CVE-2026-68820
Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
Description
CVE-2026-68820 is a high-severity use-after-free vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock that allows an authorized attacker to elevate privileges locally. An attacker who already has low-level access to a Windows system can exploit this memory-corruption flaw to gain higher privileges, potentially reaching SYSTEM-level control of the affected host. The vulnerability affects a wide range of Microsoft Windows client and server releases, from Windows 10 and Windows Server 2012 through Windows 11 and Windows Server 2025. With a CVSS score of 7.0 and inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2026-68820 is an important local privilege escalation issue that administrators should patch promptly, as it is a common building block for post-compromise attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1607 | < 10.0.14393.9418 |
| microsoft | windows 10 1809 | < 10.0.17763.9115 |
| microsoft | windows 10 21h2 | < 10.0.19044.7663 |
| microsoft | windows 10 22h2 | < 10.0.19045.7663 |
| microsoft | windows 11 23h2 | < 10.0.22631.7517 |
| microsoft | windows 11 24h2 | < 10.0.26100.9106 |
| microsoft | windows 11 25h2 | < 10.0.26200.9106 |
| microsoft | windows 11 26h1 | < 10.0.28000.2704 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.9418 |
| microsoft | windows server 2019 | < 10.0.17763.9115 |
| microsoft | windows server 2022 | < 10.0.20348.5440 |
| microsoft | windows server 2025 | < 10.0.26100.33222 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use after free occurs when software continues to use a pointer after the memory it references has been freed, allowing corruption, information disclosure, or code execution. In CVE-2026-68820, this weakness in the Windows AFD for WinSock lets a locally authorized attacker manipulate freed kernel memory to escalate privileges.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2026-68820 is rated High with a CVSS score of 7.0. The attack vector is local, so the attacker must already have access to the target system rather than exploiting it purely over the network. The attack complexity is high, meaning successful exploitation depends on specific conditions such as winning a race or grooming the heap, and low privileges are required, so the attacker needs an existing foothold — for example a standard user account. No user interaction is required. When exploited, the impact is severe across all three dimensions — high confidentiality, integrity, and availability impact — because privilege escalation to a higher, potentially SYSTEM-level context lets the attacker read protected data, tamper with the system, and disrupt operations. The EPSS score is low at roughly 0.3% (26th percentile), reflecting the local access requirement and higher complexity, but the KEV listing confirms that this escalation path is being used in real attacks, typically as a second stage after initial access.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-68820 by adding it to the Known Exploited Vulnerabilities catalog, so despite its local nature this should be treated as an in-the-wild threat and patched promptly. The EPSS score of roughly 0.3% (26th percentile) is comparatively low, which reflects the requirements for local access and high attack complexity rather than a lack of danger; local privilege-escalation flaws like this are frequently used after an attacker has already gained a foothold. No dedicated public exploit link is listed among the references beyond the Microsoft vendor advisory, and the KEV ransomware flag is currently "Unknown." Given the confirmed exploitation, defenders should assume working exploitation techniques exist and prioritize patching multi-user and exposed systems.
Remediation
- Apply the Microsoft security update for your Windows version. Per CISA's KEV required action, apply mitigations in accordance with vendor instructions and BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the affected product.
- Install the fixed build for your specific edition, for example Windows 11 24H2 build 10.0.26100.9106, Windows Server 2025 build 10.0.26100.33222, Windows Server 2022 build 10.0.20348.5440, or the corresponding patched build for Windows 10 and Server 2016/2019 (and the relevant update for Windows Server 2012/2012 R2).
- Reduce local attack surface by enforcing least-privilege access, limiting which users can run untrusted code, and applying application allowlisting so that an attacker cannot easily obtain the low-privilege foothold needed to trigger the flaw.
- Monitor endpoints for privilege-escalation indicators, reviewing EDR and system telemetry for unusual token manipulation, kernel crashes, or suspicious child processes spawned with elevated privileges.
- Prioritize patching of internet-exposed and multi-user systems where an attacker who gains initial access could chain this local escalation to achieve full control.
Technical Details
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock, the kernel-mode driver that underpins Windows sockets. When a pointer continues to reference kernel memory that has already been freed, an attacker can arrange for attacker-controlled data to occupy that freed allocation, so that the subsequent dereference operates on data of the attacker's choosing. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the flaw is exploited locally, requires low privileges and no user interaction, and carries high complexity — consistent with a memory-corruption bug that needs heap grooming or race-condition timing to reliably control the freed memory. Because AFD runs in kernel context, successful exploitation can escalate a low-privileged user to a higher privilege level, giving the attacker control over the system with high confidentiality, integrity, and availability impact.
Frequently Asked Questions
Is CVE-2026-68820 being actively exploited?
Yes. CVE-2026-68820 is listed in CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Its EPSS score is low at around 0.3%, which reflects the local access and high-complexity requirements rather than reduced risk, since it is typically used as a post-access escalation step.
What products are affected by CVE-2026-68820?
The vulnerability affects the Windows Ancillary Function Driver for WinSock across a wide range of Microsoft Windows releases, including Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. Each edition is fixed in a specific patched build published by Microsoft.
How do I fix CVE-2026-68820?
Apply Microsoft's security update for your Windows version to reach the fixed build, following CISA's KEV guidance under BOD 26-04. Additionally, enforce least-privilege access and application allowlisting to make it harder for an attacker to obtain the low-privilege foothold needed to exploit the flaw.
How severe is CVE-2026-68820?
It is rated High with a CVSS 3.1 score of 7.0. Exploitation requires local access, low privileges, and high attack complexity, but no user interaction, and results in high impact to confidentiality, integrity, and availability through privilege escalation. Its EPSS score sits around the 26th percentile, but the KEV listing confirms real-world exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.