Skip to content
Sign in
CVE-2026-688207.0HighCWE-416

CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft · Windows Ancillary Function Driver for WinSock

Vendor fix available · Affected: Microsoft Windows Ancillary Function Driver for WinSock · Exploitation: in CISA KEV since 11 Aug

Exploitation attributed to Lazarus Group (according to Check Point Research)

ExploitationIn CISA KEV

  1. In CISA KEVCISA KEV catalogue11 Aug
  2. Exploited (reported)Check Point Research, via Check Point11 Aug
  3. Scanning observed: not seen
  4. Proof of concept public4 public GitHub repositories (unverified), listed by PoC-in-GitHub13 Aug
  5. Not established: not seen

Who exploits it, and who says so

8.6%probability of exploitation in the next 30 days
95th percentile
050100

Higher than 95% of scored CVEs

7.0HighCVSS 3.1
LowHigh

Federal deadline

CISA KEV · added 11 Aug · catalogue entry

Passed 76 days ago

DescriptionNVD

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

What changed

  1. Security Affairs reported exploitation by Lazarus Group Security Affairs
  2. PoC-in-GitHub lists 4 public GitHub repositories (unverified) PoC-in-GitHub
  3. Infosecurity reported exploitation by Lazarus Group Infosecurity
  4. SecurityWeek reported exploitation by Lazarus Group SecurityWeek
  5. SecurityOnline reported exploitation by Lazarus Group SecurityOnline
  6. SecurityOnline reported exploitation by Lazarus Group SecurityOnline
  7. Check Point reported exploitation by Lazarus Group Check Point
  8. Check Point reported exploitation, according to Check Point Research Check Point
  9. CISA added it to the KEV catalogue CISA

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Coverage17 articles · 10 outlets

One row per outlet, in order of first report. First in our coverage: Check Point, 11 Aug.

Full timeline
Quiet for 12 weekslast report 17 Aug17 articles10 outlets
11 Aug · Check Point first28 Sep14 OctNow
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
All coveragerunning total17Check Point1SecurityWeek2SANS ISC1Krebs on Se…1Dark Reading1CISA2Rapid71SecurityOnl…4Security Af…21 more outlets212 Aug12 Sep13 OctNow
  • First report
  • Article
  • Official notice
  • Running total

Added to CISA KEV

Show as table
17 articles about CVE-2026-68820 from 10 outlets
Published (UTC)OutletHeadline
11 Aug 17:51Check PointLazarus hits defence via fake job PDFs, CVE-2026-68820
11 Aug 18:58SecurityWeekMicrosoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820
11 Aug 20:11SANS ISCMicrosoft Patch Tuesday August 2026, (Tue, Aug 11th)
11 Aug 22:01Krebs on SecurityMicrosoft Plugs Nearly 400 Security Holes
11 Aug 22:32Dark ReadingMicrosoft's Patch Tuesday Deluge Continues With August Updates
11 Aug 22:36CISACISA Flags High Risk Windows WinSock Use After Free Flaw in KEV
12 Aug 00:17CISACISA Flags Windows Driver Use After Free Flaw CVE-2026-68820
12 Aug 00:47Rapid7Microsoft Fixes 421 Flaws Including SharePoint Zero Day
12 Aug 03:40SecurityOnlineMicrosoft Patch Tuesday Patches Critical WinSock Exploit
12 Aug 03:41SecurityOnlineLazarus Exploits Windows Zero-Day in Operation Dream Job Attacks
12 Aug 07:31Security AffairsMicrosoft patches wormable DNS flaw and critical WinSock zero day
12 Aug 09:11SecurityWeekLazarus uses fake job offers to exploit Windows CVE-2026-68820
12 Aug 09:11InfosecurityMicrosoft Fixes 400 Flaws on August Patch Tuesday
12 Aug 13:32SecurityOnlineCVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
12 Aug 14:11InfosecurityLazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
13 Aug 08:52Security AffairsLazarus Group exploits CVE‑2026‑68820 via fake job offers
17 Aug 02:40SecurityOnlineCritical Metabase SQLi flaw lets attackers seize full admin control
  1. Critical Metabase SQLi flaw lets attackers seize full admin control
    SecurityOnline · mentions it in passing
  2. Lazarus Group exploits CVE‑2026‑68820 via fake job offers
    Security Affairs
  3. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
    Infosecurity
  4. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed
    SecurityOnline · mentions it in passing
  5. Microsoft Fixes 400 Flaws on August Patch Tuesday
    Infosecurity
  6. Lazarus uses fake job offers to exploit Windows CVE-2026-68820
    SecurityWeek
  7. Microsoft patches wormable DNS flaw and critical WinSock zero day
    Security Affairs
  8. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks
    SecurityOnline
Show 9 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in