Actively exploited August 12, 2026

CVE-2026-68820: Actively Exploited Vulnerability

CVE-2026-68820 CVSS 7 CISA KEV · actively exploited

Who it affects: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
What to do: Patch immediately — prioritise internet-facing systems.

Deploy the fix with Action1 Automox ManageEngine Patch Manager Plus ManageEngine Endpoint Central Are you exposed? Compare patch tools →

CVE-2026-68820 is a high-severity vulnerability (CVSS 7), listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as actively exploited.

Summary

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Remediation

It is actively exploited — apply the vendor’s patch immediately and prioritize internet-facing systems. Patch-management tools that can deploy and verify the fix include Action1, Automox, ManageEngine Patch Manager Plus, ManageEngine Endpoint Central. See our best patch management ranking.

Sources

Data as of August 12, 2026. Sources: nvd.nist.gov, msrc.microsoft.com, cisa.gov. Figures are pulled from public vendor and security data and refreshed automatically.

Back to all news & advisories