CVE-2026-68820: Windows Ancillary Function Driver for WinSock use-after-free privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a kernel use-after-free allowing local privilege escalation, is listed in CISA KEV with a near-term remediation deadline, and affects a very wide range of Windows builds, though it requires local access and high attack complexity.

What it is

The Windows Ancillary Function Driver for WinSock (afd.sys) contains a use-after-free (CWE-416) that lets an authorized local attacker elevate privileges. The flaw affects a broad set of Windows 10, Windows 11 and Windows Server releases, and Microsoft has published a patch. Because it is a kernel driver reachable by any logged-on user, it is a practical local privilege-escalation primitive on unpatched hosts.

Impact

An attacker who already holds a low-privileged local account can exploit the memory corruption to gain elevated privileges, typically SYSTEM, on the affected machine. That yields full control of the host, enabling credential theft, persistence and lateral movement.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so any authenticated local user who can reach the WinSock AFD interface can trigger it. Attack complexity is rated high (AC:H), indicating a non-trivial race or heap-shaping condition rather than a simple one-shot trigger.

Exploitation

CVE-2026-68820 was added to CISA KEV on 2026-08-11 with a remediation due date of 2026-08-25, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.06184 (93rd percentile), and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2026-68820 across all affected Windows 10, Windows 11 and Windows Server builds; prioritize internet-facing and high-value assets per CISA BOD 26-04.
• Inventory and patch the full affected build list, including older Windows 10 1607/1809 and Windows Server 2012/2016 systems that are often missed.
• Enforce least privilege so that standard users cannot run arbitrary local code, reducing the pool of accounts that can reach the driver.
• Where patching is delayed, isolate or restrict access to affected hosts and monitor them closely for post-exploitation activity.
• Track the CISA KEV due date of 2026-08-25 and confirm remediation status for every affected asset.

Detection

• Monitor for unexpected elevation to SYSTEM or new high-integrity processes spawned from low-privileged user contexts.
• Watch for crashes or bugchecks in afd.sys and for unusual handle or memory patterns associated with WinSock AFD operations.
• Alert on known local privilege-escalation tooling and exploit artifacts executed by non-administrative users.
• Correlate local logon events with subsequent privileged process creation or service installation on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.