- The Mess: Microsoft patched CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock (
afd.sys). The problem is already being exploited, and CISA put it on the Known Exploited Vulnerabilities list.
The attacker does not need to trick someone into clicking a popup at the exact moment of exploitation. They need a low-privileged foothold on the machine and a specially crafted application. From there, a race condition in the kernel driver can be abused to jump from limited permissions to SYSTEM. That is essentially game over for the endpoint.
The bug carries a CVSS 7.0 score. That sounds less dramatic than a 9.8 RCE, but the number misses the important part: Microsoft says it was exploited in the wild before the fix arrived. CISA’s remediation deadline for internally exposed systems is August 25, 2026 — today.
And there is a nasty operational detail. Installing the update is not necessarily enough. The fix replaces the vulnerable kernel driver, so affected machines need a reboot before the remediation is actually complete. A patched-but-not-restarted PC can still have the old vulnerable driver loaded.
- The Damage: An attacker who already has a foothold with ordinary user privileges can potentially turn it into full SYSTEM-level control, then disable defenses, steal credentials, deploy malware or move deeper into the network.
This is the classic second-stage attack problem. The WinSock flaw may not be the door that gets the attacker inside. It can be the thing that turns a limited foothold into administrative control.
That makes it particularly useful after phishing, malicious software execution or another initial compromise. Security researchers have also noted that the affected Windows component has a history of being targeted in attacks.
- The Fix: Install Microsoft’s August 2026 security update and reboot affected Windows systems immediately; the relevant Windows 11 updates include KB5121003, while Windows 10 ESU systems receive KB5120249.
Bugstoday Opinion
This is exactly the kind of bug people ignore because CVSS 7.0 doesn’t look scary enough.
Bad idea.
A kernel privilege-escalation vulnerability that is already exploited is not theoretical. An attacker gets a foothold, wins the race, gets SYSTEM. Simple.
And today is the deadline.
Bugstoday verdict: patch it, reboot it, verify it. A Windows machine sitting on “restart pending” is not patched.
