Microsoft’s August security updates fix a Windows kernel-driver flaw that attackers were already exploiting. CVE-2026-68820 is a use-after-free in the Ancillary Function Driver for WinSock, or AFD.sys. A locally authenticated attacker can race the driver and rise from low privileges to SYSTEM without user interaction.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 11, 2026. Covered federal agencies have until August 25 to remediate it. The agency says known ransomware use is unknown, and neither CISA nor Microsoft identifies the entry vector, attacker, campaign, targets, or victim count.
This is the exploited counterpart to another August Windows escalation issue. Nulltap’s LegacyHive report covers a public technique that Microsoft says has not been exploited. CVE-2026-68820 has fewer published hunting details, but confirmed exploitation makes patch evidence and pre-update triage more urgent.
Exploitation changes the patch order
Microsoft’s advisory rates the vulnerability Important at CVSS 7.0. Its vector is local, high complexity, low privilege, and no user interaction. Microsoft marks exploitation detected and says the issue was not publicly disclosed before the fix.
Those facts define a post-access escalation path. An attacker needs authenticated local execution before attempting the race. The flaw does not provide remote entry by itself. Once exploited, the process runs as SYSTEM. That turns a limited foothold into full local control.
The advisory covers 30 product-and-architecture combinations, from Windows Server 2012 and Windows 10 Version 1607 through Windows Server 2025 and Windows 11 Version 26H1. The count includes architecture and Server Core variants. It is not a victim count, and the vendors do not quantify the number of attacked systems.
An AFD race reaches SYSTEM
AFD.sys is the kernel driver that supports the Windows sockets interface. Microsoft’s public description stops at the vulnerable condition: a locally authenticated attacker runs a specially crafted application on an affected system and triggers a race in the driver’s use of released memory.
The vendor describes the decisive step directly: “A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition.” Winning that race can give the process SYSTEM privileges. Microsoft does not publish a proof of concept, command signature, affected function, or reliable exploit indicator in the advisory.
Figure details
The figure separates the unknown initial-access path from the confirmed local escalation. An attacker first has an authenticated low-privilege foothold on an affected Windows system. A specially crafted local application then triggers a race condition involving released memory in AFD.sys. A successful race elevates the process to SYSTEM. CISA and Microsoft confirm exploitation but do not identify the initial-access vector, attacker, campaign, victims, or a public command signature.
That evidence boundary matters during investigation. A process running as SYSTEM after starting in a user context is a useful lead, but it is not unique to this flaw. A clean search for one filename or command line cannot clear the host because Microsoft has not published either artifact.
Fixed builds span Windows releases
Microsoft’s CSAF record gives a fixed build for every affected release. The table collapses architecture and Server Core duplicates while preserving each build boundary.
| Windows release | August update | Fixed build | Supersedes |
|---|---|---|---|
| Windows Server 2012 | KB5120386 | 6.2.9200.26280 | Earlier monthly rollups |
| Windows Server 2012 R2 | KB5120385 | 6.3.9600.23338 | Earlier monthly rollups |
| Windows 10 1607 / Server 2016 | KB5120418 | 14393.9418 | Earlier cumulative updates |
| Windows 10 1809 / Server 2019 | KB5120238 | 17763.9121 | Earlier cumulative updates |
| Windows 10 21H2 | KB5120249 | 19044.7663 | Earlier cumulative updates |
| Windows 10 22H2 | KB5120249 | 19045.7663 | Earlier cumulative updates |
| Windows Server 2022 | KB5120242 | 20348.5499 | Earlier cumulative updates |
| Windows 11 23H2 | KB5120240 | 22631.7517 | Earlier cumulative updates |
| Windows 11 24H2 | KB5121003 | 26100.9168 | Earlier cumulative updates |
| Windows 11 25H2 | KB5121003 | 26200.9168 | Earlier cumulative updates |
| Windows Server 2025 | KB5120233 | 26100.33296 | Earlier cumulative updates |
| Windows 11 26H1 | KB5121000 | 28000.2704 | Earlier cumulative updates |
Microsoft also lists supported hotpatch boundaries: KB5120229 at build 20348.5440 for Server 2022; KB5120228 at build 26100.33222 for Server 2025; and KB5120994 at builds 26100.9106 for Windows 11 24H2 and 26200.9106 for Windows 11 25H2. Every listed product row requires a reboot.
Later supported cumulative updates supersede the August packages and retain the security fix. The durable condition is the listed build or a later supported build for the same Windows release and servicing channel. An inventory record that shows only a KB deployment attempt is an expected-value claim until the endpoint reports its post-reboot build.
Verify builds and inspect footholds
Inventory the Windows release, architecture, servicing channel, and current build on endpoints and servers. Prioritize systems that were reachable through another suspected foothold before the August update, then deploy the matching cumulative or supported hotpatch update and complete the required reboot.
This PowerShell check returns the release and full build from the endpoint:
$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.ProductName) $($v.DisplayVersion) $($v.CurrentBuild).$($v.UBR)"The expected result is a build at or above the applicable boundary in the table, or the matching hotpatch floor, after reboot. Treat a later supported cumulative build as superseding the August package. Record that endpoint result beside deployment data so the patch claim is independently compared with the running system.
For machines exposed during the vulnerable interval, preserve endpoint process trees, Windows process-creation records where enabled, authentication events, service changes, security-control changes, and the timestamps around any initial foothold. Look for a low-privilege authenticated process followed by unexpected SYSTEM execution. That sequence is investigative context rather than a CVE-specific signature.
Microsoft and CISA provide no exploit filename, hash, command line, actor, or initial-access indicator. Scope suspicious SYSTEM activity through its parent process, account, host, and adjacent network events. A patched build closes the escalation path; it does not establish whether an attacker used the flaw before the update.