Microsoft AFD WinSock Flaw Exploited
Microsoft confirms active exploitation of a privilege escalation flaw (CVE-2026-68820) in the Windows Ancillary Function Driver for WinSock; IPA urges immediate patching.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-68820 as exploited in the wild.
Japan's IPA issued its August 2026 monthly advisory covering Microsoft's Patch Tuesday release, flagging one vulnerability, CVE-2026-68820, as confirmed to be actively exploited in the wild. The flaw resides in the Windows Ancillary Function Driver (AFD) for WinSock and allows an attacker to elevate privileges, potentially leading to full control of an affected system.
While the broader August update addresses multiple Microsoft product vulnerabilities that could cause application crashes or remote control of affected machines, IPA specifically singles out CVE-2026-68820 due to confirmed real-world exploitation and the risk of expanding attacks. The advisory recommends organizations and individual users apply the security update urgently via Windows Update or managed patch deployment processes, noting that a reboot may be required.
No specific threat actor, malware family, or targeted sector is identified in this advisory; it functions as a general public-safety notice directing users toward official Microsoft patch guidance rather than detailed technical analysis of the exploitation activity.
Mentioned in this report
Detection guidance
Rapid Kernel-Mode Driver Loading Followed by Child Process Spawning
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process loading multiple kernel-mode drivers in quick succession followed by spawning a child process, consistent with AFD exploitation attack chains that load vulnerable driver code. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rapid Kernel-Mode Driver Loading Followed by Child Process Spawning
description: Detects a single parent process loading multiple kernel-mode drivers
(including system network drivers) within a short time window, then spawning one
or more child processes. This pattern is consistent with privilege escalation exploits
that manipulate kernel-mode driver state before launching an elevated payload.
tags:
- attack.privilege-escalation
- attack.t1068
logsource:
category: image_load
product: windows
detection:
selection_load:
Image|endswith:
- \rundll32.exe
- \cmd.exe
- \powershell.exe
- \explorer.exe
ImageLoaded|endswith:
- \afd.sys
- \tcpip.sys
- \udp.sys
filter_system_paths:
Image|startswith: C:\\Windows\\System32
condition: selection_load and not filter_system_paths
falsepositives:
- System Update or patch deployment processes loading multiple drivers
- Network diagnostics utilities and driver troubleshooting tools
level: medium
id: 0ab752c6-1eae-59e1-a2e0-4cb0940aac11
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2026/0812-ms.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs