Microsoft's August Patch Tuesday release included a fix for a Windows kernel driver flaw that was already being exploited before the patch shipped. The Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog the same day, August 11, alongside two unrelated flaws in Cisco firewall software and the Metabase analytics platform (CISA, 2026).
What the advisory says
The vulnerability, tracked as CVE-2026-68820, sits in the Windows Ancillary Function Driver for WinSock, a kernel-mode component known as AFD.sys that handles the Windows Sockets API. Microsoft's Security Update Guide describes it as a use-after-free flaw, catalogued as CWE-416, that allows an authenticated attacker to elevate privileges locally (Microsoft Security Response Center, 2026).
Microsoft rates the flaw "Important" with a CVSS 3.1 base score of 7.0. It is not the most severe bug in the August release by score, but it is the one Microsoft confirms was exploited in the wild ahead of the fix. Microsoft credits the discovery to researchers at Check Point (Microsoft Security Response Center, 2026).
An attacker needs an existing, authenticated foothold on the target machine to use the flaw. There is no remote, unauthenticated path in what Microsoft has disclosed. That distinction matters for how organizations should prioritize the fix: it is a follow-on privilege escalation tool for an attacker who already has a way in, not an initial entry point on its own.
Who is affected
The fix ships in Microsoft's August cumulative updates: KB5121003 for Windows 11, and KB5120249 for Windows 10 systems under Extended Security Updates, according to vendor and third-party tracking of the release (Qualys, 2026). AFD.sys is a core networking component present across supported Windows client and server builds, so the practical scope is any organization still running unpatched Windows endpoints or servers as of the August release.
CISA's KEV entry applies directly to Federal Civilian Executive Branch agencies, which are required to remediate catalog entries under Binding Operational Directive 26-04. That directive, issued in June 2026, replaced flat remediation windows with a risk-based model: publicly exposed systems affected by a KEV entry get a three-day deadline, and internal systems get fourteen days, depending on exposure and exploitability criteria (CISA, 2026; Tenable, 2026). Private-sector organizations are not bound by the directive, but security teams commonly treat a KEV listing as the practical floor for how fast to patch.
What organizations should know
Nothing in Microsoft's advisory or CISA's alert names or characterizes who is behind the exploitation. Neither source attributes the activity to a specific group, and this brief does not either.
What is confirmed: the flaw was used against real Windows systems before a patch existed, it grants SYSTEM-level privileges once triggered, and it is now formally documented as exploited by the U.S. government's own vulnerability tracker. For any organization running Windows 10 or Windows 11 endpoints, the practical action is the same regardless of attribution: apply the August cumulative update and confirm it landed, particularly on internet-facing or shared-access systems where an attacker is more likely to already hold a low-privilege account.
Security teams that rely on endpoint detection tools should also check whether their EDR vendor has published detection logic for AFD.sys exploitation attempts, since privilege escalation activity at the driver level is not always visible to application-layer monitoring.
What happens next
Microsoft's August release closed out with several hundred CVEs fixed in total, a count that varies slightly by tracker depending on how third-party and cumulative bundle entries are counted (SecurityWeek, 2026; Tenable, 2026). CVE-2026-68820 is the one item from that release with a confirmed KEV listing and confirmed pre-patch exploitation. Federal agencies now work against the BOD 26-04 clock. Everyone else should treat the KEV addition as the signal to move this patch to the front of the queue, not the end of it.
Sources
- Microsoft Security Response Center, "CVE-2026-68820 - Security Update Guide" - https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-68820
- CISA, "CISA Adds Three Known Exploited Vulnerabilities to Catalog" - https://www.cisa.gov/news-events/alerts/2026/08/11/cisa-adds-three-known-exploited-vulnerabilities-catalog
- CISA, "BOD 26-04: Prioritizing Security Updates Based on Risk" - https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- SecurityWeek, "August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day" - https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/
- The Hacker News, "Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack" - https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
- Tenable, "August 2026 Microsoft Patch Tuesday" - https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
- Qualys, "CVE-2026-68820 Is in KEV. What BOD 26-04 Requires Now" - https://blog.qualys.com/product-tech/2026/08/18/cve-2026-68820-kev-bod-26-04-requirements