CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock, afd.sys, the kernel driver that backs every Winsock socket operation on every Windows install. Microsoft and NVD both score it 7.0 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H): local, authenticated, high attack complexity, and full impact on confidentiality, integrity and availability. That score understates its operational weight. Microsoft's own exploitability index reads "Publicly Disclosed: No; Exploited: Yes; Exploitation Detected", CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2026, the same day the patch shipped, with an August 25 remediation deadline, and Check Point Research, which discovered and reported the bug, attributes in-the-wild use to the DPRK-linked Lazarus group. It is a privilege escalation, not an entry point. It matters because it is the step that turns a phished user into a kernel-level intruder.
Note on scoring: some feeds, including an earlier version of this brief, carry 9.5 for this CVE. Neither NVD nor MSRC supports that figure. Both publish 7.0.
Am I vulnerable?
Effectively every supported Windows SKU was affected before the August 11, 2026 updates. afd.sys is not an optional component and there is no configuration that removes it, so exposure is purely a function of build number. Any host that has not taken an August 2026 or later cumulative update is vulnerable, including servers, domain controllers and virtual desktop images.
Affected versions
| Product |
Vulnerable range |
Fixed build |
KB |
| Windows 10 1607 / Server 2016 |
< 10.0.14393.9418 |
10.0.14393.9418 |
KB5120418 |
| Windows 10 1809 / Server 2019 |
< 10.0.17763.9121 |
10.0.17763.9121 |
KB5120238 |
| Windows 10 21H2 |
< 10.0.19044.7663 |
10.0.19044.7663 |
KB5120249 |
| Windows 10 22H2 |
< 10.0.19045.7663 |
10.0.19045.7663 |
KB5120249 |
| Windows 11 23H2 |
< 10.0.22631.7517 |
10.0.22631.7517 |
KB5120240 |
| Windows 11 24H2 |
< 10.0.26100.9168 |
10.0.26100.9168 (hotpatch 9106) |
KB5121003 (hotpatch KB5120994) |
| Windows 11 25H2 |
< 10.0.26200.9168 |
10.0.26200.9168 (hotpatch 9106) |
KB5121003 (hotpatch KB5120994) |
| Windows 11 26H1 |
< 10.0.28000.2704 |
10.0.28000.2704 |
KB5121000 |
| Windows Server 2022 |
< 10.0.20348.5499 |
10.0.20348.5499 (hotpatch 5440) |
KB5120242 (hotpatch KB5120229) |
| Windows Server 2025 |
< 10.0.26100.33296 |
10.0.26100.33296 (hotpatch 33222) |
KB5120233 (hotpatch KB5120228) |
| Windows Server 2012 (ESU) |
< 6.2.9200.26280 |
6.2.9200.26280 |
KB5120386 |
| Windows Server 2012 R2 (ESU) |
< 6.3.9600.23338 |
6.3.9600.23338 |
KB5120385 |
NVD's CPE data lists 10.0.17763.9115 for the 1809 line where MSRC lists 9121. MSRC is authoritative for fixed builds.
Diagnostic commands
Read-only checks. Run them as any user; none of them modify state.
Authoritative check, build plus UBR: the registry carries the revision number that [System.Environment]::OSVersion.Version drops.
$k = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
$build = [int]$k.CurrentBuild; $ubr = [int]$k.UBR
$fixed = @{ 14393=9418; 17763=9121; 19044=7663; 19045=7663; 22631=7517; 26200=9168; 28000=2704; 20348=5499 }
"$($k.ProductName) Build $build.$ubr"
if ($build -eq 26100) {
"Build 26100 is shared: Win11 24H2 fixes at UBR 9168 (hotpatch 9106), Server 2025 at 33296 (hotpatch 33222). Match on ProductName."
} elseif ($fixed.ContainsKey($build)) {
if ($ubr -lt $fixed[$build]) { "VULNERABLE - UBR $ubr below fixed UBR $($fixed[$build])" } else { "PATCHED" }
} else { "Build $build not in the affected list, verify against the MSRC table." }
A Windows 10 22H2 host reporting Build 19045.7515 is vulnerable, because 7515 is below 7663.
Driver on disk: (Get-Item C:\Windows\System32\drivers\afd.sys).VersionInfo | Select-Object FileVersion. Compare only the last field against the fixed UBR. On Windows 10 21H2 and 22H2 the file reports the 19041 servicing branch, not the 19044/19045 OS build. A stale value immediately after patching is expected: the loaded driver is not replaced until reboot.
KB presence: Get-CimInstance Win32_QuickFixEngineering | Where-Object HotFixID -in @('KB5120418','KB5120238','KB5120249','KB5120240','KB5121003','KB5120994','KB5121000','KB5120242','KB5120229','KB5120233','KB5120228','KB5120386','KB5120385'). Empty output suggests none of the August updates are present, but cumulative updates supersede one another, so a host patched in a later month also returns empty. Use this to corroborate the build check, not to replace it.
Hotpatch enrolment: Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, InstalledOn. Server 2022, Server 2025 and Windows 11 24H2/25H2 Enterprise hosts on the hotpatch channel are remediated at a lower UBR than the full security update. Flagging them on UBR alone produces false positives.
Vulnerability
The bug is a race condition in afd.sys that Check Point's researchers root-cause to two driver code paths operating on the same socket-related state concurrently without synchronization. An attacker who wins that window frees an object that the other path still holds a reference to, and the resulting use-after-free yields a kernel read and write primitive. From there the established route is stealing the SYSTEM token and injecting into a SYSTEM process. Microsoft's FAQ confirms the shape: a locally authenticated attacker runs a specially crafted application to trigger the race, and no user interaction is required. The High attack-complexity rating exists because the race has to be won, not because the outcome is uncertain once it is.
Tenable's Satnam Narang places the CVE in a sequence rather than treating it as an isolated finding: since 2022, three other afd.sys zero-days have been exploited in the wild, CVE-2024-38193, CVE-2025-21418 and CVE-2025-32709, and CVE-2024-38193 was itself reported as a Lazarus tool used to load the same rootkit family. The driver is an attractive target for structural reasons. It is present on every install, it is reachable from low-integrity and sandboxed contexts because sandboxed code still needs sockets, and it carries a large IOCTL surface handling per-socket state.
MSRC records no workaround and no mitigation for this CVE, only vendor fixes, and sets "Customer Action Required: Yes". There is no supported way to disable or unload afd.sys, since doing so removes all Winsock networking from the host. The update is the only remediation.
Threat model
Who would exploit this: State-aligned espionage operators are the confirmed users of this vulnerability today. Check Point Research attributes in-the-wild exploitation to the DPRK-linked Lazarus group, which ran it as the escalation stage of an Operation Dream Job intrusion against defense, aerospace, drone and robotics organizations. The local, authenticated attack vector rules out opportunistic mass exploitation and favours operators who already hold user-level code execution, notably targeted intrusion crews and initial-access brokers packaging SYSTEM-capable footholds for resale. Ransomware affiliates are the plausible next adopters, because a kernel privilege escalation that disables endpoint protection is precisely what they buy, though CISA currently records no known ransomware use and no public exploit code has surfaced.
What they're after:
- Defence evasion and EDR tampering, first in sequence: kernel access lets the operator strip security telemetry before any noisy activity begins
- Persistence via kernel-mode rootkit: the observed campaign deployed FudModule v3.1, followed by the ForestTiger or Troy backdoors
- Credential theft: SYSTEM privileges expose LSASS memory, cached domain credentials, Kerberos tickets and service account secrets
- Espionage and data exfiltration: the targeting profile (military technologies, surveillance sensors, drones, robotics) indicates intellectual property collection as the end goal
- Lateral movement and Active Directory escalation, converting one workstation into a path toward directory-wide compromise
- Onward targeting, reusing a compromised defense organization as a trusted launch point for further spear-phishing
Attack chain: This is a chained second-stage bug, not an internet-facing entry point, and it cannot be triggered remotely by an unauthenticated attacker. In the observed intrusions a recruitment-themed lure delivered a trojanized PDF viewer, or a legitimate viewer that sideloaded a malicious DLL, which ran an in-memory downloader in ordinary user context and fingerprinted the host before the operators released an exploit payload to validated targets only. The exploit abuses concurrent access to a socket in afd.sys, turning that race into a use-after-free that yields kernel memory access and SYSTEM privileges, after which the actor injects into a SYSTEM process. Kernel-mode tooling then lands and removes security visibility, clearing the way for a long-term backdoor.
Blast radius: A single compromised endpoint becomes a full kernel-level compromise. At SYSTEM the attacker reads LSASS for cached credentials, Kerberos tickets and service account secrets, converting one workstation into domain credential material and a viable path toward Active Directory escalation. Kernel access also lets the operator unhook EDR process, thread and image callbacks, terminate the ETW kernel logger, remove filesystem minifilters by altitude, and reset Smart App Control policy state, so the host stops generating the telemetry that would expose the rest of the intrusion. Because the vulnerable driver ships on every Windows install and is reachable from low-integrity and sandboxed contexts, any process that achieves even limited code execution inherits a route to SYSTEM until the August 2026 updates are applied.
Named operators: Lazarus group (DPRK), Operation Dream Job campaign, deploying the FudModule v3.1 kernel rootkit, per Check Point Research. A recovered FudModule artifact carries a compile timestamp of July 7, 2026, roughly five weeks before the fix shipped.
Mitigation
Patch
Deploy the SKU-appropriate August 11, 2026 update from the table above. A reboot is required: the running afd.sys is not replaced until restart, so a host showing the new KB but the old loaded driver version is still exploitable. Hosts on the hotpatch channel (Server 2022, Server 2025, Windows 11 24H2 and 25H2 Enterprise) take KB5120229, KB5120228 or KB5120994 respectively and land at a lower UBR than the full LCU.
Enumerate what is missing across an estate before deploying, read-only:
$s = New-Object -ComObject Microsoft.Update.Session
$r = $s.CreateUpdateSearcher().Search("IsInstalled=0 AND Type='Software'")
$r.Updates | Select-Object Title, @{n='KB';e={$_.KBArticleIDs -join ','}}, MsrcSeverity | Format-Table -AutoSize
Windows Server 2012 and 2012 R2 are covered only through Extended Security Updates (KB5120386 and KB5120385). Hosts outside ESU on those versions have no fix.
Configuration mitigation
There is no configuration workaround, and it is worth stating explicitly so nobody spends a maintenance window looking for one:
# AFD (\Device\Afd) backs every Winsock socket operation on Windows.
# Stopping or blocking the driver removes all TCP/IP networking from the host.
# Microsoft publishes no workaround and no mitigation for CVE-2026-68820.
# Read-only confirmation that the driver is present and running:
Get-Service afd | Select-Object Name, Status, StartType
Compensating controls
Until every host is patched, the useful controls target the stages either side of the escalation rather than the escalation itself.
- Cut off the delivery stage. The observed chain starts with a recruitment lure and a sideloaded DLL or trojanized PDF viewer. Application control (WDAC or AppLocker) enforcing signed-binary policy in user-writable paths breaks DLL sideloading, and blocks the downloader before it ever reaches the kernel bug.
- Deny the precondition. The exploit needs local code execution as an ordinary user. Removing local administrator rights does not stop it (PR:L is enough), but attack surface reduction rules that block Office and PDF readers from spawning child processes remove the common route to that execution.
- Protect the payoff. Enable LSA Protection (RunAsPPL) and Credential Guard where hardware permits. Neither survives a determined kernel-mode attacker, but both raise the cost of the credential-theft step that follows.
- Watch for blinding. Alert on EDR sensor telemetry stopping on a host that is still reachable on the network. Once a kernel read and write primitive exists, the absence of expected telemetry is frequently the only remaining signal.
- Prioritise by exposure. Multi-user hosts (VDI, RDS session hosts, jump boxes, build agents) are the highest-value targets for a local escalation, because one user-level foothold there reaches many sessions. Patch those before single-user laptops.
Detection (starter rules, validate before deploying)
These rules are AI-generated starter content. Test against your own telemetry and tune falsepositives before deploying to production.
Set expectations first: there is no usable network signal for this CVE. It is a local kernel use-after-free with no remote trigger and no wire artefact, so a NIDS rule is not the right instrument. The exploit-stage host signals are also largely invisible to stock tooling, and the broadly deployable detection is the post-exploitation token theft.
Network and log signals
- Token-theft lineage (highest value, works with standard telemetry): a process running as
NT AUTHORITY\SYSTEM at System integrity whose parent was an ordinary interactive user context. Hunt Sysmon EID 1 (needs Sysmon v13+ for the ParentUser field) or Security 4688 with token-elevation enrichment. This is the artefact of the escalation, not the use-after-free itself, and it is what caught prior afd.sys abuse by FudModule-family tooling.
\Device\Afd handle opens from processes with no networking role: Office child processes, browser renderer spawn, scripting hosts, binaries in %TEMP%, %PUBLIC% or %PROGRAMDATA%. Visibility caveat: neither the Windows Security log nor stock Sysmon records device-object opens. This needs an EDR kernel driver with object-callback telemetry, or Microsoft-Windows-Kernel-Audit-API-Calls / ETW Threat Intelligence. Without a kernel-mode sensor the signal is simply unavailable, and an absence of alerts means nothing.- Anomalous IOCTL traffic to an AFD handle: high-rate or unusual-code
NtDeviceIoControlFile calls from a single low or medium integrity process. For a use-after-free the reliable pattern is a rate and sequencing anomaly (rapid socket create and close churn plus repeated IOCTLs on the same endpoint, consistent with grooming a freed object) rather than one magic function code. Requires EDR syscall visibility or ETW-TI.
- Kernel crash clusters referencing
afd.sys: System log Event ID 1001 (source BugCheck) and Kernel-Power Event ID 41, with bugcheck codes 0x3B, 0x139, or 0x50 and 0xC4 under Driver Verifier. Failed race attempts blue-screen the host, so a cluster of afd.sys bugchecks across several endpoints in a short window is a strong hunting lead. Corroborate against C:\Windows\Minidump and WER ReportArchive entries naming the driver.
- Rootkit and blinding follow-on: a newly-SYSTEM process loading an unsigned or unusual driver (Sysmon EID 6),
CreateRemoteThread into a protected process (EID 8), process access whose CallTrace begins with UNKNOWN rather than ntdll (EID 10, direct syscalls), or sensor telemetry abruptly going silent on a live host.
- Post-exploitation network activity: first-seen outbound C2 from a SYSTEM-context process (Sysmon EID 3), particularly where the image path is world-writable, followed by SMB or WinRM lateral movement and Security 4672/4673 privileged-service events on logon sessions that should not hold those privileges. Check Point reports C2 in this campaign ran through compromised Roundcube and WordPress servers, so destination reputation is a weak filter.
YARA
rule CVE_2026_68820_AFD_LPE_starter
{
meta:
description = "Behavioural heuristic for a user-mode loader or stager that drives the AFD WinSock device object and performs kernel token manipulation. NOT a signature for any confirmed CVE-2026-68820 sample and contains no sample-specific hashes."
author = "CVE Brief (AI-generated starter rule)"
date = "2026-08-17"
reference = "CVE-2026-68820 Windows Ancillary Function Driver for WinSock (afd.sys) use-after-free, CISA KEV"
confidence = "low"
note = "Weak signal by design. A kernel use-after-free leaves little on disk, and every string below appears in legitimate networking, diagnostic and offensive-security tooling. Validate and tune before deploying. Does not match packed or obfuscated binaries."
strings:
// AFD device object, as referenced by a user-mode driver of the bug
$afd1 = "\\Device\\Afd" ascii wide nocase
$afd2 = "\\Device\\Afd\\Endpoint" ascii wide nocase
$afd3 = "AfdDeviceIoControl" ascii wide
// Native API surface used to reach and abuse the driver
$api1 = "NtDeviceIoControlFile" ascii
$api2 = "NtQuerySystemInformation" ascii
$api3 = "NtQueryInformationProcess" ascii
$api4 = "NtDuplicateObject" ascii
$api5 = "NtWriteVirtualMemory" ascii
// Kernel address discovery and token manipulation indicators
$tok1 = "SystemHandleInformation" ascii wide
$tok2 = "SystemExtendedHandleInformation" ascii wide
$tok3 = "SystemModuleInformation" ascii wide
$tok4 = "PsInitialSystemProcess" ascii wide
$tok5 = "SeDebugPrivilege" ascii wide
$tok6 = "SeLoadDriverPrivilege" ascii wide
condition:
uint16(0) == 0x5A4D
and filesize < 5MB
and 1 of ($afd*)
and 2 of ($api*)
and 2 of ($tok*)
}
Sigma
title: SYSTEM Process Spawned by Non-SYSTEM Parent (Possible AFD.sys Kernel LPE, CVE-2026-68820)
id: 7c1e4a2f-9b63-4d18-8a05-3e6f2d9c47b1
status: experimental
description: |
Detects a process running as NT AUTHORITY\SYSTEM at System integrity whose parent
process was running in an ordinary (non-SYSTEM) user context. This parent/child token
mismatch is the classic post-exploitation artefact of a Windows kernel privilege
escalation such as CVE-2026-68820, a use-after-free in the Ancillary Function Driver
for WinSock (afd.sys) listed in CISA KEV as actively exploited: a low-privileged
process steals the SYSTEM token via a kernel read/write primitive and then spawns a payload.
Scope note: this rule does NOT detect the AFD IOCTL abuse itself. Device-object opens on
\Device\Afd and anomalous NtDeviceIoControlFile calls are not present in the Windows
Security log or in stock Sysmon telemetry and require a kernel-mode EDR sensor or ETW
Threat Intelligence. Treat this as generic kernel-token-theft coverage, not CVE-specific.
references:
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
author: CVE Brief (AI-generated starter rule, validate in your environment before deploying)
date: 2026/08/17
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t1134.001
- cve.2026.68820
logsource:
product: windows
category: process_creation
detection:
selection:
IntegrityLevel: 'System'
User|contains: 'AUTHORITY\SYSTEM'
filter_optional_system_parent:
ParentUser|contains:
- 'AUTHORITY\SYSTEM'
- 'AUTHORITY\LOCAL SERVICE'
- 'AUTHORITY\NETWORK SERVICE'
filter_optional_service_hosts:
ParentImage|endswith:
- '\services.exe'
- '\wininit.exe'
- '\winlogon.exe'
- '\smss.exe'
- '\csrss.exe'
- '\lsass.exe'
- '\svchost.exe'
- '\TrustedInstaller.exe'
- '\MsMpEng.exe'
filter_optional_no_parent_user:
ParentUser: null
condition: selection and not 1 of filter_optional_*
falsepositives:
- Endpoint agents, RMM and patch-management platforms (SCCM, Intune, Tanium, NinjaOne, Datto) whose user-context broker launches SYSTEM helpers
- Backup, imaging and antivirus products that spawn SYSTEM maintenance tasks from an elevated user-context UI
- Legitimate administrative remote execution (PsExec, WinRM, DCOM and scheduled-task deployment) performed by IT staff
- Software installers and driver-update utilities running elevated that hand off work to a SYSTEM service
- Non-English Windows builds where the SYSTEM account name is localised, causing the User and ParentUser matches to behave unexpectedly
- Sysmon below v13 and raw Security 4688 events do not carry ParentUser, so the filters silently fail open and the rule becomes very noisy. Confirm field availability before enabling
level: high
Rule notes
The Sigma rule is the deployable half. It keys on the parent/child token mismatch (a non-SYSTEM parent spawning a SYSTEM, System-integrity child) that follows a successful kernel token steal, a pattern with precedent in SigmaHQ's kernel-driver token-stealing rule and in Elastic's token-theft coverage. It fires only after exploitation succeeds, and it depends on Sysmon v13+ ParentUser enrichment. Without that field the filters fail open and the rule is very noisy, so confirm telemetry before enabling.
The YARA rule is deliberately marked low confidence. A use-after-free in a kernel driver leaves essentially nothing on disk, so the rule can only score a user-mode loader that references the AFD device object alongside token-manipulation APIs in an unpacked binary. It will miss packed exploits and will match legitimate networking and offensive-security tooling. Scope it to quarantined samples and staged tooling, not to a filesystem sweep.
SOC Prime reported no public proof-of-concept for CVE-2026-68820 as of publication, which suggests exploitation is currently confined to the original actor rather than commodity tooling. Check Point published SHA256 indicators for the MISTPEN, ForestTiger, Troy, RelayShell and SecurityPDF components of the campaign; those are worth ingesting alongside the behavioural rules above.
References