CVE-2026-72971

hallenge to process for organizations without automated, risk-based patching programs. The actively exploited zero day (CVE-2026-68820) is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker with low privileges could run a specially crafted application and trigger a race condition to gai

affected by August 2026 Patch Tuesday Exploited Zero-Day Vulnerability in Windows Ancillary Function Driver for WinSock CVE-2026-68820 is an Important elevation of privilege vulnerability affecting the Windows Ancillary Function Driver for WinSock and has a CVSS score of 7.0 . A use-after-free flaw (CWE-416) allows a low-privileged local attacker to el

Microsoft Patch Tuesday for August 2026 fixes 398 CVEs, including an actively exploited zero-day and a wormable DNS flaw enabling remote code execution. Microsoft released its Patch Tuesday security updates for August 2026 on Tuesday, covering 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, .NET, and a range of other […]

ued today in Microsoft’s August Patch Tuesday releases. The hole is in Windows’ Ancillary Function Driver for WinSock ( CVE-2026-68820 ), which, according to Todd Schell , principal product manager at Ivanti, has been a recurring target for local privilege-escalation bugs throughout 2026. Past vulnerabilities in this component have let an authorized at

ation denial-of-service, and arbitrary code execution. Zero-day Vulnerabilities Patched in August Patch Tuesday Edition CVE-2026-72971: Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability This is a link-following flaw that may allow an authenticated attacker to perform local tampering. CVE-2026-62832: Windows User Profile

Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today.

ktop browser security patches so far this month. SharePoint: critical RCE chain by Rapid7 Today sees the publication of CVE-2026-63520 , a high-severity remote code execution in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer , and published today in coordination with Microsoft; this vulnerability is the se

cluding a high-severity vulnerability that has been exploited in the wild as a zero-day. The exploited flaw, tracked as CVE-2026-68820, is described as a use-after-free issue in Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver functioning as the backbone for the Windows Sockets API. Microsoft says threat actors have been exploiti

of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.1%. Important CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability CVE-2026-68820 is an EoP vulnerability affecting Windows Ancillary Function Driver for WinSock. It received a CVSSv3 score of 7.0 and

g actively exploited, at least as 0-days. Again, we’ll start with the bug under active attack and move on from there. - CVE-2026-68820 - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability This bug allows attackers to execute code at SYSTEM level. Bugs of this type are often paired with code execution bugs to take over a

Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.