Windows has a zero-day that hands attackers full control - and it is already being used

Microsoft’s August security update fixed hundreds of vulnerabilities across Windows. One of them was already being used against real machines before the patch existed.

That flaw is CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock - the kernel component known as AFD.sys that sits underneath almost every network connection Windows makes. CISA added it to its Known Exploited Vulnerabilities catalogue on 11 August and gave federal agencies until 25 August to patch, a deadline it only sets for flaws it can confirm are being exploited.

What the bug actually does

It is an elevation-of-privilege vulnerability, rated 7.0. A locally authenticated attacker who runs a specially crafted program can win a race condition inside the driver and escalate all the way to SYSTEM - the highest level of access on a Windows machine - without any user interaction.

The important word there is “local”. This is not a bug that lets someone take over your PC across the internet. To use it, an attacker already has to be running code on the machine as an ordinary user.

So who is actually at risk

That distinction matters, because it changes what this vulnerability is for. It is not the opening move in an attack; it is the second one.

Malware delivered by a phishing email, a malicious download or a compromised app typically lands with the limited rights of whoever is logged in. A bug like this is how that foothold is turned into full control of the machine - disabling security tools, installing drivers, reading everything. Attackers chain it to something else. That is exactly why kernel elevation bugs in AFD.sys are prized: the driver has been the target of this kind of exploitation repeatedly over the years.

Because AFD.sys ships in every supported version of Windows, the exposure is broad - home machines included. But the realistic threat is targeted intrusions and malware campaigns, not something that will sweep across consumer PCs on its own.

What to do about it

Install the August update. For almost everyone, that is the entire response - the fix is in the standard Windows cumulative update, so a machine that is up to date is already covered. If you have turned off automatic updates, this is the reminder to turn them back on.

For businesses running their own patch schedules, this is the one from the August batch to prioritise. It is confirmed as exploited, it is a clean path to SYSTEM, and the fix is already available - which is the combination that gets a vulnerability weaponised more widely once proof-of-concept code circulates.

None of this is cause for alarm. It is, however, a good argument for not being three updates behind.