Our automated tracking framework flagged that CISA added CVE-2026-68820 (Microsoft Windows Ancillary Function Driver for WinSock) to the Known Exploited Vulnerabilities (KEV) catalog on August 13, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-68820 by August 25, 2026 — a 14-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-68820 |
| Vendor / product | Microsoft Windows Ancillary Function Driver for WinSock |
| Vulnerability | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability |
| CVSS base score | 7 |
| Added to KEV | August 11, 2026 |
| Days public before listing (NVD → KEV lag) | 0 |
| Federal patch deadline | August 25, 2026 |
| Known ransomware use | No |
How This Compares to Microsoft’s Track Record
This one was listed on or before its public disclosure (a lag of 0 days) — a zero-day exploited at or before the vulnerability was even published. Microsoft currently ranks #18 on our KEV Lag leaderboard.
| Microsoft in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 383 |
| Median lag (public → KEV listing) | 567 days |
| 0-day rate (exploited at or before disclosure) | 23% |
| Entries tied to known ransomware campaigns | 104 |
For perspective, the median across all 1665 tracked KEV entries is 271 days — Microsoft’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Microsoft KEV Additions
The most recent Microsoft vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-50522 | SharePoint | July 22, 2026 | 8 | No |
| CVE-2026-58644 | SharePoint | July 16, 2026 | 2 | No |
| CVE-2026-56155 | Active Directory Federation Services | July 14, 2026 | 0 | No |
| CVE-2026-56164 | SharePoint Server | July 14, 2026 | 0 | No |
| CVE-2026-45659 | SharePoint Server | July 1, 2026 | 40 | No |
Defense guide: How to Detect Zero-day Vulnerability: Attack Chain & Defense — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog. This use-after-free vulnerability in the Microsoft Windows Ancillary Function Driver for WinSock carries a CVSS base score of 7, posing a significant risk. With its KEV listing on August 11, 2026, and a federal patch deadline of August 25, 2026, patching is urgent. Organizations using Microsoft Windows should prioritize applying the patch immediately.
The critical factor is the ‘0 days public before KEV listing.’ This indicates exploitation was likely occurring as a zero-day or very soon after disclosure, suggesting quick weaponization by threat actors. This rapid listing leaves little detection window for most organizations before CISA’s warning. While known ransomware use isn’t indicated, active exploitation necessitates prompt action to prevent potential data breaches or system compromise.
If immediate patching isn’t feasible before the August 25th deadline, implement strong compensating controls. These include network segmentation to restrict access to affected systems and applying least privilege principles. Enhance monitoring for unusual activity originating from or targeting Windows Ancillary Function Driver components.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
