Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
TL;DR 📌
- Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- Highest CVSS: 7.0 (High).
- Listed in CISA KEV (2026-08-11) — this is being exploited in the wild.
- Fixed in
10.0.14393.9418,10.0.17763.9115,10.0.19044.7663,10.0.19045.7663— upgrade to this release or later. - CVEs: CVE-2026-68820.
What it is
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), the kernel-mode driver that underpins the Windows Sockets API. It’s a local privilege escalation flaw: an attacker needs to already have code execution on the target as a low-privileged, authorised user (CVSS vector shows AV:L, PR:L). There’s no network access path here and no user interaction required beyond that initial local foothold.
The use-after-free sits in kernel space, so successful exploitation gives an attacker full compromise of confidentiality, integrity and availability on the host (CVSS 7.0, C:H/I:H/A:H) — in practice, a route from standard user to SYSTEM. AC:H (high attack complexity) suggests exploitation isn’t trivial to line up, but the impact if it succeeds is total.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-08-11, so it is known to be exploited. It fits a familiar pattern for AFD.sys: a low-severity-looking local bug that becomes a high-value second stage once an attacker has any kind of initial access, including via phishing, a web-facing exploit, or a compromised low-privilege account.
What to do
- Patch to the fixed build listed for your Windows version: 10.0.14393.9418, 10.0.17763.9115, 10.0.19044.7663, 10.0.19045.7663, 10.0.20348.5440, 10.0.22631.7517, 10.0.26100.9106, 10.0.26100.33222, 10.0.26200.9106, or 10.0.28000.2704, depending on which release you run.
- Given the KEV listing, treat this as a priority patch even though remote reach isn’t possible — it’s the escalation step that turns a minor foothold into full SYSTEM control.
- Prioritise systems where local access is more likely to occur unnoticed: shared workstations, terminal/RDS servers, jump boxes, and any host exposed to untrusted local users or code (e.g. via browser exploits or malicious downloads).
- Check patch status through your usual Windows Update or WSUS/SCCM reporting rather than assuming coverage, since AFD.sys fixes ship per Windows build and version drift is common across fleets.
- No workaround is indicated in the advisory; treat the update as the only mitigation.
For leadership 🧭
Executive summary. An actively exploited flaw in a core Windows networking driver lets anyone with basic local access on a machine take full control of it, turning minor footholds—phishing, a compromised account, a browser exploit—into complete system compromise. Because it’s already in CISA’s exploited list, patching should be treated as urgent rather than routine.
Why it matters:
- The flaw is in AFD.sys, the kernel driver behind Windows Sockets, so exploitation grants full SYSTEM-level control rather than partial access
- No network exposure is needed—an attacker only needs existing local, low-privileged code execution, which is common after phishing or a browser exploit
- CISA’s KEV listing confirms this is being actively exploited, not just theoretical
- Shared workstations, terminal/RDS servers and jump boxes carry higher risk since multiple users or untrusted code paths increase the chance of an initial local foothold being available
Now / Next / Later:
- Now: Check which Windows builds are running across the fleet and confirm exposure against the affected version list before assuming patch coverage.
- Next: Roll out the fixed build for each Windows version in the next patch cycle, prioritising shared workstations, RDS/terminal servers and jump boxes.
- Later: Add AFD.sys and kernel driver fixes to routine WSUS/SCCM patch verification so per-build version drift doesn’t leave hosts unpatched after future advisories.