cve-2026-68820
HIGH CVSS 7.0 nvd
Description
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Timeline
- Published
- 2026-08-11
- Last Modified
- 2026-10-26
CVSS Details
- Attack Vector
- LOCAL
- Attack Complexity
- HIGH
- Privileges Required
- LOW
Affected Products
- microsoft windows_10_1607
- microsoft windows_10_1809
- microsoft windows_10_21h2
- microsoft windows_10_22h2
- microsoft windows_11_23h2
- microsoft windows_11_24h2
- microsoft windows_11_25h2
- microsoft windows_11_26h1
- microsoft windows_server_2012
- microsoft windows_server_2016
- microsoft windows_server_2019
- microsoft windows_server_2022
- microsoft windows_server_2025
CISA KEV — Known Exploited Vulnerability
- Name
- Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Added to KEV
- 2026-08-11
- Action due
- 2026-08-25
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Weaknesses (CWE)
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 7.0 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.0 | 5.9 | secure@microsoft.com |
CPE configurations
OR
| CPE | Version range | Vulnerable |
|---|---|---|
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* |
< 10.0.14393.9418 | yes |
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* |
< 10.0.14393.9418 | yes |
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* |
< 10.0.17763.9115 | yes |
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* |
< 10.0.17763.9115 | yes |
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* |
< 10.0.19044.7663 | yes |
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* |
< 10.0.19045.7663 | yes |
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* |
< 10.0.22631.7517 | yes |
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* |
< 10.0.26100.9106 | yes |
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:* |
< 10.0.26200.9106 | yes |
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:*:* |
< 10.0.28000.2704 | yes |
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* |
— | yes |
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* |
— | yes |
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* |
< 10.0.14393.9418 | yes |
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* |
< 10.0.17763.9115 | yes |
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* |
< 10.0.20348.5440 | yes |
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* |
< 10.0.26100.33222 | yes |
NVD metadata
- NVD status
- Analyzed
- Source identifier
secure@microsoft.com
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820 Patch, Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820 US Government Resource
Linked Vulnerabilities
No linked vulnerabilities found.
{
"cvss": 7.0,
"datePublished": "2026-08-11T17:19:06.357",
"dateUpdated": "2026-10-26T13:10:00.140",
"description": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
"id": "CVE-2026-68820",
"raw": {
"affected": [
{
"affectedData": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1607",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9418",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1809",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9121",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 21H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19044.7663",
"status": "affected",
"version": "10.0.19044.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 22H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19045.7663",
"status": "affected",
"version": "10.0.19045.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems"
],
"product": "Windows 11 version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7517",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows 11 Version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7517",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 24H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.9168",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 25H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26200.9168",
"status": "affected",
"version": "10.0.26200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 version 26H1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.28000.2704",
"status": "affected",
"version": "10.0.28000.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.26280",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.26280",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.23338",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.23338",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9418",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9418",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9121",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9121",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.20348.5499",
"status": "affected",
"version": "10.0.20348.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.33296",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2025 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.33296",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
}
],
"source": "secure@microsoft.com"
}
],
"cisaActionDue": "2026-08-25",
"cisaExploitAdd": "2026-08-11",
"cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"cisaVulnerabilityName": "Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability",
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "14FF7EDA-F43B-4BB4-BC6C-7EFE15382EEB",
"versionEndExcluding": "10.0.14393.9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "CB3EDBCC-9F4E-49F2-9701-67D2C1F7B47A",
"versionEndExcluding": "10.0.14393.9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
"matchCriteriaId": "3B36E37E-C661-4F5B-BFAB-8DE7EA3BBF5A",
"versionEndExcluding": "10.0.17763.9115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"matchCriteriaId": "490C0819-7717-4869-B85C-2A218E7C50B2",
"versionEndExcluding": "10.0.17763.9115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B27B392C-BA96-4CAA-8368-64DB0C90F204",
"versionEndExcluding": "10.0.19044.7663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "94D69542-4258-4423-9815-0191DE06A4E7",
"versionEndExcluding": "10.0.19045.7663",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0821B99A-2DDC-4B1E-999A-76EC1D018CD5",
"versionEndExcluding": "10.0.22631.7517",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3539AA11-7E3B-4EBC-9427-C2F58A6BA963",
"versionEndExcluding": "10.0.26100.9106",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F25F821F-F56B-4150-80B7-9A6108FAA8BD",
"versionEndExcluding": "10.0.26200.9106",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:*:*",
"matchCriteriaId": "645B7F94-BBDA-41B1-825B-6103F2AC2FC9",
"versionEndExcluding": "10.0.28000.2704",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
"matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"matchCriteriaId": "14EEFCD3-C815-4CBE-99AB-6AFB40EF2FE9",
"versionEndExcluding": "10.0.14393.9418",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7877A816-4EF3-4DA9-81F6-DF77056F329B",
"versionEndExcluding": "10.0.17763.9115",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8EBC7E47-4744-4802-B04C-869AA63985A5",
"versionEndExcluding": "10.0.20348.5440",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"matchCriteriaId": "48C0EB1A-5EC0-4916-A812-08E16FEB040A",
"versionEndExcluding": "10.0.26100.33222",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally."
},
{
"lang": "es",
"value": "Uso después de liberar en el controlador de función auxiliar de Windows para WinSock permite a un atacante autorizado elevar privilegios localmente."
}
],
"id": "CVE-2026-68820",
"lastModified": "2026-10-26T13:10:00.140",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.0,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-68820",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T00:00:00+00:00",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-11T17:19:06.357",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-416"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"severity": "HIGH",
"source": "nvd",
"title": "Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges l..."
}
Enrichment data
Aggregated bundle (all enrichments)