEV sources
Ransomware useUnknown
Federal fix dueAug 25, 2026

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

patch window

Called exploited the same day it was disclosed.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

  1. CVE published
  2. First KEV listingsame day
  3. Last sighting23d

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

Sources3 of 3
Listings differ by0 d
Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

13 public reports collected from VulnCheck and CIRCL, first on Aug 11, 2026. Each links to its original source. We have not verified them.

Description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

← Back to the CVE Tracker

Our coverage of CVE-2026-68820

CVE-2026-68820high

CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now

A critical use-after-free vulnerability, identified as CVE-2026-68820, in the Windows Ancillary Function Driver for WinSock (afd.sys) is currently under active exploitation and has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability allows a low-privilege local attacker to escalate privileges to SYSTEM without requiring user interaction.

CVE-2026-68820high

17th August – Threat Intelligence Report

Several organizations across various sectors have recently reported cyberattacks and data breaches, while security researchers have detailed new vulnerabilities and emerging threat trends, including the use of AI in cyberespionage.

CVE-2026-20349critical

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to address them promptly. The newly cataloged flaws include a critical SQL injection vulnerability in Metabase, a use-after-free flaw in Microsoft Windows' Ancillary Function Driver for WinSock, and a heap…

CVE-2026-68820high

Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor

A recent report indicates that the Lazarus Group, a North Korean state-sponsored hacking collective, has been exploiting a Windows zero-day vulnerability to achieve SYSTEM-level access and deploy a new backdoor. This activity is part of a broader cyber espionage campaign known as Operation Dream Job. The campaign specifically targets defense and aerospace companies across several countries.

CVE-2026-68820

Lazarus hackers exploited Windows zero-day to target defense firms

North Korean state-sponsored hackers, identified as the Lazarus Group, have been exploiting a Windows zero-day vulnerability, designated CVE-2026-68820, as part of their ongoing Operation Dream Job campaign. The vulnerability, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), allows for local privilege escalation. Microsoft confirmed the active exploitation…

CVE-2026-68820

Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Microsoft has reportedly issued its monthly security updates, addressing a substantial number of vulnerabilities, including a Windows kernel driver zero-day that is actively being exploited in the wild. This critical flaw is said to be present in a core Windows kernel driver responsible for managing network socket operations. The update package reportedly includes patches for 398 distinct…