CISA Adds Actively Exploited Windows WinSock Vulnerability to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Microsoft Windows vulnerability to its Known Exploited Vulnerabilities catalog, warning that the flaw is actively being exploited in real-world attacks.

The vulnerability, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock and could allow an authorized local attacker to elevate their privileges on a vulnerable system.

Windows WinSock Vulnerability

Microsoft describes CVE-2026-68820 as a use-after-free vulnerability in the afd.sys kernel driver, which supports Windows networking operations and provides socket-related functions used by applications and services.

This vulnerability falls under the Common Weakness Enumeration (CWE) category 416, or Use After Free, which occurs when a program continues to access memory after it has been released.

If this condition is exploited in a kernel-mode component, it could allow an attacker to control sensitive memory operations and execute code with elevated privileges.

CVE-2026-68820 is categorized as a local privilege escalation vulnerability. An attacker must already have authorized access to a Windows endpoint to exploit this flaw, meaning it is not a vector for initial remote access. However, its consequences can be severe, especially when combined with other attack techniques.

Threat actors often exploit privilege-escalation vulnerabilities after gaining initial access through methods such as phishing, malware distribution, compromised credentials, remote-access abuse, or other weaknesses.

Elevated privileges enable attackers to disable endpoint defenses, access sensitive credentials, establish persistence, alter system configurations, and expand their control over the environment.

The addition of this vulnerability to CISA’s catalog indicates that it has been exploited. CISA has not confirmed whether the flaw is being used in ransomware campaigns; that status remains unknown.

Nevertheless, organizations should consider the active exploitation of a Windows kernel-level privilege escalation flaw a high-priority security issue.

CISA added CVE-2026-68820 to its catalog on August 11, 2026, and set a remediation deadline of August 25, 2026. This gives affected organizations a limited window to apply the necessary vendor-provided mitigations.

Federal Civilian Executive Branch agencies must adhere to CISA’s Binding Operational Directive 26-04, which prioritizes security updates according to risk. CISA also recommends that stakeholders follow applicable forensic triage requirements and assess each asset’s internet exposure.

Although the vulnerability requires local access, internet-facing systems should not be ignored. Externally exposed servers, virtual desktop infrastructures, remote-access hosts, and endpoints accessed by third parties can become attractive targets if an attacker leverages initial compromises to escalate privileges locally.

Recommended Actions

Organizations using affected Microsoft Windows systems should take the following steps:

• Apply Microsoft’s security updates or mitigations as soon as they are available.
• Prioritize patching systems used by administrators, developers, remote workers, and privileged IT personnel.
• Monitor for suspicious privilege escalation activities, including unusual service creation, tampering with security tools, and unexpected behavior of drivers or processes.
• Review endpoint detection and response telemetry for activities indicating attempts at kernel-level exploitation.
• Enforce the principle of least privilege and remove unnecessary local administrator rights.
• Isolate or discontinue the use of affected products if mitigations cannot be applied.

CVE-2026-68820 highlights a recurring risk for enterprises: attackers do not always need to exploit a remote code execution vulnerability to cause substantial damage.

A locally exploited Windows kernel flaw can transform limited access into complete system compromise, making rapid patching and vigilant endpoint monitoring essential.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world