{"id":"CVE-2026-68820","kind":"vulnerability","aliases":["CVE-2026-68820"],"related":[],"title":"Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges…","description":"Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Use-after-free (race) in afd.sys lets a local low-privilege user reach SYSTEM. Microsoft marks it Exploitation Detected. KernelSight reports Lazarus used it as a zero-day (Operation Dream Job, deploying FudModule v3.1) for about five weeks before the 11 Aug 2026 patch. It needs a foothold first and cannot be reached remotely. No public PoC.","severity":"high","cvss":7.0,"epss":null,"exploited":true,"exploited_at":"2026-08-11T00:00:00+00:00","products":[{"name":"Microsoft Windows Ancillary Function Driver for WinSock","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Windows Ancillary Function Driver for WinSock (afd.sys)","fixed":["26100.9168","26200.9168","28000.2704","22631.7517","19044.7663","19045.7663","17763.9121","14393.9418","20348.5499","6.3.9600.23338","6.2.9200.26280"],"affected":"Windows builds below fixed build: 26100 < 26100.9168; 26200 < 26200.9168; 28000 < 28000.2704; 22631 < 22631.7517; 19044/19045 < 19044.7663/19045.7663; 17763 < 17763.9121; 14393 < 14393.9418; 20348 < 20348.5499; 6.3.9600 < 6.3.9600.23338; 6.2.9200 < 6.2.9200.26280","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.9418"],"affected":"< 10.0.14393.9418","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.9115"],"affected":"< 10.0.17763.9115","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.7663"],"affected":"< 10.0.19044.7663","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.7663"],"affected":"< 10.0.19045.7663","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.7517"],"affected":"< 10.0.22631.7517","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.9106"],"affected":"< 10.0.26100.9106","ecosystem":"vendor"},{"name":"microsoft windows 11 25h2","fixed":["10.0.26200.9106"],"affected":"< 10.0.26200.9106","ecosystem":"vendor"},{"name":"microsoft windows 11 26h1","fixed":["10.0.28000.2704"],"affected":"< 10.0.28000.2704","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.9418"],"affected":"< 10.0.14393.9418","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.9115"],"affected":"< 10.0.17763.9115","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.5440"],"affected":"< 10.0.20348.5440","ecosystem":"vendor"},{"name":"microsoft windows server 2025","fixed":["10.0.26100.33222"],"affected":"< 10.0.26100.33222","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","lazarus","local-privilege-escalation","microsoft-windows","other","self-hosted","windows"],"not_affected_if":["non-windows","patched-aug-2026"],"how_to_check":"Check the OS build with winver or [System.Environment]::OSVersion. Any build below the fixed build for your branch is exposed (e.g. 26100 < 26100.9168, 26200 < 26200.9168, 22631 < 22631.7517, 19045 < 19045.7663, 17763 < 17763.9121). Reboot after patching, because the old driver stays loaded until then. Inventory by build number, not by update status. Detection (KernelSight): bulk ETW provider loss, security-product kernel callbacks disappearing, NT Kernel Logger stopping.","fix":"Install the August 2026 (or later) cumulative update. Windows 11 24H2/25H2: KB5121003 (26100.9168 / 26200.9168). Other fixed builds: 10.0.28000.2704, 10.0.22631.7517, 10.0.19044.7663 and 10.0.19045.7663, 10.0.17763.9121, 10.0.14393.9418, 10.0.20348.5499, 6.3.9600.23338, 6.2.9200.26280. Then reboot.","status":"open","published_at":"2026-08-11T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:59+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T20:31:59Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for CVE-2026-68820 per CISA BOD 26-04 guidance; the specific patched build is unknown from the sources.","summary":"A use-after-free bug in the Windows Ancillary Function Driver for WinSock (afd.sys) lets an authorized local user elevate privileges. CISA lists it as actively exploited in the wild.","category":"other","who_cares":["windows","microsoft-windows","self-hosted"],"confidence":0.6,"analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-68820 to get affected builds, patch KB and any detection guidance; the KEV entry gives no fixed versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["non-windows"],"severity_if_unknown":"high"},"cost_usd":0.000369,"input_tokens":2239,"output_tokens":291,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-68820 to get affected builds, patch KB and any detection guidance; the KEV entry gives no fixed versions.","search":"'-04':208C,234C,265C '-2026':19A,22A '-68820':20A,23A '10':40A,44A,48A,52A '11':56A,60A,64A,68A,151B '1607':41A '1809':45A '2012':73A,77A '2016':81A '2019':85A '2022':89A '2025':93A '2026':153B '21h2':49A '22h2':53A '23h2':57A '24h2':61A '25h2':65A '26':207C,233C,264C '26h1':69A 'accord':197C 'action':193C 'adher':261C 'afd.sys':37A,114B 'allow':11A,183C 'ancillari':6A,170C 'ancillary':26A,32A 'appli':194C 'applic':231C 'asset':255C 'attack':14A,186C 'aug':152B 'author':13A,185C 'base':212C 'bod':206C,232C,263C 'cannot':161B 'cisa':191C,204C,221C 'cloud':237C 'complianc':202C 'contain':175C 'cve':18A,21A 'day':138B 'deploy':142B 'detect':128B 'discontinu':240C 'dream':140B 'driver':8A,28A,34A,172C 'elev':16A,188C 'ensur':201C,260C 'escal':99B 'evalu':253C 'exploit':94B,127B 'exposur':258C 'first':159B 'five':147B 'follow':230C 'foothold':158B 'for':29A,35A 'forens':223C 'free':3A,111B,180C 'fudmodul':143B 'function':7A,27A,33A,171C 'guidanc':219C,235C 'guidelin':267C 'host':106B 'instruct':200C 'internet':257C 'job':141B 'kernelsight':129B 'lazarus':95B,131B 'let':115B 'local':97B,117B,190C 'local-privilege-escal':96B 'low':119B 'low-privileg':118B 'mark':125B 'microsoft':24A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,86A,90A,101B,124B,168C 'microsoft-window':100B 'mitig':195C,246C 'need':156B 'note':218C,229C 'oper':139B 'patch':154B,266C 'poc':167B 'priorit':209C 'privileg':17A,98B,120B,189C 'product':244C 'public':166B 'race':112B 'reach':122B,163B 'remot':164B 'report':130B 'requir':192C,225C 'respons':251C 'risk':214C 'secur':210C 'see':215C,226C 'self':105B 'self-host':104B 'server':72A,76A,80A,84A,88A,92A 'servic':238C 'stakehold':249C 'system':123B 'triag':224C 'unavail':248C 'updat':211C 'url':216C,227C 'use':1A,109B,132B,178C,241C 'use-after-fre':108B,177C 'user':121B 'v3.1':144B 'vendor':199C 'vulner':181C 'week':148B 'window':5A,102B,107B,169C 'windows':25A,31A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A,87A,91A 'winsock':10A,30A,36A,174C 'zero':137B 'zero-day':136B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-08-11T00:00:00+00:00","kev":{"dateAdded":"2026-08-11","dueDate":"2026-08-25","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-68820","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-68820","severity":null,"published_at":"2026-08-11T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-68820:132","url":null,"severity":null,"published_at":"2026-10-23T21:41:23+00:00","modified_at":"2026-10-23T21:41:23+00:00","first_seen_at":"2026-10-23T21:41:23+00:00","fetched_at":"2026-10-23T21:41:23+00:00","note":"MSRC advisory (released 2026-08-11) plus CVE.org build list: exploited zero-day, no public PoC. KernelSight reports Lazarus use and KB5121003 for 24H2/25H2; I didn't check that against Microsoft's KB or Check Point. CVE.org lists some builds twice, so the per-SKU mapping is approximate."},{"source":"nvd","external_id":"CVE-2026-68820","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68820","severity":null,"published_at":"2026-08-11T17:19:06+00:00","modified_at":"2026-08-16T19:17:24+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[{"id":1194,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820","title":"MSRC: Windows Ancillary Function Driver for WinSock EoP (CVE-2026-68820)","kind":"advisory","source":"analyst","text":"Released Aug 11, 2026. CWE-416 UAF, local EoP, CVSS 3.1 7.0 (Important). Publicly disclosed: No. Exploited: Yes (Exploitation Detected).","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1196,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68820","title":"CVE record CVE-2026-68820 (CNA Microsoft) fixed builds","kind":"advisory","source":"analyst","text":"Affected before: 10.0.14393.9418, 10.0.17763.9121, 10.0.19044.7663, 10.0.19045.7663, 10.0.22631.7517, 10.0.26100.9168, 10.0.26200.9168, 10.0.28000.2704, 10.0.20348.5499, 6.2.9200.26280, 6.3.9600.23338, 10.0.26100.33296 (Server 2025 line, as listed).","published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1198,"url":"https://splintersfury.github.io/KernelSight/case-studies/CVE-2026-68820/","title":"KernelSight: CVE-2026-68820 case study","kind":"blog","source":"analyst","text":"Used as zero-day by Lazarus (Operation Dream Job) ~5 weeks before Aug 2026 patch to deploy FudModule v3.1. Fixed 26100.9168/26200.9168 via KB5121003 (11 Aug 2026). No public PoC or internals. Reboot needed; inventory by build number. Detection: bulk ETW provider loss, callback removal, NT Kernel Logger stop.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}