Act nowKnown exploited

Advisory · CVE-2026-68820

Lazarus used this Windows socket bug to go kernel-deep

A use-after-free race in the Windows AFD driver let local attackers escalate to SYSTEM. Microsoft patched it August 11, 2026; Check Point attributes zero-day exploitation to the Lazarus Group's Operation Dream Job.

Advisory published August 11, 2026Independent summary
Vendor
Microsoft
Product
Windows
Identifier / CWE
CVE-2026-68820
CWE-416
Action timing
Sep 1, 2026
ELI5

Explain it like I’m five

The part of Windows that handles network calls leaves a coat-check ticket on the hook after the coat is picked up. An attacker grabs the reused ticket, claims someone else's coat, and walks out wearing the building manager's uniform.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Fake recruiter lure

    Targets at defense and aerospace organizations are approached with fabricated job offers, sometimes via trojanized software.

  2. 02Local foothold

    The lure delivers malware that runs with limited user privileges on the victim's machine.

  3. 03Race triggered

    The malware triggers a use-after-free race condition in afd.sys, the kernel driver behind Windows networking.

  4. 04Rootkit deployed

    With SYSTEM access, the attackers deploy the FudModule kernel rootkit to blind security telemetry and persist.

What happened

Microsoft’s August 11, 2026 Patch Tuesday fixed CVE-2026-68820, a use-after-free vulnerability (CWE-416) in afd.sys, the Windows Ancillary Function Driver for WinSock that handles low-level socket operations in kernel mode. Triggering a race condition in the driver’s concurrent socket handling lets an attacker with code already running on the machine escalate to SYSTEM. Microsoft rates it CVSS 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and flagged it as the only flaw in that release under active exploitation. Check Point Research, which reported the vulnerability to Microsoft on July 28, 2026, attributes the zero-day exploitation to North Korea’s Lazarus Group as part of its Operation Dream Job campaign: fake recruiter lures impersonating a real privacy-technology company targeted defense, aerospace, and aviation organizations in France, Germany, Brazil, and India over roughly five weeks. Post-exploitation, the group deployed FudModule v3.1, a kernel-mode rootkit that disables EDR telemetry including around 94 ETW providers, alongside the Troy and ForestTiger backdoors. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 11, 2026.

What to do

  1. Apply the August 2026 or later Windows cumulative update to all client and server systems; do not rely on the exploit’s narrow build-target checks as an exposure test.
  2. Patching does not remove FudModule or restore impaired telemetry: isolate suspected systems, collect volatile evidence first, then reimage.
  3. Review confirmed or suspected systems for disabled kernel callbacks, minifilters, ETW providers, crash-dump suppression, Smart App Control changes, and unusual SYSTEM processes.
  4. Brief recruiting-adjacent and defense-sector staff on the fake-recruiter lure pattern, since the initial access here was social engineering, not a technical perimeter failure.

Management note

This is a state-sponsored group spending a genuine Windows kernel zero-day on targeted espionage, not commodity crimeware. The technical fix is one Patch Tuesday update, but the real exposure is post-exploitation: a kernel rootkit designed to blind your own security tools. Any system that may have been hit needs forensic handling and a rebuild, not just a patch and a reboot.