Exploited Windows afd.sys Zero-Day Gets a 3-Day Patch Clock for Exposed Systems
CVE-2026-68820, a use-after-free in Windows's afd.sys kernel driver, was already under active attack when Microsoft's fix shipped on August 11 — and CISA added it to KEV the same day. Under BOD 26-04, internet-facing systems get just 3 days to remediate; internal fleets have 14. Because the update swaps a kernel driver, installing the patch alone doesn't complete the job: endpoints must reboot before CISA counts remediation done.