CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys) that lets an already-authenticated local attacker elevate privileges to SYSTEM, and Microsoft's own Exploitability Index flags it as "Exploitation Detected" at the time of the August 2026 Patch Tuesday release.
Vulnerability summary
7
High
8.6%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-08-11
Published
Vulnerability ID: CVE-2026-68820 · Source: Microsoft MSRC (not NVD-confirmed)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Microsoft Windows 10 / Windows 11 (client) | cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* | Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 26H1 — fixed by the August 2026 cumulative update |
| Microsoft Windows Server | cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* | Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 — fixed by the August 2026 cumulative update |
What this means
CVE-2026-68820 is a CWE-416 (Use After Free) vulnerability in the Windows Ancillary Function Driver for WinSock, the kernel-mode driver (AFD.sys) that backs the Winsock networking API. NVD's description states: "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally" (NVD).
NVD lists only a Secondary CVSS v3.1 score from source [email protected]: base score 7.0 (high), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — local attack vector, high attack complexity, low privileges required, no user interaction. NVD's status is "Analyzed," with no NVD Primary metric published, so this score is labelled not NVD-confirmed on this page (NVD).
Microsoft shipped the fix as part of the August 2026 Patch Tuesday release (Security Update Guide, 2026-Aug release notes), affecting the Windows 10 and Windows 11 client builds and Windows Server versions listed above; Microsoft's Exploitability Index for this release marked CVE-2026-68820 as "Exploitation Detected," meaning Microsoft had direct evidence of in-the-wild use at disclosure time (Microsoft Security Update Guide — August 2026).
CISA added CVE-2026-68820 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-11, the same day as Microsoft's disclosure, with a required-action due date of 2026-08-25, confirmed present in the live KEV catalog's CVE-filtered view this run (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.08567 (95.064th percentile) — notably elevated for a local-only elevation-of-privilege bug, consistent with its value as a reliable second-stage payload once an attacker already has a foothold on a Windows host (FIRST EPSS).
Because this is a local-privilege-escalation bug rather than a remote initial-access vector, it is most dangerous when chained after any other foothold-granting exploit or phishing compromise; all affected Windows 10, Windows 11 and Windows Server systems should receive the August 2026 cumulative update (or later) without delay.
Evidence
- Use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows an authorized, locally-authenticated attacker to elevate privileges to SYSTEM. — NVD
- NVD lists only a Secondary CVSS v3.1 score of 7.0 (high) from source [email protected], vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; no NVD Primary metric is published. — NVD
- Fixed in the August 2026 Patch Tuesday cumulative updates for the listed Windows 10/11 and Windows Server versions; Microsoft's Exploitability Index marked this CVE as "Exploitation Detected." — Microsoft Security Update Guide — August 2026
- Added to the CISA KEV catalog on 2026-08-11, required-action due date 2026-08-25. — CISA KEV
- EPSS score is 0.08567 (95.064th percentile) as of 2026-10-30. — FIRST EPSS
