ctrlINT What the industry said about every indicator, with the quote

CVE-2026-68820Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 8 independent sources · first reported by Check Point Research · last reported

Last reported 27 days ago

CISA KEVAdded 11 Aug 2026
Fix due 25 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS0.3%
higher than 25% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

10 reports, newest first · the exact sentence from each

  1. “They exploited CVE-2025-49113 in vulnerable Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”

    CERT-EUGovernment
    Cyber Brief 26-09 - August 2026

  2. “Lazarus attacked defense industry targets in “Operation Dream Job” using a malicious PDF viewer and the CVE-2026-68820 zero-day vulnerability (a vulnerability exploited before it was publicly disclosed).”

    AhnLab ASECVendor
    August 2026 Threat Trend Report on APT Groups

  3. “CVE-2026-68820”

    Recorded FutureVendor
    August 2026 CVE Landscape

  4. “The fixes include 42 critical flaws and CVE-2026-68820, an actively exploited Windows Ancillary Function Driver for WinSock vulnerability that allows local attackers to gain SYSTEM privileges.”

    Check Point ResearchVendor
    17th August – Threat Intelligence Report

  5. “(One already is; CVE-2026-68820 is an Important-severity Elevation of Privilege issue affecting most versions of Windows.) Eighty have a CVSS Base score of 8.0 or higher.”

    Sophos X-OpsVendor
    2608-patch-tuesday

  6. “CVE-2026-68820 is a use-after-free race condition in AFD.sys, the driver handling network sockets in the Windows kernel, and was the only flaw in this the August Patch Tuesday release Microsoft flagged as under active exploitation.”

    Infosecurity MagazineNews
    Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day

  7. “The actively exploited zero day (CVE-2026-68820) is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock.”

    Infosecurity MagazineNews
    Microsoft Fixes 400 Flaws on August Patch Tuesday

  8. “CVE-2026-68820”

    JPCERT/CC alertsGovernment
    Security Alert: Microsoft Releases August 2026 Security Updates

  9. “The sole known “zero day” bug fixed by Microsoft this month is CVE-2026-68820, a privilege escalation weakness in a core Windows component called afd.sys, which the security firm Automox describes as “the driver behind Windows socket connections on effectively every endpoint.””

    Krebs on SecurityNews
    Microsoft Plugs Nearly 400 Security Holes

  10. “During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit.”

    Check Point ResearchVendor
    Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack

Indicators reported together

named in the same reports

Also named with it: CVE-2025-49113, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-62832, CVE-2026-72971, CVE-2026-58231, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-34486, CVE-2026-39987, CVE-2026-63030, CVE-2021-3156, CVE-2021-29441, CVE-2026-3055, CVE-2026-12569, CVE-2026-3395

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-68820 here?
No account needed. We do not store your IP address.