CISA Warns of Windows Ancillary Function 0-Day Vulnerability Exploited in Attacks
Brief
The U. S. Cybersecurity and Infrastructure Security Agency has added a Microsoft Windows vulnerability to its Known Exploited Vulnerabilities Catalog, warning that the flaw is being exploited in attacks.
The issue, tracked as CVE-2026-68820 , is a use-after-free vulnerability affecting the Windows Ancillary Function Driver for WinSock. An authorized attacker could exploit the issue locally to elevate privileges on an affected Windows system.
This means an attacker who already has access to a device with limited permissions may be able to gain higher-level access, including privileges normally restricted to administrators or the operating system.
The vulnerability is associated with CWE-416, a common software weakness known as use-after-free . This class of flaw occurs when a program continues to use memory after it has been released.