{"schema":"vulnpedia.research/1","cve":"CVE-2026-68820","references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820","tags":["vendor-advisory","patch","Patch","Vendor Advisory","KEV report"],"source":"mitre","sourceId":"microsoft","modified":"2026-10-21T20:52:47.921Z","origins":[{"source":"mitre","sourceId":"microsoft","modified":"2026-10-21T20:52:47.921Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"},{"source":"nvd","sourceId":"CVE-2026-68820","modified":"2026-08-16T19:17:24.183","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-12T03:55:17.379Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-12T03:55:17.379Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820"},{"source":"nvd","sourceId":"CVE-2026-68820","modified":"2026-08-16T19:17:24.183","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-68820"}]},{"source":"euvd","sourceId":"EUVD-2026-56468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-56468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug"}]},{"url":"https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/"}]},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"}]},{"url":"https://previdian.com/CVE-2026-68820","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://previdian.com/CVE-2026-68820"}]},{"url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://cydome.io/maritime-cybersecurity-bulletin-august-14th-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-14th-2026/"}]},{"url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/"}]},{"url":"https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750"}]},{"url":"https://blackpointcyber.com/blog/notes-from-the-chief-security-and-trust-officer-august-2026/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://blackpointcyber.com/blog/notes-from-the-chief-security-and-trust-officer-august-2026/"}]},{"url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/"}]},{"url":"https://www.trellix.com/blogs/research/the-bug-report-august-2026-edition/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://www.trellix.com/blogs/research/the-bug-report-august-2026-edition/"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://asec.ahnlab.com/en/95478/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://asec.ahnlab.com/en/95478/"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/HORKimhab/CVE-2026-68820","source":"poc-in-github","sourceId":"CVE-2026-68820","description":"CVE-2026-68820 - Draft or TODO","modified":"2026-10-11T06:27:47Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-68820","url":"https://github.com/HORKimhab/CVE-2026-68820"},{"source":"poc-in-github","sourceId":"CVE-2026-68820","modified":"2026-10-11T06:27:47Z","url":"https://github.com/HORKimhab/CVE-2026-68820"}],"tags":[]},{"url":"https://github.com/ubitquity/Windows-WinSock-UAF-Mitigation","source":"poc-in-github","sourceId":"CVE-2026-68820","description":"This repository contains a conceptual patch demonstrating the mitigation for CVE-2026-68820, a critical Use-After-Free (UAF) vulnerability in the Windows Ancillary Function Driver for WinSock (`afd.sys`).","modified":"2026-08-15T10:42:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-68820","url":"https://github.com/ubitquity/Windows-WinSock-UAF-Mitigation"},{"source":"poc-in-github","sourceId":"CVE-2026-68820","modified":"2026-08-15T10:42:40Z","url":"https://github.com/ubitquity/Windows-WinSock-UAF-Mitigation"}],"tags":[]},{"url":"https://github.com/fevar54/CVE-2026-68820-Mitigation-PoC-","source":"poc-in-github","sourceId":"CVE-2026-68820","description":"Demostracion educativa de mitigacion de CVE-2026-68820: Use-After-Free en afd.sys de Windows.","modified":"2026-10-05T08:10:36Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-68820","url":"https://github.com/fevar54/CVE-2026-68820-Mitigation-PoC-"},{"source":"poc-in-github","sourceId":"CVE-2026-68820","modified":"2026-10-05T08:10:36Z","url":"https://github.com/fevar54/CVE-2026-68820-Mitigation-PoC-"}],"tags":[]},{"url":"https://github.com/maxprog-svg/CVE-2026-68820_Mass_Exploit","source":"poc-in-github","sourceId":"CVE-2026-68820","description":"CVE-2026-68820 — Mass Exploit Framework Edition.","modified":"2026-08-25T18:10:23Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-68820","url":"https://github.com/maxprog-svg/CVE-2026-68820_Mass_Exploit"},{"source":"poc-in-github","sourceId":"CVE-2026-68820","modified":"2026-08-25T18:10:23Z","url":"https://github.com/maxprog-svg/CVE-2026-68820_Mass_Exploit"}],"tags":[]}],"cataloguedPoc":[],"vendorStatements":[],"exploitationSources":[{"source":"euvd","sourceId":"EUVD-2026-56468","catalog":"ENISA EU KEV","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468","dateAdded":"2026-08-11","origins":[{"source":"euvd","sourceId":"EUVD-2026-56468","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-56468"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-11T00:00:00Z","modified":"2026-08-11T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Microsoft","product":"Windows Ancillary Function Driver for WinSock ","dueDate":"2026-08-25T00:00:00Z","cisaDateAdded":"2026-08-11T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","modified":"2026-08-11T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug","dateAdded":"2026-08-11T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Aug"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://blog.checkpoint.com/research/state-sponsored-hackers-use-fake-job-offers-to-deliver-new-zero-day-exploit/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://previdian.com/CVE-2026-68820"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-14th-2026/","dateAdded":"2026-08-14T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://cydome.io/maritime-cybersecurity-bulletin-august-14th-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/","dateAdded":"2026-08-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750","dateAdded":"2026-08-21T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://blackpointcyber.com/blog/notes-from-the-chief-security-and-trust-officer-august-2026/","dateAdded":"2026-09-02T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://blackpointcyber.com/blog/notes-from-the-chief-security-and-trust-officer-august-2026/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/","dateAdded":"2026-09-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://cert.europa.eu/publications/threat-intelligence/cb26-09/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://www.trellix.com/blogs/research/the-bug-report-august-2026-edition/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","catalog":"VulnCheck KEV","kind":"report","url":"https://asec.ahnlab.com/en/95478/","dateAdded":"2026-09-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-68820","url":"https://asec.ahnlab.com/en/95478/"}]}]}