CVE-2026-68820

nvd.nist.gov • August 15, 2026

Share: View original

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Alerts on Exploitation of Windows Ancillary Function Vulnerability CVE-2026-68820 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a Microsoft Windows vulnerability, CVE-2026-68820, which is a use-after-free flaw in the Windows Ancillary Function Driver for WinSock. This vulnerability allows an authorized attacker to elevate privileges locally. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on August 11, 2026. The first public proof of concept (PoC) was released on August 13, 2026. Organizations using affected Windows systems are at risk, and immediate action is recommended to mitigate potential attacks. The vulnerability highlights the ongoing challenges in securing Windows environments against privilege escalation attacks. 3 sources 70

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

CWE Weaknesses (1)

Cwe-416 - Use After Free

MITRE ATT&CK (1)

T1068 - Exploitation for Privilege Escalation

Platforms (1)