Microsoft Patch Tuesday Fixes Active Windows Driver Exploit
Microsoft’s August Patch Tuesday fixed about 398 CVEs, and Microsoft says CVE-2026-68820 is the only one already under active exploitation. The flaw sits in afd.sys, the Windows Ancillary Function Driver for WinSock, and it can take an attacker from code already running on a machine to SYSTEM.
The bug is a use-after-free in core networking code: an attacker keeps hitting a race condition until memory is reused the wrong way, then the process escapes ordinary user rights. That makes it a post-foothold escalation step, so a phish or dropped payload can turn into full local control even though the bug is not an initial-entry path.
The same release also includes four unauthenticated 9.8 remote code execution flaws in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack. If Windows endpoints or exposed Microsoft server roles are in your environment, the urgent question is not just internet-facing exposure but how quickly a low-privilege foothold could be turned into SYSTEM.