Critical CVSS 7 Actively exploited
CVE-2026-68820
Microsoft Windows Ancillary Function Driver for WinSock
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
What this means
- Exposure
- Exploitable with local access to the machine, with an ordinary user account and with no action from the victim. The attack does require particular conditions, which makes it less systematic.
- Impact
- An attacker can read sensitive data, modify or destroy data and take the service offline.
- Weakness
- Already-freed memory is reused, letting the attacker reclaim it and hijack execution.
- Likelihood
- Exploitation is not hypothetical: CISA has observed it in the wild.
What to doTop priority: CISA sets the remediation deadline at 25 August 2026.
Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.