Skip to content
OriginalSign in

CISA KEV alertCyberSIXT

CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV

Part of the CVE-2026-68820 story · since 11 Aug

Quiet for 12 weekslast report 17 Aug17 articles10 outlets
11 Aug · Check Point first28 Sep14 OctNowThis article6th of 17
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV. This article, 6th of 17.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.

CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue. The flaw affects Microsoft’s Windows Ancillary Function Driver for WinSock and is identified as the Microsoft Windows Ancillary Function Driver for WinSock Use‑After‑Free Vulnerability. It allows an authorised local attacker to trigger a use‑after‑free condition and escalate privileges on the system.

The vulnerability is a classic use‑after‑free memory corruption issue in the WinSock ancillary function driver. Exploitation requires the attacker to have local access and valid credentials, after which they can execute arbitrary code with elevated privileges. The CVSS v3.1 score is 7.0, rated HIGH. Microsoft has released a patch that addresses the issue, and advisory details are available through the MSRC update guide.

Because the entry appears in the KEV catalogue, CISA confirms that the vulnerability is being actively exploited in the wild. No public reports link this flaw to ransomware campaigns at this time. Federal agencies must apply the required mitigations by the remediation due date of 25 August 2026.

CISA’s required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s ‘Forensics Triage Requirements’. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. While the directive bind FCEB agencies, all organisations should review their Windows systems for exposure and prioritise applying the available patch.

For full technical details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-68820 and the CISA KEV catalogue.

How the story developed

All 17 articles
Quiet for 12 weekslast report 17 Aug17 articles10 outlets

17 articles from 10 outlets since 11 Aug. Quiet since 17 Aug. This was the 6th report, 5 hours after the first.

Now11 Aug12131415161718First reportCheck Point · 11 Aug, 17:51
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV. This article, 6th of 17.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Tue 11 AugDay 06
    1. Lazarus hits defence via fake job PDFs, CVE-2026-6882017:51 · Check Point · First report · Known exploited CVE
    2. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-6882018:58 · SecurityWeek · Known exploited CVE
    3. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV22:36 · CISA · official · CISA alert · Known exploited CVE · This article, 6th of 17
    Show 3 more from 11 Aug
    1. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)20:11 · SANS ISC · Known exploited CVE
    2. Microsoft Plugs Nearly 400 Security Holes22:01 · Krebs on Security · Known exploited CVE
    3. Microsoft's Patch Tuesday Deluge Continues With August Updates22:32 · Dark Reading · Known exploited CVE
  2. Wed 12 AugDay 19
    1. CISA Flags Windows Driver Use After Free Flaw CVE-2026-6882000:17 · CISA · official · Known exploited CVE
    2. Microsoft Fixes 421 Flaws Including SharePoint Zero Day00:47 · Rapid7 · Known exploited CVE
    3. Microsoft Patch Tuesday Patches Critical WinSock Exploit03:40 · SecurityOnline · Known exploited CVE
    Show 6 more from 12 Aug
    1. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks03:41 · SecurityOnline · Known exploited CVE
    2. Microsoft patches wormable DNS flaw and critical WinSock zero day07:31 · Security Affairs · Known exploited CVE
    3. Lazarus uses fake job offers to exploit Windows CVE-2026-6882009:11 · SecurityWeek · Known exploited CVE
    4. Microsoft Fixes 400 Flaws on August Patch Tuesday09:11 · Infosecurity · Known exploited CVE
    5. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
    6. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day14:11 · Infosecurity · Known exploited CVE
  3. Thu 13 AugDay 21
    1. Lazarus Group exploits CVE‑2026‑68820 via fake job offers08:52 · Security Affairs · Known exploited CVE

  4. Quiet for 4 days

    Mon 17 AugDay 61
    1. Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in