Security CISA KEV CVE-2026-68820
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
Product Windows Ancillary Function Driver for WinSock
Added to KEV 11 Aug 2026
Federal remediation due 25 Aug 2026
Known ransomware use Not reported
CISA KEV: Listed 11 Aug 2026; remediation due 25 Aug 2026 → Listed 11 Aug 2026 · Title changed
4 Nov 2026 Detection template: Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed
2 Nov 2026 · 17:30:39 UTC Detection template: No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained
2 Nov 2026 · 16:27:39 UTC Detection template: No Nuclei template listed · Customer action: Required: apply the update → Required: follow the MSRC remediation guidance · Public disclosure: No → No (MSRC assessment) · Exploitation detected: Yes → Yes, reported by MSRC
29 Oct 2026 Detection template: Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed
23 Oct 2026 · 09:33:49 UTC Detection template: No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained
23 Oct 2026 · 08:31:50 UTC
Changes are dated when recorded; day views use the last saved version from that UTC day, and citations stay fixed.
Cite this version Field-level log (69)
Up to 100 recent field edits are shown; older edits may be outside retention.
4 Nov 2026 · 21:21:22 UTC
Federal remediation due 25 Aug 2026 4 Nov 2026 · 21:21:22 UTC
Known ransomware use Not stated 4 Nov 2026 · 21:21:22 UTC
CISA KEV Listed 11 Aug 2026; remediation due 25 Aug 2026 → Listed 11 Aug 2026 4 Nov 2026 · 21:21:22 UTC
Product Windows Ancillary Function Driver for WinSock 4 Nov 2026 · 21:21:22 UTC
Vendor Microsoft 4 Nov 2026 · 21:21:22 UTC
Source coverage: public-exploit-code Current → Not collected 4 Nov 2026 · 21:21:22 UTC
Source coverage: first-epss Current → Not collected 4 Nov 2026 · 21:21:22 UTC
Source coverage: msrc-cvrf Current → Not collected 4 Nov 2026 · 21:21:22 UTC
Link: KB5121003 /windows/kb/KB5121003 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5121000 /windows/kb/KB5121000 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120994 /windows/kb/KB5120994 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120418 /windows/kb/KB5120418 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120386 /windows/kb/KB5120386 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120385 /windows/kb/KB5120385 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120249 /windows/kb/KB5120249 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120242 /windows/kb/KB5120242 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120240 /windows/kb/KB5120240 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120238 /windows/kb/KB5120238 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120233 /windows/kb/KB5120233 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120229 /windows/kb/KB5120229 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: KB5120228 /windows/kb/KB5120228 → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Link: August 2026 /security?release=2026-Aug#cves → No longer listed in this observation 4 Nov 2026 · 21:21:22 UTC
Source Microsoft Security Response Center → CISA Known Exploited Vulnerabilities 4 Nov 2026 · 21:21:22 UTC
Summary Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. → Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. 4 Nov 2026 · 21:21:22 UTC
Title Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability → Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability 4 Nov 2026 · 03:04:37 UTC
EPSS 8.6%; scored 2 Nov 2026 → 8.6%; scored 3 Nov 2026 3 Nov 2026 · 01:53:36 UTC
EPSS 8.6%; scored 1 Nov 2026 → 8.6%; scored 2 Nov 2026 2 Nov 2026 · 17:30:39 UTC
Public detection template Unknown: detection-template evidence is incomplete or retained → No Nuclei template listed 2 Nov 2026 · 17:30:39 UTC
Source coverage: public-exploit-code Incomplete → Current 2 Nov 2026 · 17:30:39 UTC
Source coverage: first-epss Incomplete → Current 2 Nov 2026 · 17:30:39 UTC
Source coverage: msrc-cvrf Incomplete → Current 2 Nov 2026 · 16:27:39 UTC
Public detection template No Nuclei template listed → Unknown: detection-template evidence is incomplete or retained 2 Nov 2026 · 16:27:39 UTC
Source coverage: public-exploit-code Current → Incomplete 2 Nov 2026 · 16:27:39 UTC
Source coverage: first-epss Current → Incomplete 2 Nov 2026 · 16:27:39 UTC
Source coverage: msrc-cvrf Current → Incomplete 2 Nov 2026 · 00:36:51 UTC
EPSS 8.6%; scored 31 Oct 2026 → 8.6%; scored 1 Nov 2026 31 Oct 2026 · 18:22:15 UTC
EPSS 8.6%; scored 30 Oct 2026 → 8.6%; scored 31 Oct 2026 30 Oct 2026 · 18:02:45 UTC
EPSS 0.3%; scored 29 Oct 2026 → 8.6%; scored 30 Oct 2026 29 Oct 2026 · 20:19:26 UTC
Public detection template No Nuclei template listed 29 Oct 2026 · 20:19:26 UTC
Customer action Required: apply the update → Required: follow the MSRC remediation guidance 29 Oct 2026 · 20:19:26 UTC
Publicly disclosed No → No (MSRC assessment) 29 Oct 2026 · 20:19:26 UTC
Exploitation detected Yes → Yes, reported by MSRC 29 Oct 2026 · 18:33:30 UTC
EPSS 0.3%; scored 28 Oct 2026 → 0.3%; scored 29 Oct 2026 28 Oct 2026 · 20:00:33 UTC
EPSS 0.3%; scored 27 Oct 2026 → 0.3%; scored 28 Oct 2026 27 Oct 2026 · 15:48:13 UTC
EPSS 0.3%; scored 26 Oct 2026 → 0.3%; scored 27 Oct 2026 26 Oct 2026 · 23:57:09 UTC
EPSS 0.3%; scored 25 Oct 2026 → 0.3%; scored 26 Oct 2026 25 Oct 2026 · 17:12:51 UTC
EPSS 0.3%; scored 24 Oct 2026 → 0.3%; scored 25 Oct 2026 25 Oct 2026 · 01:34:18 UTC
EPSS 0.3%; scored 23 Oct 2026 → 0.3%; scored 24 Oct 2026 23 Oct 2026 · 15:51:28 UTC
EPSS 0.3%; scored 22 Oct 2026 → 0.3%; scored 23 Oct 2026 23 Oct 2026 · 09:33:49 UTC
Public exploit code Unknown: exploit-code evidence is incomplete or retained → No Nuclei template listed 23 Oct 2026 · 09:33:49 UTC
Source coverage: public-exploit-code Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: first-epss Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: cisa-kev Incomplete → Current 23 Oct 2026 · 09:33:49 UTC
Source coverage: msrc-cvrf Incomplete → Current 23 Oct 2026 · 08:31:50 UTC
Public exploit code No Nuclei template listed → Unknown: exploit-code evidence is incomplete or retained 23 Oct 2026 · 08:31:50 UTC
Source coverage: public-exploit-code Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: first-epss Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: cisa-kev Current → Incomplete 23 Oct 2026 · 08:31:50 UTC
Source coverage: msrc-cvrf Current → Incomplete 22 Oct 2026 · 17:33:15 UTC
EPSS 0.3%; scored 21 Oct 2026 → 0.3%; scored 22 Oct 2026 21 Oct 2026 · 21:47:24 UTC
EPSS 0.3%; scored 20 Oct 2026 → 0.3%; scored 21 Oct 2026 20 Oct 2026 · 20:53:31 UTC
EPSS 0.3%; scored 19 Oct 2026 → 0.3%; scored 20 Oct 2026 19 Oct 2026 · 15:12:40 UTC
EPSS 0.3%; scored 18 Oct 2026 → 0.3%; scored 19 Oct 2026 18 Oct 2026 · 14:54:30 UTC
EPSS 0.3%; scored 16 Oct 2026 → 0.3%; scored 18 Oct 2026 18 Oct 2026 · 14:54:30 UTC
Link: August 2026 /security?release=2026-Aug#cves 16 Oct 2026 · 16:13:25 UTC
EPSS 0.3%; scored 15 Oct 2026 → 0.3%; scored 16 Oct 2026 15 Oct 2026 · 21:30:54 UTC
EPSS 0.3%; scored 14 Oct 2026 → 0.3%; scored 15 Oct 2026 15 Oct 2026 · 01:07:54 UTC
EPSS 0.3%; scored 13 Oct 2026 → 0.3%; scored 14 Oct 2026 14 Oct 2026 · 11:22:42 UTC
Source coverage: msrc-cvrf Incomplete → Current Explore global source statements, affected packages and advisory history for CVE-2026-68820 . The catalog has a separate collection scope from Microsoft release records.
cve-program · CVE-2026-68820 Published Windows 10 Version 1607 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 1607",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9418",
"versionType": "custom",
"status": "affected"
}
]
} Windows 10 Version 1809 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 1809",
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9121",
"versionType": "custom",
"status": "affected"
}
]
} Windows 10 Version 21H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 21H2",
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.19044.0",
"lessThan": "10.0.19044.7663",
"versionType": "custom",
"status": "affected"
}
]
} Windows 10 Version 22H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 10 Version 22H2",
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.19045.0",
"lessThan": "10.0.19045.7663",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 version 23H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 version 23H2",
"platforms": [
"ARM64-based Systems"
],
"versions": [
{
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7517",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 23H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 23H2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.22631.0",
"lessThan": "10.0.22631.7517",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 24H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 24H2",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.9168",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 Version 25H2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 Version 25H2",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26200.0",
"lessThan": "10.0.26200.9168",
"versionType": "custom",
"status": "affected"
}
]
} Windows 11 version 26H1 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows 11 version 26H1",
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"versions": [
{
"version": "10.0.28000.0",
"lessThan": "10.0.28000.2704",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2012 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2012",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26280",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2012 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2012 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.2.9200.0",
"lessThan": "6.2.9200.26280",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2012 R2 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2012 R2",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23338",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2012 R2 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2012 R2 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "6.3.9600.0",
"lessThan": "6.3.9600.23338",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2016",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9418",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2016 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2016 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.14393.0",
"lessThan": "10.0.14393.9418",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2019",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9121",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2019 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2019 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.17763.0",
"lessThan": "10.0.17763.9121",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2022 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2022",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.20348.0",
"lessThan": "10.0.20348.5499",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2025",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33296",
"versionType": "custom",
"status": "affected"
}
]
} Windows Server 2025 (Server Core installation) Vendor product
Original vendor version evidence · not evaluated as a NuGet range {
"vendor": "Microsoft",
"product": "Windows Server 2025 (Server Core installation)",
"platforms": [
"x64-based Systems"
],
"versions": [
{
"version": "10.0.26100.0",
"lessThan": "10.0.26100.33296",
"versionType": "custom",
"status": "affected"
}
]
} Original source record · Cite this exact observation · Complete original publisher JSON