CVE-2026-68820

high

Description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

From the Tenable Blog

August 2026 Microsoft Patch Tuesday | Tenable®

Published: 2026-08-11

Microsoft patched 398 CVEs in August including three zero-day flaws, one exploited in the wild: CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock.

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820

https://securityaffairs.com/197110/hacking/u-s-cisa-adds-metabase-windows-and-cisco-secure-firewall-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://securityaffairs.com/197098/uncategorized/north-korean-lazarus-group-uses-windows-zero-day-in-operation-dream-job.html

https://www.securityweek.com/fresh-windows-zero-day-exploited-in-north-korean-cyberattacks/

https://www.helpnetsecurity.com/2026/08/12/north-korea-lazarus-fake-job-offers/

https://www.helpnetsecurity.com/2026/08/12/august-2026-patch-tuesday-cve-2026-68820/

https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/

https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html

https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html

https://securityaffairs.com/197048/security/microsoft-patch-tuesday-for-august-2026-fixed-a-zero-day-and-wormable-rce.html

https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483

https://www.securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/

https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html

https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/

https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/

https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/

https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820

Details

Source: Mitre, NVD

Published: 2026-08-11

Updated: 2026-08-12

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6

Vector: CVSS2#AV:L/AC:H/Au:S/C:C/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: High

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest

Detections

Analytics