Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-68820 Published 2026-08-11 Updated 2 months ago Vendor/s Microsoft Product/s Windows Ancillary Function Driver for WinSock Version/s \* > 10.0.14393.9418 KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 7 / 10 High Severity Details Base score 7 High Attack vector Local Attack complexity High Privileges required Low User interaction None Scope Unchanged Confidentiality High Integrity High Availability High Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-68820 is a high-severity privilege escalation flaw in Windows AFD.sys actively exploited in the wild. Patch affected Windows systems immediately. ## Why this matters "This High-severity vulnerability (CVSS 7.0) is a critical concern because it is actively exploited in the wild, as evidenced by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. A use-after-free flaw in the Windows Ancillary Function Driver (AFD.sys) for WinSock allows a local attacker with low privileges to elevate their permissions to SYSTEM level. This provides a foothold for attackers to move laterally, disable security software, or deploy ransomware. Organizations running affected versions of Windows 10, 11, or Windows Server must prioritize this update to prevent full system compromise by local actors or secondary payloads." ## CPE Microsoft | Product | Version Start | Version End (excl.) | Status | | --------------------- | ------------- | ------------------- | ---------- | | windows\_10\_1607 | \* | 10.0.14393.9418 | vulnerable | | windows\_10\_1607 | \* | 10.0.14393.9418 | vulnerable | | windows\_10\_1809 | \* | 10.0.17763.9115 | vulnerable | | windows\_10\_1809 | \* | 10.0.17763.9115 | vulnerable | | windows\_10\_21h2 | \* | 10.0.19044.7663 | vulnerable | | windows\_10\_22h2 | \* | 10.0.19045.7663 | vulnerable | | windows\_11\_23h2 | \* | 10.0.22631.7517 | vulnerable | | windows\_11\_24h2 | \* | 10.0.26100.9106 | vulnerable | | windows\_11\_25h2 | \* | 10.0.26200.9106 | vulnerable | | windows\_11\_26h1 | \* | 10.0.28000.2704 | vulnerable | | windows\_server\_2012 | - | - | vulnerable | | windows\_server\_2012 | r2 | r2 | vulnerable | | windows\_server\_2016 | \* | 10.0.14393.9418 | vulnerable | | windows\_server\_2019 | \* | 10.0.17763.9115 | vulnerable | | windows\_server\_2022 | \* | 10.0.20348.5440 | vulnerable | | windows\_server\_2025 | \* | 10.0.26100.33222 | vulnerable | ## Related weakness (CWE) CWE-416 ## Remediation plan 1 ### Apply official patches Immediately install the latest security updates provided by Microsoft for the Windows Ancillary Function Driver (AFD.sys) via Windows Update, WSUS, or Microsoft Endpoint Configuration Manager. 2 ### Update affected systems Ensure all Windows 10, 11, and Windows Server instances are updated to versions exceeding the vulnerable thresholds, such as build 10.0.19045.7663 for Windows 10 22H2 or 10.0.26100.9106 for Windows 11 24H2. 3 ### Restrict access Enforce the principle of least privilege (PoLP) to limit local access. Since the attack vector is local, reducing the number of users with interactive login rights and implementing application whitelisting can mitigate the risk of exploit execution. 4 ### Monitor for exploitation Follow CISA’s BOD 26-04 guidance for forensic triage. Monitor for unusual kernel-mode driver activity, unexpected SYSTEM process creation from low-privilege accounts, and system crashes (BSOD) that may indicate exploit attempts. ## Detection Guidance "Detection should focus on identifying local privilege escalation attempts. Monitor Windows Event Logs for Event ID 4688 (Process Creation) involving suspicious tools or unexpected SYSTEM-level processes spawned from low-privilege accounts. Use EDR solutions to flag unusual memory access patterns or API calls targeting afd.sys. Additionally, watch for system instability or 'Blue Screen of Death' (BSOD) events that may indicate failed exploitation attempts of this use-after-free vulnerability." ## References [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820 Patch Vendor Advisory ](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-68820 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)