Windows AFD Exploitation Turns Local Access Into SYSTEM Risk

Microsoft disclosed CVE-2026-68820 on August 11 and marked exploitation detected. The use-after-free flaw sits in the Windows Ancillary Function Driver for WinSock, commonly called AFD. A locally authenticated attacker can run a crafted application, win a race condition, and gain SYSTEM privileges without further user interaction. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day and set an August 25 remediation deadline for covered federal systems.

This is not a remote, unauthenticated entry point. An attacker needs credentials and local code execution first. That limitation does not make the flaw routine: it can convert a constrained foothold into the highest local Windows privilege across a wide client and server estate. Teams should deploy the August updates, verify the running build on every in-scope system, and investigate evidence that a low-privilege process or account unexpectedly crossed into SYSTEM during the exposure window.

Microsoft released CVE-2026-68820 with its August 11 security updates. The company rates it Important with a CVSS 3.1 base score of 7.0 and says exploitation has been detected. CISA added the same CVE to KEV on August 11. The federal catalog entry requires remediation by August 25 for covered systems and lists known ransomware use as unknown.

The score reflects meaningful preconditions. The vector is local, requires low privileges, and assigns high attack complexity because the attacker must win a race condition. Those properties reduce the number of situations in which exploitation works. They do not reduce the impact after it works: Microsoft says the result can be SYSTEM, with high confidentiality, integrity, and availability impact.

Operational priority should therefore follow evidence of exploitation and the role of the affected asset, not a simple sort by base score. A Windows workstation used by an administrator, a jump server, a domain controller, a build agent, or a collaboration server can give a new SYSTEM process very different downstream authority. Patch urgency is broad; incident scope remains asset-specific.

AFD is a kernel networking component used by the Windows sockets implementation. Microsoft's description classifies CVE-2026-68820 as a use-after-free condition. A locally authenticated attacker runs a specially crafted application that triggers a race condition in the affected driver. No second user needs to open a file, click a prompt, or approve an elevation request.

That sequence defines the boundary of the confirmed claim. The vulnerability does not let an unauthenticated internet user directly reach SYSTEM. An attacker must already have credentials and a way to execute code on the device. That first step could come from phishing, a malicious download, a stolen remote session, another vulnerability, an abused management tool, or a legitimate insider, but Microsoft has not identified the path used in the observed exploitation.

Defenders should treat the CVE as a privilege-escalation link in a longer attack chain. Preventive controls that block initial execution still matter, as do application control and least privilege. They are not substitutes for the update. Once low-privilege code is running, the vulnerable driver sits below many user-mode controls, and SYSTEM can make persistence, credential access, defense evasion, and lateral movement easier.

Microsoft's release data lists Windows 11 versions 23H2, 24H2, 25H2, and 26H1, plus Windows 10 versions 1607, 1809, 21H2, and 22H2 across the applicable architectures. Server coverage includes Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core where Microsoft lists it. Some older releases receive the fix through Extended Security Updates rather than ordinary support.

A useful inventory therefore includes managed laptops, persistent and nonpersistent virtual desktops, remote desktop hosts, servers, golden images, build runners, lab systems, recovery media, cloud marketplace images, and powered-down disaster-recovery machines. A dormant image can reintroduce the flaw after the active fleet reports healthy. Unsupported Windows releases without an available security path need isolation, migration, or retirement rather than a false compliant state.

Do not infer exposure solely from whether a system provides public network services. The exploit path is local, so an internet-facing role is not required. Prioritize systems where attackers are more likely to gain user-level execution or where SYSTEM has valuable reach: administrator workstations, shared terminal servers, identity infrastructure, software delivery systems, monitoring servers, and machines holding service credentials.

The August CVRF maps the fix to version-specific packages. Examples include KB5121003 for Windows 11 24H2 and 25H2, KB5121000 for Windows 11 26H1, KB5120240 for Windows 11 23H2, KB5120249 for Windows 10 21H2 and 22H2, KB5120233 for Windows Server 2025, and KB5120242 for Windows Server 2022. Older Server and ESU releases use different packages. Administrators should use the CVE page for the exact product and architecture rather than copying one KB across the estate.

Microsoft's remediation records for this CVE mark the update path as requiring a restart. Confirm the running OS build after that restart. A successful download, an installation command that returned zero, or a management console that has not refreshed is weaker evidence. Windows Update for Business reports, endpoint management inventory, and direct build checks can be reconciled to identify devices that missed, deferred, rolled back, or failed the update.

Record when each system crossed the fixed boundary. That timestamp helps investigators separate earlier process activity that could have used vulnerable code from later activity on the corrected build. It also exposes operational gaps such as maintenance rings that do not include servers, devices that rarely connect, nonpersistent pools that reverted to an old base image, and hotpatch assumptions that did not match the CVE remediation record.

Neither Microsoft nor CISA has published a campaign-specific process name, file hash, command line, or network indicator for CVE-2026-68820. Searching for the CVE string in endpoint telemetry will not establish whether it ran. Start instead with the prerequisite and result: code executing under a constrained local identity, followed by a new or unusual process, service, scheduled task, driver interaction, credential access, or security-control change under SYSTEM.

Microsoft Defender XDR's DeviceProcessEvents table records process creation and related context where Defender for Endpoint is deployed. Native Windows event 4688 can also record new processes; command-line content is present only when the corresponding audit policy is enabled, and that content can contain sensitive values. Correlate process ancestry with logons, file creation, service installation, scheduled tasks, endpoint alerts, application-control events, and outbound connections during the vulnerable period.

No single SYSTEM child process proves exploitation of AFD. Windows legitimately creates many processes at that privilege. Look for deviations from the known behavior of the asset, especially processes whose parent, signer, path, user transition, or timing does not fit normal administration. If telemetry is missing, state that limitation explicitly. Absence of evidence from logs that were never collected is not evidence that a device remained uncompromised.

If evidence suggests successful escalation, isolate the device through a trusted control path, preserve volatile and durable evidence, and determine the earliest plausible user-level execution. The first foothold matters because patching AFD removes the escalation route but may leave the original malware, stolen session, remote tool, or abused account intact. Reimage systems whose integrity cannot be established from reliable evidence and known-good state.

Scope what SYSTEM could access on that machine. Review local and domain credentials, service identities, browser sessions, SSH keys, management agents, signing material, deployment tokens, and reachable administrative shares according to the host's real function. Rotate secrets when evidence or access design supports exposure. Broad, uncoordinated rotation can erase evidence or cause outages, so tie each action to the investigation timeline and dependency map.

The public record is deliberately narrow as of August 12. It confirms active exploitation, the local prerequisite, the race condition, SYSTEM impact, affected products, and fixed packages. It does not identify the actor, victims, initial-access method, exploit reliability, post-exploitation payloads, or ransomware use. Patch and investigate from those confirmed facts without filling the unknowns with campaign assumptions.