Fabrice COFFRINI/gettyimages.com
Microsoft’s August 2026 Patch Tuesday, released yesterday, closed a Windows kernel vulnerability that North Korea’s Lazarus Group had been actively weaponizing against defense sector workers since at least early July — weeks before a patch was available. The flaw, CVE-2026-68820, sits in the same obscure driver that Lazarus has now exploited four separate times since 2022: the Windows Ancillary Function Driver for WinSock, or afd.sys. Check Point Research, which reported the vulnerability to Microsoft, published its full attribution report simultaneously with the patch release.
That pattern — four zero-days in four years, from the same kernel component, all used to install the same evolving rootkit — is the detail that elevates August’s Patch Tuesday beyond a routine volume story. North Korea has made a sustained research investment in afd.sys specifically, because this default Windows networking driver is accessible from any low-privilege user account, sits in the kernel, and provides a reliable path to complete system control once a use-after-free flaw can be triggered inside it. Tenable’s August 2026 Patch Tuesday analysis documents the serial exploitation pattern in detail. Patch CVE-2026-68820 immediately. Then read on for what Lazarus actually did with it.
What CVE-2026-68820 Is and Why It Matters Despite a 7.0 Score
The vulnerability is a use-after-free race condition in afd.sys, the kernel-mode driver that underpins the Windows Sockets API — the foundational networking interface all Windows applications use to open and communicate over network connections. The Microsoft MSRC advisory confirms: because afd.sys runs in Ring 0 (the kernel), a flaw in it can grant an attacker the highest tier of system access without requiring any elevated privileges to trigger.
The specific mechanism: when multiple threads attempt to create or access socket state simultaneously, afd.sys can free a socket data structure while another thread still holds a reference to it. That dangling pointer — called a use-after-free — gives an attacker a read/write primitive into kernel memory, which they can use to redirect execution and escalate to NT AUTHORITYSYSTEM privileges. A CyberPress technical analysis of CVE-2026-68820 confirms no user interaction is required.
Microsoft rated CVE-2026-68820 as Important with a CVSSv3 score of 7.0, a rating that has drawn industry criticism as inadequate given confirmed active exploitation. Automox CTO Jason Kikta’s response was direct: the only vulnerability in this release Microsoft confirms is being exploited in the wild “outranks every bigger number on the advisory sheet.” Kikta’s full August 2026 Patch Tuesday analysis details the operational prioritization case. CISA agreed: the Known Exploited Vulnerabilities catalog was updated on August 11 to include CVE-2026-68820, triggering mandatory federal patching requirements under Binding Operational Directive 26-04.
Moshe Marelus and David Driker of Check Point Research reported the vulnerability to Microsoft on July 28. Microsoft confirmed the issue within three days, assigned it CVE-2026-68820 on August 5, and released the fix yesterday as part of Patch Tuesday — a turnaround that suggests Microsoft treated the disclosure with appropriate urgency. BleepingComputer’s August 2026 Patch Tuesday coverage confirms the researcher credits and timeline.
Lazarus Has Now Exploited afd.sys Four Times Since 2022
CVE-2026-68820 is not a novel discovery. It is the latest iteration in a documented pattern of deliberate research into a specific attack surface. SecurityWeek’s August 2026 Patch Tuesday report notes Tenable senior staff research engineer Satnam Narang’s documentation of the full pattern:
CVE-2025-21418, an afd.sys use-after-free patched in February 2025 Patch Tuesday, was confirmed exploited in the wild. Lazarus Group was suspected but not confirmed at publication.
CVE-2025-32709, an afd.sys use-after-free patched in May 2025, was also confirmed exploited in the wild.
CVE-2024-38193, an afd.sys use-after-free patched in August 2024 Patch Tuesday, was confirmed exploited by Lazarus Group specifically — used to install FudModule v3.0 against aerospace and cryptocurrency targets, documented by Gen Digital researchers Luigino Camastra and Milanek.
CVE-2026-68820, patched yesterday, is confirmed as Lazarus Group exploitation, used to install FudModule v3.1 against defense sector targets in France, Germany, Brazil, and India.
The reason the same driver keeps appearing is structural: afd.sys has been around for decades, handles foundational networking functionality, and necessarily operates as a kernel driver that interacts with a large volume of user-supplied input — a combination that makes it a persistent source of elevation-of-privilege flaws and an attractive research target for a nation-state with the patience to find them. Rapid7’s August 2026 Patch Tuesday analysis examines the Windows backward compatibility dynamic that perpetuates the attack surface.
Operation Dream Job: How Lazarus Got In
Check Point Research simultaneously released its full attribution report confirming that CVE-2026-68820 was weaponized as part of the latest wave of Operation Dream Job — the long-running North Korean espionage campaign, active since at least 2020, that uses fake job offers to compromise defense and aerospace sector workers. Check Point’s full Operation Dream Job report details the complete attack chain.
The attack typically begins with an approach through LinkedIn or direct messaging platforms, where someone posing as a recruiter presents a role at a company the target would recognize — in this wave, lures impersonated Lockheed Martin and Enveil (a legitimate privacy enhancing technology company). Victims are directed to download either an encrypted archive or a trojanized PDF viewer called SecurityPDF, distributed from websites impersonating Enveil. The materials are convincing enough that targets engage with them, and that engagement is the end of their security.
Check Point Research identified two infection chains running in parallel. The first uses DLL sideloading: a legitimate, digitally signed PDF viewer is bundled with a malicious DLL that displays a convincing decoy job description to the victim while simultaneously decrypting and executing MISTPEN in memory — a lightweight in-memory downloader first documented by Mandiant in 2024 during an earlier North Korean recruitment-themed campaign. MISTPEN communicates with attacker infrastructure through Microsoft’s own Graph API and OneDrive, blending its command-and-control traffic with legitimate Microsoft cloud service activity to evade network detection.
The second chain uses SecurityPDF, a trojanized PDF viewer. When the victim opens a PDF that carries a hidden marker, SecurityPDF decrypts and launches an embedded payload called Troy — a previously undocumented, single-DLL implant that supports 17 operator commands spanning file access, upload and download, interactive shell access, process termination, and in-memory DLL injection — entirely in memory, without writing to disk.
Rather than operating dedicated command-and-control servers that network defenders could block or trace, Lazarus routed operator traffic through compromised Roundcube webmail servers and content management system platforms. Many of those Roundcube instances were vulnerable to CVE-2025-49113, a PHP deserialization flaw, and were accessed using credentials already leaked on the dark web. The operators deployed RelayShell, a new PHP web shell that exchanges commands through simple text files rather than executing them directly, making malicious traffic resemble normal web activity. Check Point identified at least 17 unique compromised relay nodes, with operators connecting through commercial VPN services to further obscure their location.
FudModule v3.1: Why Endpoint Security Tools Could Not See It
Once MISTPEN ran reconnaissance on the infected host and escalated privileges to SYSTEM via CVE-2026-68820, it deployed FudModule v3.1 — the latest major iteration of Lazarus’s kernel-mode rootkit and the reason that compromise victims had no way to know they were under attack. Cybersecurity News published a detailed technical breakdown of FudModule v3.1.
Kernel-mode rootkits operate at the same privilege level as the operating system itself. FudModule v3.1 exploits this position to directly manipulate kernel data structures, removing the security product registrations and logging pipelines that endpoint detection and response tools depend on. Specifically, v3.1 strips Event Tracing for Windows (ETW) telemetry callbacks — the hooks that security products use to observe process creation, file access, network connections, and registry changes — and blinds 94 ETW providers across the system. It also disables minifilter drivers (which intercept file system I/O for monitoring purposes), kills the NT Kernel Logger, and adds a new capability absent from v3.0: tampering with Smart App Control by resetting its verified-and-reputable policy state. Infosecurity Magazine’s coverage of FudModule v3.1 covers these technical additions in depth.
One technical addition is notable: Infosecurity Magazine reports that MISTPEN in this campaign used post-quantum key exchange (Kyber/ML-KEM, the key encapsulation standard NIST standardized in 2024) to deliver FudModule’s payload, with GOST-CBC providing a second encryption layer on top of MISTPEN’s own AES transport encryption. This suggests Lazarus is actively working to future-proof its operational security even in current campaigns.
After FudModule blinded the endpoint security environment, MISTPEN injected a fresh instance of itself into a SYSTEM-level process and deployed ForestTiger — a documented Lazarus backdoor used to maintain long-term remote access — into a security-invisible environment. At that point, the attacker had SYSTEM-level access, no EDR visibility, and a persistent backdoor operating below the detection threshold of most security products.
The campaign focused on defense, aerospace, and aviation organizations, with confirmed activity in France, Germany, Brazil, and India. Organizations working on surveillance sensors, drones, and robotics were specifically targeted — technology categories directly relevant to North Korea’s documented weapons development priorities. In at least one case, a French organization that had already been compromised was subsequently used to send further spear-phishing messages to new targets worldwide, borrowing the organization’s legitimate reputation to increase the campaign’s apparent credibility.
Second Zero-Day: CVE-2026-62832 Has Had a Public Exploit for Over a Month
A second zero-day patched yesterday, CVE-2026-62832, affects the Windows User Profile Service and carries a CVSSv3 score of 7.8. BleepingComputer’s Patch Tuesday zero-day coverage confirms this flaw was publicly disclosed before Microsoft issued a patch, meaning it has been in the open for threat actors to study.
The mechanism: an authenticated attacker who holds credentials for another local account can run a specially crafted application to load that account’s registry hive, gaining access to or the ability to modify the other user’s data and escalate to administrator privileges. No user interaction is required. Microsoft assesses exploitation as “More Likely,” and security researchers at Ivanti note that this is the vulnerability underlying “LegacyHive,” a proof-of-concept exploit released publicly by researcher Nightmare-Eclipse just hours after July’s Patch Tuesday — meaning CVE-2026-62832 has had working public exploit code for over a month. Gadget Hacks explains the CVE-2026-62832 LegacyHive risk clearly.
A third publicly-disclosed zero-day, CVE-2026-72971, affects the Windows Container Isolation File System Filter Driver (unionfs.sys). It is also a link-following flaw that could allow a locally authenticated attacker to tamper with files and weaken integrity boundaries in containerized Windows environments. No active exploitation has been reported for either CVE-2026-62832 or CVE-2026-72971.
Wormable DNS Server Flaw Tops the Critical List
Beyond the zero-days, several flaws in the August release warrant fast treatment even without confirmed exploitation.
The highest-urgency server-side vulnerability is CVE-2026-62878, a stack-based buffer overflow in the Windows DNS Server rated CVSS 9.8 Critical. Action1’s August 2026 Patch Tuesday analysis highlights the CVE-2026-62878 risk. An unauthenticated remote attacker can send a specially crafted network packet to an affected DNS Server and execute code with elevated privileges, with no user interaction required. Trend Micro Zero Day Initiative’s Dustin Childs called it “a good ol’ fashioned stack-based buffer overflow” and characterized it as potentially wormable, as Dark Reading’s Patch Tuesday coverage reports. Microsoft rates exploitation as “less likely”; Childs’s advice: “I wouldn’t count on that. I suggest testing and deploying this one quickly, especially to your internet-facing DNS servers.” In most Active Directory environments, DNS is co-hosted on domain controllers — which makes this a first-priority fix for network infrastructure. Three additional Windows DNS Server remote code execution flaws ride in the same release (CVE-2026-62817, CVE-2026-62820, CVE-2026-65789).
CVE-2026-62911 affects Microsoft Exchange Server and was demonstrated with working exploit code at Pwn2Own Berlin. The Register’s full August 2026 Patch Tuesday report covers the Exchange Server exploitation risk. Successful exploitation can allow an attacker to take over all mailboxes on the Exchange server, including read, send, and download access. On-premises Exchange organizations should treat this as infrastructure-tier priority.
August’s release also delivers the remote code execution half of a SharePoint exploit chain that Rapid7 Labs partially disclosed at Pwn2Own Berlin in July. The authentication bypass (CVE-2026-55040) was patched in July’s release; the remote code execution component arrives now. Organizations running on-premises SharePoint should confirm both July’s bypass patch and this month’s remote code execution fix are installed.
The release also quietly addresses two TPM 2.0 hardware-level vulnerabilities and two additional elevation-of-privilege flaws in afd.sys — CVE-2026-70307 and a related CVE — both rated 7.0 and assessed as “Exploitation More Likely” by Microsoft’s Exploitability Index, though no active exploitation has been reported for either.
What Security and IT Teams Need to Do Now
CVE-2026-68820 — emergency priority. CISA’s Known Exploited Vulnerabilities catalog listing means federal agencies face a mandatory remediation deadline under Binding Operational Directive 26-04. Every organization with Windows endpoints should treat this as an emergency regardless of regulatory status, given confirmed Lazarus Group exploitation. Defense, aerospace, drone/robotics, and surveillance technology organizations should additionally investigate endpoint telemetry for: suspicious local privilege escalation events, processes injecting into SYSTEM-level processes, abnormal outbound HTTPS traffic to Roundcube or CMS-hosted infrastructure, and unusual network connections to OneDrive or the Microsoft Graph API that do not correspond to known application behavior.
CVE-2026-62832 — fast-track. Over a month of public exploit code (LegacyHive, released by Nightmare-Eclipse the day after July’s Patch Tuesday) makes the nominal lack of confirmed exploitation an unreliable comfort. Multi-user systems, terminal servers, shared workstations, and any environment where one account could easily access credentials for another are elevated risk.
DNS Server infrastructure — first-priority server patch. CVE-2026-62878 (CVSS 9.8) belongs on every internet-facing and domain-controller-hosted DNS server. A wormable stack overflow with no authentication requirement, on infrastructure that processes traffic from every networked device. Test and deploy.
Exchange Server — schedule downtime. CVE-2026-62911 has working exploit code in the hands of Pwn2Own Berlin participants. Full-mailbox blast radius from a single compromise. Do not leave on-premises Exchange unpatched.
On-premises SharePoint — confirm both patches. July’s authentication bypass (CVE-2026-55040) plus this month’s remote code execution component are a complete unauthenticated remote code execution chain. Organizations that patched July but have not yet deployed August are still exposed to the second half.
Hotpatching (Windows 11 Enterprise 24H2/25H2): Evaluate enrollment via Microsoft Intune. Eligible enterprise devices can receive the August security fixes through the hotpatch track without a reboot, accelerating effective deployment without the coordination overhead of a scheduled restart window.
Windows 11 24H2 consumer migration: October 13, 2026 is the end-of-life date for Home and Pro editions. Begin migration planning now.
What Is Patching Without a Reboot? Windows 11 Hotpatching, Explained
A notable operational development accompanying this release is the broader rollout of Windows 11 hotpatching for eligible enterprise devices, with the August cycle serving as a hotpatch month for both Windows 11 24H2 and 25H2. Microsoft’s KB5120228 support article covers hotpatch enrollment and eligibility.
Hotpatching works by injecting security fixes directly into active processes in memory during a running session, rather than staging changes that only take effect after the system restarts. The practical result: eligible devices receive equivalent security protection to the full cumulative update — including the fix for CVE-2026-68820 — without the reboot that standard Patch Tuesday installations require.
The system follows a quarterly baseline model. Full cumulative updates with required restarts ship approximately every four months; hotpatch updates arrive in the intervening months. For enterprise IT departments that have traditionally managed twelve forced reboot cycles per year, the hotpatch track reduces that to roughly four — significantly reducing the coordination overhead, smaller patch packages, and the downtime impact on systems where availability is critical.
Eligibility requirements are specific: devices must run Windows 11 Enterprise version 24H2 or 25H2, be managed through Microsoft Intune with a hotpatch-enabled quality update policy, and hold an eligible license — Windows 11 Enterprise E3 or E5, Microsoft 365 F3 or Business Premium, Windows 11 Education A3 or A5, or Windows 365 Enterprise. Virtualization-based security must also be enabled. Devices that do not meet these criteria receive the traditional full cumulative update, KB5121003, with its standard restart requirement. Microsoft’s KB5121003 support page covers patch content and known issues.
The tradeoff is genuine administrative complexity: distinct workflows for baseline and hotpatch months, separate tracking for eligible and ineligible devices, and companion KB articles documenting known hotpatch complications for Windows Server 2025 that IT teams should review before deployment.
Windows 11 24H2 Deadline: Two Months Left for Home and Pro
Windows 11 version 24H2 Home and Pro editions will reach end of support on October 13, 2026. NotebookCheck’s Windows 11 August update coverage notes the proximity of the end-of-support deadline. After that date, those installations will cease receiving monthly security rollups. August’s update is effectively the penultimate Patch Tuesday those users will receive before migration becomes mandatory — November’s Patch Tuesday will be their last.
Enterprise and Education editions receive an additional year of support under a separate lifecycle, but IT teams managing consumer-edition fleets or Home/Pro users should treat the October deadline as an active migration target rather than a future roadmap item. The specific migration path depends on whether the hardware qualifies for Windows 11 25H2 or 26H1.
Frequently Asked Questions
Why does Lazarus Group keep targeting the same Windows driver?
afd.sys — the Windows Ancillary Function Driver for WinSock — has been exploited in at least four confirmed zero-day attacks since 2022. The reason is structural: this kernel-mode driver handles foundational networking operations, has been in Windows since the NT era, and is accessible from any low-privilege user account because it processes socket calls from ordinary applications. An attacker who finds a use-after-free or similar flaw inside it gains a kernel read/write primitive — the ability to write directly to kernel memory — which is the highest-value primitive in Windows privilege escalation. North Korea appears to have made sustained research investment in this driver specifically, because two confirmed Lazarus campaigns have burned known-good afd.sys zero-days on it, and the pattern suggests active ongoing research into the component. Tenable’s August 2026 Patch Tuesday analysis examines the full afd.sys zero-day history.
What does FudModule v3.1 actually do to endpoint security tools?
FudModule v3.1 is a kernel-mode rootkit that operates at the same privilege level as the Windows kernel itself, giving it direct access to the kernel data structures that security products depend on. Once deployed — which requires SYSTEM-level privileges, achieved here through CVE-2026-68820 — it removes Event Tracing for Windows (ETW) callback registrations from the kernel, disabling 94 ETW providers. ETW is the logging infrastructure that endpoint detection and response tools use to observe process creation, network connections, file access, and registry changes. With those callbacks removed, the endpoint detection and response tool receives no telemetry and cannot detect what the attacker does next. FudModule v3.1 also disables minifilter drivers (file system activity monitors), kills the NT Kernel Logger, and in a new addition, resets Smart App Control’s policy state. Cybersecurity News has a detailed technical breakdown of FudModule v3.1.
Is my Windows 11 device protected if I install KB5121003?
Yes — KB5121003 is the cumulative update that contains the fix for CVE-2026-68820 along with all other August 2026 security patches. Installing it on Windows 11 24H2 or 25H2 closes the vulnerability Lazarus Group has been exploiting. Eligible enterprise devices can receive the same security coverage through the hotpatch track without a reboot; standard Home and Pro devices receive it through the regular cumulative update with a required restart. Install it now through Windows Update or pull KB5121003 from the Microsoft Update Catalog.
What is Operation Dream Job and should defense sector employees be concerned?
Operation Dream Job is a North Korean espionage campaign, attributed to Lazarus Group and active since at least 2020, that targets defense, aerospace, and technology sector professionals through fake job offers. Attackers pose as recruiters on LinkedIn or through direct messaging, offering positions at recognizable companies, and direct targets toward malicious files disguised as job application materials. The campaign’s current wave focuses on organizations working on surveillance sensors, drones, robotics, and military technology. Defense sector employees who receive unsolicited recruiter outreach — especially involving file downloads — should treat it with the same scrutiny they would apply to any unverified download, regardless of how convincing the accompanying documentation looks. Check Point Research’s full Operation Dream Job report details the current attack chain.
Click Here For The Original Source.
