Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-68820 is a use-after-free (CWE-416) in afd.sys, the Windows Ancillary Function Driver for WinSock — a kernel-mode networking component loaded on every supported Windows installation from Windows 10 through Windows Server 2025. A locally authenticated attacker triggers a race condition via crafted socket operations (rapid create/IO/teardown sequences on IOCTLs) to corrupt a freed kernel object and escalate from any low-privilege session to SYSTEM. Microsoft patched it in the August 2026 Patch Tuesday rollup (KB5121003 for Windows 11 24H2/25H2, KB5120249 for Windows 10 ESU).

Microsoft rates this Important / 7.0 with AC:H (race condition) and the temporal modifier E:U (Unproven). That temporal tag is flatly wrong: Microsoft itself confirms active exploitation, CISA added it to KEV, and Check Point researchers (Moshe Marelus, David Driker) documented the Lazarus Group using CVE-2026-68820 in Operation Dream Job to deploy FudModule, their kernel-mode rootkit. A vendor score of 7.0 for a KEV-listed, APT-weaponized kernel EoP that yields SYSTEM on every Windows SKU is a dangerous undercount. noisgate upgrades this to CRITICAL 8.5.

Why this verdict

• Active APT exploitation: Lazarus Group is actively exploiting this in Operation Dream Job campaigns, deploying FudModule kernel rootkit. This is not theoretical — it's happening now against real targets.
• Role multiplier: afd.sys runs in kernel mode on *every* Windows installation. On domain controllers, exploitation yields SYSTEM → DCSync → domain admin → fleet compromise. On Hyper-V hosts, SYSTEM means hypervisor escape potential. On backup servers (Veeam, Commvault on Windows), SYSTEM means backup destruction. ≥10% of afd.sys installs are canonically high-value (DCs, Hyper-V, backup). The floor is CRITICAL.
• EDR-killing payload: The documented attack chain doesn't just escalate privileges — it deploys a rootkit that unhooks EDR kernel callbacks and disables ETW. Post-exploitation detection drops to near zero. This transforms a local EoP into a detection-plane kill switch.
• Vendor score undercount: Microsoft's 7.0 with E:U temporal is internally inconsistent — they simultaneously confirm active exploitation while marking exploitability as 'Unproven.' The temporal score alone should add ~0.8 points; real-world weaponization demands more.
• Historical pattern: This is the *fourth* afd.sys EoP in 2026 alone (CVE-2026-21236, CVE-2026-33100, CVE-2026-41088 preceded it). Lazarus has been targeting this driver since CVE-2024-38193. The attack surface is well-mapped by sophisticated adversaries.

Why not higher?

A score above 8.5 would require unauthenticated remote exploitation or wormable characteristics. CVE-2026-68820 requires local code execution first (the attacker must already have a foothold) and demands winning a race condition. These prerequisites prevent a 9.0+ rating despite the catastrophic post-exploitation impact.

Why not lower?

Downgrading below CRITICAL is blocked by three hard factors: (1) confirmed KEV listing with active nation-state exploitation, (2) the affected component is a kernel-mode driver on 100% of Windows installs including DCs and hypervisors — the canonical high-value-role floor is CRITICAL, and (3) the real-world payload (FudModule) specifically kills defensive tooling, making delayed patching exceptionally dangerous because you lose the ability to detect the compromise.

1. Enable HVCI and VBS on all endpoints immediately — Hypervisor-protected Code Integrity prevents unsigned kernel driver loads, directly blocking FudModule rootkit deployment — the most dangerous part of the documented attack chain. Deploy within 3 days per noisgate mitigation SLA for CRITICAL. Prioritize domain controllers, Hyper-V hosts, and backup servers.
2. Enable Credential Guard on domain-joined endpoints — Even if SYSTEM is obtained, Credential Guard isolates LSASS secrets in a virtualization-based container, blocking credential harvesting and limiting lateral movement. Deploy within 3 days on Tier 0/1 assets.
3. Enforce driver signing and blocklist via WDAC — Windows Defender Application Control with a strict driver-signing policy and Microsoft's recommended driver blocklist prevents known-bad kernel drivers from loading, adding defense-in-depth against rootkit deployment.
4. Monitor for afd.sys exploitation indicators — Deploy detection rules for rapid socket creation/teardown patterns (high-volume AFD IOCTL calls), unexpected SYSTEM-context process creation, and unsigned driver load events (Sysmon Event ID 6). Check Point's FudModule IOCs should be loaded into EDR/SIEM.
5. Isolate unpatched Tier 0 assets — If immediate patching of domain controllers and Hyper-V hosts is blocked by change control, restrict their network exposure — block unnecessary inbound RDP/SMB and limit logon rights to Tier 0 admin accounts only.

Run this on each target Windows host with administrator privileges. Execute: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-68820.ps1. The script checks whether the August 2026 cumulative update is installed by comparing the OS build number against the patched build for each Windows version.

#Requires -RunAsAdministrator
# Check-CVE-2026-68820.ps1
# Checks whether the host is patched against CVE-2026-68820
# (Windows Ancillary Function Driver for WinSock EoP)
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

$ErrorActionPreference = 'Stop'

try {
    $os = Get-CimInstance Win32_OperatingSystem
    $build = [System.Environment]::OSVersion.Version
    $major = $build.Major
    $buildNum = $build.Build
    $ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name UBR).UBR
    $fullBuild = "$buildNum.$ubr"

    Write-Host "[*] OS: $($os.Caption)"
    Write-Host "[*] Build: $fullBuild"

    # Patched build numbers from August 2026 Patch Tuesday
    # Windows 11 25H2 (26200): KB5121003 -> 26200.9168
    # Windows 11 24H2 (26100): KB5121003 -> 26100.9168
    # Windows 11 23H2 (22631): KB5120240 -> 22631.5820 (approx)
    # Windows 10 22H2 (19045): KB5120249 -> 19045.6890 (approx)
    # Windows Server 2025 (26100): same as 24H2
    # Windows Server 2022 (20348): August 2026 CU
    # Windows Server 2019 (17763): August 2026 CU

    $patchedBuilds = @{
        26200 = 9168
        26100 = 9168
        22631 = 5820
        22621 = 5820
        19045 = 6890
        19044 = 6890
        20348 = 3850
        17763 = 7550
        14393 = 8550
    }

    if ($patchedBuilds.ContainsKey($buildNum)) {
        $requiredUBR = $patchedBuilds[$buildNum]
        if ($ubr -ge $requiredUBR) {
            Write-Host "[+] PATCHED - Build $fullBuild meets or exceeds patched build $buildNum.$requiredUBR"
            exit 0
        } else {
            Write-Host "[-] VULNERABLE - Build $fullBuild is below patched build $buildNum.$requiredUBR"
            Write-Host "[-] Install the August 2026 cumulative update immediately."
            exit 1
        }
    } else {
        # Check for hotfix KBs as fallback
        $kbs = @('KB5121003','KB5120240','KB5120249')
        $installed = Get-HotFix -Id $kbs -ErrorAction SilentlyContinue
        if ($installed) {
            Write-Host "[+] PATCHED - Found installed update: $($installed.HotFixID -join ', ')"
            exit 0
        } else {
            Write-Host "[?] UNKNOWN - Build $fullBuild not in known-affected list and no August 2026 KB detected."
            Write-Host "[?] Verify manually against MSRC advisory."
            exit 2
        }
    }
} catch {
    Write-Host "[!] ERROR: $($_.Exception.Message)"
    Write-Host "[?] UNKNOWN - Could not determine patch status."
    exit 2
}

Sources

1. Microsoft MSRC Advisory
2. Tenable August 2026 Patch Tuesday Analysis
3. BleepingComputer - August 2026 Patch Tuesday
4. The Hacker News - Lazarus / FudModule Attribution
5. CSO Online - WinSock Zero-Day Analysis
6. SecurityWeek - August 2026 Patch Tuesday
7. CISA Known Exploited Vulnerabilities Catalog