[KEV] CVE-2026-68820 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-68820 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-68820 is a use-after-free vulnerability in Microsoft Windows Ancillary Function Driver for WinSock, a Windows networking component accessible to authorized local users.

Technical Detail

The vulnerability results from improper handling of an object after its memory has been freed within the Ancillary Function Driver for WinSock. An authorized attacker with local access can trigger the flaw through interaction with the affected Windows networking component. Successful exploitation can allow local privilege escalation, potentially enabling the attacker to obtain elevated privileges on the affected system.

Exploitation Status

CISA has confirmed active exploitation in the wild. Exploit maturity is assessed as Operational, meaning a functional exploit is available and can be used in real-world intrusions by attackers who already have authorized local access to a vulnerable Windows system.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Apply Microsoft’s security update for CVE-2026-68820 as a priority, particularly on systems where local users, remote desktop users, application workloads, or other lower-privileged processes may gain an initial foothold. CISA added this vulnerability to the Known Exploited Vulnerabilities Catalog on August 11, 2026; federal civilian executive branch agencies must patch by the CISA KEV Catalog remediation deadline or apply mitigations. No vendor-supported workaround or specific detection signature is identified in the available information. Monitor for unusual local privilege escalation activity, unexpected execution from low-privileged user contexts, and anomalous creation or modification of privileged accounts, services, scheduled tasks, or security settings.