Microsoft confirms exploits before release, releases monthly patches for WinSock driver vulnerabilities, etc.

Microsoft has confirmed that it has confirmed that it has been exploited before it is publicly available for one vulnerability, CVE-2026-68820, which is an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock.

WinSock (Windows Sockets) refers to the API used by Windows applications to perform network communication. This driver is responsible for the communication processing.

According to Microsoft's Security Update Guide, CVE-2026-68820 is caused by a Use After Free memory. An exploit can be exploited by an authenticated attacker running a specially crafted application in the local environment, causing a race condition. An attacker who successfully exploits this vulnerability can gain SYSTEM privileges. No user interaction required.

Microsoft rates the attack complexity as "high" because exploitation requires a race condition to occur. This is an elevation of privilege vulnerability, which requires an attacker to be able to execute code on the target device in order to exploit it. Still, Microsoft is asking for the update to be applied as soon as possible, saying it has confirmed exploits in the real world.

Which products are “emergency”?

The product groups with the maximum severity level of "Urgent" and the expected greatest impact are as follows. For Windows Server, Server Core installation is also included.

Product Family Maximum Severity Most Impact Windows 11 (v26H1, v25H2, v24H2, v23H2) Critical Remote code execution possible Windows Server 2025 Critical Remote code execution possible Windows Server 2022 Critical Remote code execution possible Windows Server 2019, 2016 Critical Remote code execution possible Microsoft Office Critical Remote code execution possible Microsoft Exchange Emergency Remote code execution possible

The maximum severity level was ``Important'' for ``Microsoft SQL Server,'' ``Microsoft Dynamics 365,'' ``Microsoft Azure,'' ``Microsoft .NET,'' ``Microsoft Visual Studio,'' and ``Microsoft Defender.'' Among these, the biggest impact is privilege escalation for Azure, information leakage for Defender, and remote code execution for the others.

When deploying Exchange updates, you should also refer to Microsoft's separate deployment guidance.

Regarding this month's update, Microsoft also announced the following three points.

Known issues for the update are listed in the August 2026 Security Update Release Notes. The security bulletin for Microsoft Edge (Chromium version) has a different publication schedule than the monthly release, so you need to check the security update guide separately. The latest servicing stack update (SSU) can be found in advisory "ADV990001".

The next security update is scheduled to be released on September 8, 2026 (US time).