Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

🚨SEVERITY: HIGH — CVSS 7.0Security Advisory

TL;DR 📌

  • Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
  • Highest CVSS: 7.0 (High).
  • Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
  • Check the advisory for fixed releases — remediation detail is in the vendor link below.
  • CVEs: CVE-2026-68820.

What it is

CVE-2026-68820 is a use-after-free vulnerability in the Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver that underpins Windows socket operations. It sits on the local attack surface, not the network data plane: exploitation requires local access and low-privilege authentication on the target host.

The CVSS vector describes an attack of high complexity, requiring no user interaction, that needs low privileges to trigger. Because AFD.sys runs in kernel mode, a successful use-after-free exploit gives the attacker full control over confidentiality, integrity and availability on that host — in practice, a path from a low-privilege local account to elevated, likely SYSTEM-level, privileges.

This is a local privilege escalation bug, useful to an attacker who already has a foothold (via phishing, a separate remote exploit, or a compromised low-privilege account) and wants to escalate to full control of the machine.

The vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11, so it is known to be exploited in the wild.

What to do

  • Consult the Microsoft advisory for CVE-2026-68820 for the fixed build or update package; no fixed release is listed here, so check Microsoft’s update channels directly for the applicable patch.
  • Given its KEV listing, prioritise patching this over routine vulnerabilities, particularly on systems where local access is plausible (shared workstations, terminal servers, jump boxes, VDI hosts).
  • Treat detection of unexplained privilege escalation activity on Windows hosts as a signal to check patch status and investigate.
  • Ensure endpoint logging captures process creation and token elevation events, since exploitation manifests as unexpected privilege gain following an existing local foothold.
  • Review local account hygiene and least-privilege configurations, since the attacker’s entry point is a low-privileged local session — reducing standing local access reduces the exposure window pending patching.

For leadership 🧭

Executive summary. Risk is High (CVSS 7.0) across any Microsoft kit you run. Follow the remediation in the vendor advisory within Immediate — CISA KEV entries carry a federal remediation deadline.

Why it matters:

  • Exposure depends on deployment topology and which access paths reach the affected component.
  • Treat internet-facing and management-plane instances as higher risk than internal-only ones.
  • Keep monitoring for abnormal authentication and configuration events until upgrades complete.

Now / Next / Later:

  • Now: confirm whether you run the affected versions, and check exposure of any that are internet-facing.
  • Next: apply the remediation the advisory specifies, through an approved change window.
  • Later: add a control check so builds cannot drift back onto a vulnerable train.

Source