Patch Tuesday August 2026: A zero-day WinSock driver hole under exploit, and a maximum severity SAP vulnerability

A zero-day elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock, identified as CVE-2026-68820, is being actively exploited and requires immediate patching. This vulnerability allows an authorized attacker to exploit a race condition and gain SYSTEM privileges. The WinSock driver has been a recurring target for local privilege-escalation bugs throughout 2026, with past vulnerabilities enabling similar attacks. Microsoft's August Patch Tuesday releases include 398 fixes, with this zero-day vulnerability being a top priority. The exploitation status of CVE-2026-68820 is currently under discussion with Microsoft, determining whether this is a patch-now or monitor situation¹. This vulnerability matters to security practitioners because it highlights the need for prompt patching to prevent attackers from gaining elevated privileges, especially given the driver's history of similar vulnerabilities.