Windows AFD privilege escalation, exploited (CVE-2026-68820)

Actively exploited in the wild - CVE-2026-68820 is a high-severity use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) that lets an authenticated attacker elevate privileges to SYSTEM. Microsoft has released a patch in the March 2026 security update; apply it immediately.

Overview

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sock). This kernel-mode driver handles Windows Sockets operations. A use-after-free occurs when a program continues to reference memory after it has been freed, which can lead to corrupted memory states.

An attacker who can execute code on a target machine can exploit this flaw to gain SYSTEM-level privileges, the highest level of access in Windows. The attack requires local access and low privileges to start, but the complexity of the exploit is rated high, meaning it takes skill to execute reliably. No user interaction is needed.

This vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are using it in real-world attacks. The exploitation could be leveraged as part of a post-compromise chain, where an attacker who has already gained a foothold on a system uses this bug to move from a low-privilege user account to full administrative control.

Impact

Successful exploitation of CVE-2026-68820 gives an attacker complete control over the affected Windows host. This allows them to:

• Disable security tools and antivirus software.
• Install persistent backdoors and malware.
• Steal credentials, data, and encryption keys.
• Move laterally across the network with elevated privileges.

Given that this is a local privilege escalation, the attack surface is restricted to systems where the attacker already has some form of code execution, such as a compromised user account or malware already present on the machine.

Mitigation and Remediation

Microsoft has addressed this vulnerability in the March 2026 Patch Tuesday release. All Windows versions using the affected afd.sys driver should be updated immediately.

1. Apply Patches: Prioritize the installation of the latest Windows security updates on all endpoints and servers. Treat this as an emergency change given the active exploitation.
2. Monitor Endpoints: Review systems running the older driver version for indicators of compromise, particularly looking for unusual privilege escalation activity or new SYSTEM-level processes.
3. Apply the Principle of Least Privilege: Minimize the number of local user accounts with write or execute permissions to reduce the initial foothold an attacker can gain.

Security Insight

The Ancillary Function Driver is a high-value target for attackers because it is a default component of the Windows networking stack, present on every modern Windows system. This vulnerability highlights a recurring trend: attackers are focusing on kernel-mode components that provide a reliable and universal path to privilege escalation. The confirmation by CISA KEV suggests that despite Microsoft’s hardening efforts, the attack surface in legacy kernel drivers remains a viable vector for advanced persistent threats.

Related: Russian CTRL Toolkit Hijacks RDP via Malicious LNK | Windows 11 KB5079391 update rolls out Smart App Control | Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning | Windows93 Data Breach: 46K Accounts Exposed (2026)

Further Reading

• Russian CTRL Toolkit Hijacks RDP via Malicious LNK
• Windows 11 KB5079391 update rolls out Smart App Control
• Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs