Report · Cisco TalosAbout CVE-2026-68820Published 11 Aug 2026

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Affects Microsoft Windows Ancillary Function Driver for WinSockSource Cisco Talos

Mentioned vulnerabilities

Authoritative record:CVE-2026-68820· High 7.0

Exploited in the wild · KEV due 25 Aug 2026 · 8% EPSS · fixed in 10.0.14393.9418 : patch Microsoft Windows Ancillary Function Driver for WinSock now.

Data as of 8 Nov 2026, 23:24 UTC

CVSS 3.1 base score

7.0High

How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none

CVSS scores by source
CNA (microsoft)	CVSS 3.1	7.0

KEV deadline: 25 Aug 2026 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
EPSS: 8.5% chance of exploitation in 30 days – higher than 95% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 10.0.14393.9418, 10.0.17763.9121, 10.0.19044.7663 +9

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Base metrics

Attack Vector: Local
Attack Complexity: High
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Temporal metrics

Exploit Code Maturity: Unproven
Remediation Level: Official Fix
Report Confidence: Confirmed

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Exploit Code Maturity: Unproven: No exploit code is available, or an exploit is theoretical.
Remediation Level: Official Fix: A complete vendor solution is available. Either the vendor has issued an official patch, or an upgrade is available.
Report Confidence: Confirmed: Detailed reports exist, or functional reproduction is possible (functional exploits may provide this). Source code is available to independently verify the assertions of the research, or the author or vendor of the affected code has confirmed the presence of the vulnerability.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 11 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: evidence found.
Listed in CISA KEV the same day as disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

CVE ID reserved
by Microsoft Corporation
31 Jul 202616:41 UTC, 11 days before disclosure
CVE published
on cve.org
11 Aug 202617:05 UTC, t = 0
In Threat Radar
record ingested
11 Aug 202617:13 UTC, 8 minutes after disclosure
Added to CISA KEV (opens in a new tab)
exploitation confirmed
11 Aug 2026, the same day as disclosure
KEV remediation due
US federal deadline
25 Aug 2026, 14 days after disclosure

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 9 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
MicrosoftWindows 10 Version 1607	Affected >=10.0.14393.0 <10.0.14393.9418	Fixed in 10.0.14393.9418
MicrosoftWindows 10 Version 1809	Affected >=10.0.17763.0 <10.0.17763.9121	Fixed in 10.0.17763.9121
MicrosoftWindows 10 Version 21H2	Affected >=10.0.19044.0 <10.0.19044.7663	Fixed in 10.0.19044.7663
MicrosoftWindows 10 Version 22H2	Affected >=10.0.19045.0 <10.0.19045.7663	Fixed in 10.0.19045.7663
MicrosoftWindows 11 version 23H2	Affected >=10.0.22631.0 <10.0.22631.7517	Fixed in 10.0.22631.7517
MicrosoftWindows 11 Version 23H2	Affected >=10.0.22631.0 <10.0.22631.7517	Fixed in 10.0.22631.7517

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

Microsoft has released its monthly security update for August 2026, which includes 421 vulnerabilities affecting a range of products, including 62 that Microsoft marked as "critical." Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild CVE-2026-68820 is an elevation of privilege vulnerability affecting Windows Ancillary Function Driver for WinSock. A Use After Free vulnerability could allow an authorized attacker to elevate privileges locally. This vulnerability has a CVSS base score of 7.0. Out of 62 "critical" vulnerabilities, 40 are remote code execution (RCE) vulnerabilities. Microsoft considers exploitation of the following vulnerabilities more likely. CVE-2026-62893 is a remote code execution vulnerability affecting Windows Deployment Services TFTP Server. A Use After Free could allow an unauthorized attacker to execute code over a network. This vulnerability has a CVSS base score of 9.8. CVE-2026-65665 is a remote code execution vulnerability affecting Microsoft SharePoint Server. Deserialization of Untrusted Data could allow an authorized attacker to execute code over a network. This vulnerability has a CVSS base score of 8.8. CVE-2026-62823 is a remote code execution vulnerability affecting Windows DHCP Server. A Heap-based Buffer Overflow could allow an unauthorized attacker to execute code over an adjacent network. This vulnerability has a CVSS base score of 8.8. Microsoft considers exploitation of the following vulnerabilities less likely. CVE-2026-62830 is an elevation of privilege vulnerability affecting Azure SRE Agent. Missing Authorization could allow an authorized attacker to elevate privileges over a network. This vulnerability has a CVSS base score of 9.9. CVE-2026-50516 is an elevation of privilege vulnerability affecting Microsoft Azure Kubernetes Service. Missing Authentication for Critical Function could allow an unauthorized attacker to elevate privileges over a network. This vulnerability has a CVSS base score of 9.4. Three remote code execution vulnerabilities, CVE-2026-68794 , CVE-2026-68816 and CVE-2026-68804 , affect Microsoft Excel and have a CVSS base score of 7.8. An unauthorized attacker could execute code locally. CVE-2026-68794 is a Heap-based Buffer Overflow. CVE-2026-68816 is a Stack-based Buffer Overflow. CVE-2026-68804 involves a Numeric Truncation Error and a Heap-based Buffer Overflow. CVE-2026-62911 is an elevation of privilege vulnerability affecting Microsoft Exchange Server. Authentication Bypass by Capture-replay could allow an authorized attacker to elevate privileges over a network. This vulnerability has a CVSS base score of 8.0. Nine remote code execution vulnerabilities, CVE-2026-63515 , CVE-2026-65657 , CVE-2026-63532 , CVE-2026-64898 , CVE-2026-64903 , CVE-2026-64909 , CVE-2026-64910 , CVE-2026-64911 and CVE-2026-70130 , affect Microsoft Office and could allow an unauthorized attacker to execute code locally. CVE-2026-63515 involves an Out-of-bounds Read and an Integer Underflow (Wrap or Wraparound) and has a CVSS base score of 7.8. CVE-2026-65657 is a Use After Free and has a CVSS base score of 7.8. CVE-2026-63532 involves an Integer Overflow or Wraparound and a Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-64898 involves a Heap-based Buffer Overflow and an Integer Overflow or Wraparound and has a CVSS base score of 7.8. CVE-2026-64903 involves an Integer Overflow or Wraparound and a Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-64909 involves an Integer Underflow (Wrap or Wraparound), an Out-of-bounds Read and a Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-64910 is an Untrusted Pointer Dereference and has a CVSS base score of 7.8. CVE-2026-64911 involves an Integer Overflow or Wraparound and a Heap-based Buffer Overflow and has a CVSS base score of 7.8. CVE-2026-70130 is a Heap-based Buffer Overflow and has a CVSS base score of 8.4. Five remote code exec…

Impact

Successful exploitation of these vulnerabilities could allow attackers to execute code remotely or locally, elevate privileges, or bypass authentication, depending on the specific flaw. The exploited CVE-2026-68820 allows local privilege escalation. High-severity remote code execution vulnerabilities could enable attackers to run arbitrary code on affected systems remotely, potentially leading to full system compromise. Elevation of privilege flaws in Azure services could allow attackers to gain higher privileges over networked resources. The widespread nature and critical severity of many vulnerabilities pose significant risk if unpatched.

Mitigation

Microsoft has released official patches for all vulnerabilities disclosed in the August 2026 update, including those exploited in the wild. Organizations should apply the August 2026 security updates promptly to mitigate these risks. No additional vendor advisories indicate alternative mitigations or that no action is required. Patch status is confirmed as official-fix via Microsoft's monthly update.

CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Architecture and Design · Language Selection
Choose a language that provides automatic memory management.
Implementation · Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Affected software

Description

AI analysisMachine-generated, updated 11 Aug 2026, 22:38 UTC

Public exploits and detectionGitHub proofs of concept

WeaknessesCWE-416

References

Community reviews

Related threats