The Windows flaw added to CISA's exploited list this week is one of the few that reaches home machines
CVE-2026-68820 is a privilege escalation in a Windows networking driver. It cannot get an attacker in, which is the point: it is what they use once they are already there.
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue on 11 August, giving US federal agencies until 25 August to patch it. Inclusion in that catalogue means exploitation has been observed rather than predicted.
The National Vulnerability Database describes it as a use after free in the Windows Ancillary Function Driver for WinSock, allowing an authorised attacker to elevate privileges locally. Microsoft assigns it a CVSS 3.1 base score of 7.0, rated high.
Why this one is worth more attention than its score
Most entries added to the catalogue in any given week affect equipment nobody reads about at home. This week’s Cisco firewall flaw was a good example, sitting in appliances owned by enterprises and public bodies.
This one is different. The NVD entry lists Windows 10 across versions 1607, 1809, 21H2 and 22H2, Windows 11 across 23H2, 24H2, 25H2 and 26H1, and Windows Server from 2012 R2 through to 2025. That is not a niche product line. It is most of the Windows installed base, including the machine a lot of people are reading this on.
What it actually does, and what it does not
The vector string is the part worth reading: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
AV:L means local. An attacker has to already be running code on the machine. PR:L means they need low level privileges before they start. So this is not a way in, and anyone describing it as a remote takeover has misread it.
What it is, is the step that comes next. An attacker with an ordinary user account, obtained through a phished password or a malicious download, uses a flaw like this to become an administrator. That is the difference between an intruder who can read one person’s files and one who owns the machine.
AC:H also matters, and cuts the other way. High attack complexity means the exploit is not trivially reliable, which is part of why the score sits at 7.0 rather than higher. Set against that, the catalogue listing says someone has already made it work.
The deadline is not your deadline
The 25 August date binds US federal civilian agencies. No UK organisation is instructed by it, and no home user is either.
It remains the most useful patching signal available, for the same reason it was worth citing on the Cisco flaw: a severity score estimates how bad an attack could be, while the catalogue records which attacks are being carried out. When the two disagree, the catalogue is describing the present tense.
For anything running a supported version of Windows, this arrives through the ordinary update channel. The practical action is checking that automatic updates have actually applied rather than assuming, which on Windows 10 is worth doing deliberately now that its own support timeline has become a moving target.