Hackers Are Already Exploiting the Windows Zero-Day Microsoft Just Patched

Microsoft shipped a fix for CVE-2026-68820 in this week's Patch Tuesday. Attackers had already been using it for a while.

The flaw sits in the Windows Ancillary Function Driver for WinSock, the kernel-level component that handles network socket calls for effectively every application on a Windows machine. It carries a CVSS score of 7.0, which reads as moderate right up until you notice the "exploited in the wild" label sitting next to it.

What this Windows zero-day actually buys an attacker

Privilege escalation is not how someone breaks into your network. It is what they do once they are already standing in the hallway. A phishing click or a stolen credential gets an attacker onto a machine as a normal user. CVE-2026-68820 is the step that turns that limited foothold into SYSTEM-level control of the box.

That distinction matters for how you triage it. On its own, a 7.0 privilege escalation bug is unremarkable. Chained behind an initial access technique, it is the difference between one compromised laptop and a domain-wide incident. That is exactly why it shows up in real attacks rather than proof-of-concept demos, and it is the same pattern we saw with the Metabase zero-day earlier this month.

The Cisco problem running alongside it

Microsoft is not the only vendor with an active problem this week. A vulnerability in Cisco ASA and FTD SSL VPN appliances is also being exploited, and this one does not need credentials at all. An unauthenticated attacker can crash the device remotely, which for most organisations means the VPN concentrator that the entire remote workforce depends on goes offline.

Two actively exploited flaws in the same week, sitting at opposite ends of the stack: one in Windows desktops, one in the network edge appliance in front of them. Almost every organisation of any size runs at least one of those.

What to do this weekend

Patch the Cisco appliances first. An unauthenticated remote crash on an internet-facing device is a lower-effort attack than a chained privilege escalation, and the blast radius is your entire remote access path. Then push the Windows updates through your normal ring deployment, but compress the timeline. "Next month's maintenance window" is not a plan for something already in use.

If you are running either product and have no patch window until September, assume exposure and monitor accordingly. Ransomware crews move fast on exactly this kind of bug, and attacks on large organisations have been climbing all year. The gap between a public patch and mass exploitation is usually measured in days, not weeks, as last month's Oracle and SonicWall round showed.