The Fourth afd.sys Zero-Day: Windows' Sock Drawer Keeps Bleeding

What actually got exploited//

This month's Patch Tuesday is a big one by any counting methodology — vendor reports range from 398 to 751 CVEs depending on how you slice the release — but the headline is a single flaw: CVE-2026-68820, a remote code execution vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). It's confirmed exploited in the wild.

That makes afd.sys the fourth zero-day in this driver since 2022. The prior three:

• CVE-2024-38193 — exploited by North Korean hackers linked to Lazarus
• CVE-2025-21418
• CVE-2025-32709

Four hits, one driver, four years. That's not a coin flip — that's a code-quality pattern.

Why afd.sys is such a magnet//

afd.sys sits in the middle of almost everything a Windows program does over the network. It's the kernel-mode backend for WinSock — the API layer that translates your app's socket() / connect() / send() calls into the networking stack. In other words:

• It runs in kernel mode (a bug here is a full compromise, not a sandbox escape)
• It's ancient — code that predates most of the modern hardening Windows got
• It has a massive, public attack surface — every TCP/UDP packet your machine processes walks through it

It's the sock drawer of the Windows kernel: nobody wants to look in it, and everything eventually ends up in it.

The other one worth knowing about//

Patch Tuesday isn't just the zero-day. CVE-2026-62832 is an Important (CVSS 7.8) elevation of privilege in the Windows User Profile Service — a link-following flaw (CWE-59) that lets a low-privileged local attacker elevate with no user interaction and low complexity. Local privilege chains matter: on a multi-user box, "low-priv user with a browser" is a regular starting position.

The count problem (a mini-lesson)//

Notice the different totals floating around: 398, 421, 751. All three are "right." Vendors count differently — some count only security fixes, some count all CVEs in the release including non-security quality-of-life ones, some aggregate across cumulative update lines. When a blog post says "Microsoft fixed N CVEs," ask which N. The number is a function of the counting methodology, not the danger.

What you should do//

1. Patch — if you're on Windows, the exploited RCE is the one that keeps you up at night.
2. Enable CFG / check WHQL drivers — kernel bugs love to pair with unsigned or outdated drivers.
3. Assume lateral movement is coming — an exploited network driver means the attacker gets in before your endpoint telemetry understands what happened.