HIGH: Windows AFD.sys Zero-Day CVE-2026-68820 Exploited by Lazarus

Pour one out for the idea that a CVSS 7.0 is a next sprint problem.

Microsoft shipped its August 2026 Patch Tuesday on August 11, and buried in a genuinely absurd pile of 398 CVEs sits one flaw that North Korean operators had already been quietly using for weeks. CVE-2026-68820 is an elevation of privilege bug in afd.sys, the Ancillary Function Driver for WinSock, and it carries a base score of 7.0. That number is going to get this thing deprioritized in a lot of environments, which is precisely the mistake the Lazarus Group is banking on.

Check Point Research caught the exploitation and attributed it to Lazarus operating under the banner of Operation Dream Job, the long running fake recruiter campaign that has been separating defense engineers from their credentials for years. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day the patch landed and gave federal agencies two weeks to sort it out. When a 7.0 gets KEV listed on day one, the score has stopped being the story.

What the bug actually is

afd.sys is not some obscure optional component. It is the kernel driver sitting underneath every socket operation on a Windows machine, the thing the Windows Sockets API talks to when anything on the box opens a network connection. It runs in the kernel, it is present by default, and it is reachable from unprivileged user mode code by design, because unprivileged code needs to make network connections. That combination has made it one of the most reliably productive privilege escalation targets in Windows over the last several years, and attackers keep going back to the well for good reason.

The specific defect is a use after free triggered by a race condition. Two threads touch the same socket state without proper synchronization, one of them frees a kernel object while the other is still holding a reference to it, and the attacker gets to decide what occupies that memory next. Win the race, groom the pool, and the freed object becomes an arbitrary kernel read and write primitive. From there, escalating a standard user token to SYSTEM is well trodden ground.

The catch, and the reason for the modest 7.0, is that this is local only. An attacker needs code already executing on the target before any of it matters. That constraint is real, and it is also why treating the score as a proxy for urgency falls apart here. Lazarus does not consider getting code running on the target to be a meaningful obstacle. That part is their day job.

How the attack actually runs

The intrusion chain is patient and it is aimed at people, not perimeters. It opens with a recruiter reaching out on LinkedIn with a role that is a little too good and a compensation range that is a little too generous. The target works in defense, aerospace, or aviation, and the message reads like it was written by someone who has actually studied their background. Check Point tracked victims across France, Germany, Brazil, and India.

From there the campaign splits into two observed paths. In the first, a DLL sideloading chain executes MISTPEN, a lightweight downloader that handles reconnaissance and persistence before anything noisy happens. Once MISTPEN has established a foothold and confirmed the machine is worth the trouble, the afd.sys exploit fires, SYSTEM is obtained, and the ForestTiger remote access tool gets deployed. In the second path, the target is steered toward a trojanized PDF viewer branded as SecurityPDF, which drops a new DLL backdoor called Troy that supports seventeen operator commands.

The reason the zero day matters is what comes after it. With SYSTEM in hand the operators load FudModule 3.1, the kernel mode rootkit Lazarus has been iterating on for years, whose entire purpose is to reach into kernel structures and blind the security products watching the endpoint. Check Point also observed a PHP web shell called RelayShell used for command and control relay. The privilege escalation is not the objective. It is the door between having a foothold on a workstation and owning the machine outright while the EDR agent quietly stops having opinions about it. MISTPEN gets reinjected into a SYSTEM process to finish the job of disappearing.

The campaign ran for roughly five weeks before the patch shipped. That is five weeks of a kernel zero day in the hands of an operator who specializes in defense sector espionage and had no particular reason to hurry, because nobody was looking.

Who needs to care and how much

Every supported Windows build is in scope. Windows 10, Windows 11, and multiple Windows Server generations all received fixes on August 11. There is no configuration that opts you out, because there is no Windows without afd.sys.

If you are in defense, aerospace, aviation, or their supply chains, this is a drop everything item and you should be hunting as well as patching. Everyone else should still treat it as a priority, because exploitation techniques do not stay contained to their original owner. A working afd.sys escalation primitive is exactly the kind of capability that turns up in commodity tooling and ransomware playbooks a few months later, once the technique leaks or gets independently rediscovered. The initial access broker who sells you to a ransomware crew appreciates a reliable local privilege escalation just as much as Pyongyang does.

What to do about it

Deploy the August 2026 cumulative updates. That is the fix, there is no workaround, and no registry key is going to save you. Microsoft did not ship a mitigation for this one, because for a kernel driver defect of this shape there generally is not one short of the patch itself.

Detection is worth some effort even after you have patched, because patching does not evict anyone who is already inside. Hunt for processes that transition to SYSTEM without a plausible parent or service context, particularly where the originating process is a document viewer or a recently installed application. Look for DLL sideloading, meaning legitimate signed binaries loading unsigned or unexpected DLLs out of writable directories. Watch for EDR agents going quiet or losing kernel visibility on a host that is otherwise still online and reporting, because that silence is the intended outcome of FudModule rather than a monitoring glitch. Review any PDF viewer installed outside your software approval process over the past several months, and treat anything calling itself SecurityPDF as hostile on sight.

On the human side, remember that the initial access here is a recruiter message. Tell your engineering staff and your defense adjacent clients, in plain language, that unsolicited job offers arriving with attachments or installers are an attack pattern and not a compliment. Check Point specifically called out scrutinizing unsolicited recruiting outreach, which is an unusual line to find in a vulnerability writeup and tells you exactly where the real front line sits.

The rest of the August pile

While you are in there, 398 CVEs is not a typo and 62 of them are rated Critical. Four unauthenticated remote code execution flaws sit at CVSS 9.8 and deserve attention ahead of the zero day if you have the relevant services exposed. CVE-2026-62878 is a stack based buffer overflow in Windows DNS Server that has been described as wormable, which is a word that should ruin your afternoon. CVE-2026-62893 affects TFTP handling in Windows Deployment Services, CVE-2026-62815 hits the Microsoft QUIC transport, and CVE-2026-59124 lands in HPC Pack, rated Important only because it is not installed by default. There is also a two part SharePoint fix worth understanding, since CVE-2026-55040 from July handled an authentication bypass and CVE-2026-63520 in August closes the remote code execution half of the chain. Applying only one of those leaves the chain broken but the door unlocked, and there is already public exploitation of the SharePoint bypass following a proof of concept release.

The business angle

There is a clean upsell here for any MSP carrying defense, aerospace, aviation, or precision manufacturing clients. This is a concrete, attributed, nation state campaign that used a five week zero day window against exactly their peer group, which makes it the most persuasive argument you will get all quarter for managed EDR with kernel tamper alerting and for a patch SLA measured in days rather than quarters. Lead with the KEV listing and the two week federal deadline, because a published government deadline reframes the conversation from your opinion into a standard somebody else set.

The second angle is security awareness training aimed at senior technical staff rather than at reception. Most awareness programs teach people not to click invoices. Almost none of them teach a principal engineer that a flattering LinkedIn recruiter with a PDF attachment is documented North Korean tradecraft. That gap is a service you can sell, and this campaign is the case study that sells it.