CVE-2026-68820

CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.

What to do: Apply Microsoft's August 2026 security updates for all listed Windows 10, Windows 11, and Windows Server versions as a priority; CISA KEV (added 2026-08-11) requires federal agencies to patch within two weeks in accordance with BOD 26-04. Because observed attacks used fake job-offer social engineering to reach local code execution, prioritize user workstations and review endpoints for unexplained SYSTEM-level process activity, newly installed services, or backdoor persistence artifacts. Where patching is deferred, restrict execution of untrusted local code on affected hosts and monitor for privilege-escalation events.