CVE-2026-68820

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

At a glance

Severity: HIGH 7.0
Exploitation: Known exploited (CISA KEV) · added 2026-08-11
Exploited per ENISA since 2026-08-11
EPSS: EPSS 0.33 % · percentile 26 (2026-10-27)
State: PUBLISHED
Published: 2026-08-11
Updated: 2026-10-21
Assigner: microsoft
NVD status: Analyzed

Description

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	microsoft
CVSS 3.1	HIGH 7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	NVD · secure@microsoft.com (Secondary)

Weaknesses (CWE)

CWE-416

European references

ENISA EUVD · EUVD-2026-56468
GCVE · GCVE-0-2026-68820

CERT-FR advisories

CERTFR-2026-AVI-1001 — Multiples vulnérabilités dans Microsoft Windows · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* < 10.0.14393.9418
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* < 10.0.14393.9418
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* < 10.0.17763.9115
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* < 10.0.17763.9115
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* < 10.0.19044.7663
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* < 10.0.19045.7663
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* < 10.0.22631.7517
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:* < 10.0.26100.9106
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:* < 10.0.26200.9106
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:*:* < 10.0.28000.2704
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* < 10.0.14393.9418
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.9115
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.5440
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:* < 10.0.26100.33222

Affected products

Product	Versions
Microsoft · Windows 10 Version 1607	affected 10.0.14393.0 < 10.0.14393.9418
Microsoft · Windows 10 Version 1809	affected 10.0.17763.0 < 10.0.17763.9121
Microsoft · Windows 10 Version 21H2	affected 10.0.19044.0 < 10.0.19044.7663
Microsoft · Windows 10 Version 22H2	affected 10.0.19045.0 < 10.0.19045.7663
Microsoft · Windows 11 version 23H2	affected 10.0.22631.0 < 10.0.22631.7517
Microsoft · Windows 11 Version 23H2	affected 10.0.22631.0 < 10.0.22631.7517
Microsoft · Windows 11 Version 24H2	affected 10.0.26100.0 < 10.0.26100.9168
Microsoft · Windows 11 Version 25H2	affected 10.0.26200.0 < 10.0.26200.9168
Microsoft · Windows 11 version 26H1	affected 10.0.28000.0 < 10.0.28000.2704
Microsoft · Windows Server 2012	affected 6.2.9200.0 < 6.2.9200.26280
Microsoft · Windows Server 2012 (Server Core installation)	affected 6.2.9200.0 < 6.2.9200.26280
Microsoft · Windows Server 2012 R2	affected 6.3.9600.0 < 6.3.9600.23338
Microsoft · Windows Server 2012 R2 (Server Core installation)	affected 6.3.9600.0 < 6.3.9600.23338
Microsoft · Windows Server 2016	affected 10.0.14393.0 < 10.0.14393.9418
Microsoft · Windows Server 2016 (Server Core installation)	affected 10.0.14393.0 < 10.0.14393.9418
Microsoft · Windows Server 2019	affected 10.0.17763.0 < 10.0.17763.9121
Microsoft · Windows Server 2019 (Server Core installation)	affected 10.0.17763.0 < 10.0.17763.9121
Microsoft · Windows Server 2022	affected 10.0.20348.0 < 10.0.20348.5499
Microsoft · Windows Server 2025	affected 10.0.26100.0 < 10.0.26100.33296
Microsoft · Windows Server 2025 (Server Core installation)	affected 10.0.26100.0 < 10.0.26100.33296

References

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
CISA Known Exploited Vulnerabilities	CC0 1.0
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD