Local flaw with SYSTEM as the target

Microsoft fixed CVE-2026-68820 in the Windows security updates released on August 11, 2026. The use-after-free flaw affects the Windows Ancillary Function Driver for WinSock (afd.sys). A locally authenticated attacker can run a crafted application, trigger a race condition and, if exploitation succeeds, gain SYSTEM privileges. No user interaction is required.

Microsoft rates the vulnerability Important with a CVSS score of 7.0. The local attack vector and high attack complexity account for that score, but they do not lower the operational priority: Microsoft confirms active exploitation, and CISA added the CVE to its KEV catalog on August 11. The remediation deadline set there for US federal agencies is August 25, 2026.

CVE-2026-68820 does not provide unauthenticated remote access by itself. An attacker must already be able to execute local code under a valid account. In an attack chain, however, the flaw can turn that initial foothold into full control of the affected host.

August updates close the vulnerability

The affected scope covers 30 product and architecture combinations across Windows 10, Windows 11 and Windows Server. Microsoft lists these regular target builds for common enterprise versions:

  • Windows 11: 23H2 build 22631.7517 (KB5120240), 24H2 build 26100.9168 and 25H2 build 26200.9168 (both KB5121003), and 26H1 build 28000.2704 (KB5121000).
  • Windows 10: 1607 build 14393.9418 (KB5120418), 1809 build 17763.9121 (KB5120238), 21H2 build 19044.7663 and 22H2 build 19045.7663 (both KB5120249).
  • Windows Server: 2016 build 14393.9418 (KB5120418), 2019 build 17763.9121 (KB5120238), 2022 build 20348.5499 (KB5120242), and 2025 build 26100.33296 (KB5120233), including the corresponding Server Core installations.
  • ESU systems: Windows Server 2012 build 9200.26280 (KB5120386) and Server 2012 R2 build 9600.23338 (KB5120385). Older Windows 10 releases receive protection only through an eligible servicing or ESU channel.

Hotpatch systems have separate package and build rows in the Microsoft servicing channel. Inventory checks therefore need to account for edition, architecture and update channel. Microsoft documents no workaround or separate mitigation; the applicable August update is the corrective action.

Update Tier 0 systems first

Deployment should start with Domain Controllers, privileged access workstations, identity and management servers, RDS systems, and other hosts carrying valuable logon sessions. Internet exposure alone is not a suitable prioritization filter because exploitation follows an existing local foothold.

After a representative pilot group, deploy the updates broadly within days. Verify the installed KB, actual OS build, pending restart state and update failures. Systems that cannot be updated should no longer permit interactive use, should be tightly segmented, and need a firm retirement date.

If suspicious activity occurred before patching, installing the update is not enough. Review EDR and Windows telemetry for unusual process execution, new services or scheduled tasks, credential access, and changes to privileged groups. Microsoft has not published CVE-specific public indicators, so the review must be behavior-based.

The immediate check: record the August build level across every Windows client and server, update Tier 0 systems first, and close remaining gaps by August 25.