Microsoft released patches for 398 vulnerabilities in Tuesday's monthly security update cycle. Among them sits CVE-2026-68820, a Windows kernel driver flaw already exploited in active attacks.

The vulnerability resides in a core Windows driver responsible for network socket operations. Attackers who already possess code execution on a target machine can leverage this flaw to escalate privileges to SYSTEM level, granting them complete control over the compromised system. Microsoft assigned the vulnerability a CVSS score of 7.0, reflecting its high severity.

The timing matters. This zero-day is not theoretical. Threat actors are actively weaponizing CVE-2026-68820 in the wild, making immediate patching essential for organisations running vulnerable Windows systems. An attacker chain typically involves initial code execution through malware, phishing, or another vulnerability, followed by this privilege escalation technique to gain administrative access.

The patch targets a critical attack vector. Windows kernel drivers operate at the highest privilege level, so flaws here bypass most user-space security controls. Once SYSTEM access is obtained, attackers can disable security software, install persistent malware, steal credentials, and move laterally across networks.

Organisations should prioritise this update alongside other critical patches from the 398-vulnerability batch. The active exploitation status means delay increases risk exposure. Windows administrators should test and deploy this patch across their environments immediately, prioritising systems facing external network access or running high-value workloads.

For individuals, applying Windows Update when prompted remains the simplest defense. Systems configured for automatic updates receive this patch without manual intervention. Those managing manual updates should check Windows Update or Microsoft's security advisory pages for CVE-2026-68820 details and deployment guidance.

Microsoft's monthly Patch Tuesday cycle typically closes dozens of vulnerabilities. This month's count of 398 represents the scale of ongoing development across Windows,