Patch Forecast
Red warning
Act within 24 hours. CISA deadline for US federal agencies: 25 Aug 2026.

CVE-2026-68820 Exploited in the wild

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Risk score
80/100
CVSS
7.0 v3.1
Published
11 Aug 2026
Added to CISA's exploited list
11 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Affected
Microsoft Windows Ancillary Function Driver For Winsock
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploited in the wild

Story map

Story map: Microsoft Windows Ancillary Function Driver For WinsockTHE FLAWSTHE FIXCVE-2026-68820Microsoft Windows AncillaryFunction Driver for WinSockUse-After-Free VulnerabilityCVSS 7.0 · exploitedFixApply the vendor's securityupdate; see the linked advisory.Who is exposedMicrosoft Windows AncillaryFunction Driver For WinsockRED · ACT TODAYMicrosoftWindows…Use after free in WindowsAncillary Function Driver forWinSock allows an authorizedattacker to elevate privilegeslocally.Where it standsExploited in the wildOn CISA's exploited list since 11 AugUS federal deadline 25 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.11 Aug · CISAAdded to the Known Exploited Vulnerabilities list25 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessUse-after-free (CWE-416)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft Windows Ancillary Function Driver For Winsock: Red, act today. Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

The flaws

  • CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability (CVSS 7.0 · exploited)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Microsoft Windows Ancillary Function Driver For Winsock

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 11 Aug
  • US federal deadline 25 Aug

How it unfolded

  1. 11 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 25 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Red

  • CVSS 7.0 high
  • Exploited in the wild (CISA KEV)
  • On your watchlist: windows server
  • Exploited in the wild in something on your watchlist: Red regardless of score

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Last activity 11 Aug 2026. Patch Forecast updates every hour.