August 2026 Patch Tuesday: The Zero-Day Lazarus Used

North Korea’s Lazarus Group exploited a Windows kernel zero-day for five weeks before Microsoft patched it on August 11 — and your VS Code editor was also in the line of fire. This month’s August 2026 Patch Tuesday pushed 421 CVEs, the second-largest drop in Microsoft’s history, with CVE-2026-68820 already weaponized by state actors running the FudModule kernel rootkit against defense and aerospace firms across Europe and India. If you’re on Windows — developer machine, CI/CD agent, or production server — this is the month to patch without delay.

The Zero-Day That Nation-States Were Already Using

CVE-2026-68820 is a use-after-free in afd.sys, the Windows Ancillary Function Driver for WinSock. It works like this: two competing threads race to access socket state, and an attacker who times the race correctly corrupts freed memory to gain a kernel read/write primitive — effectively full SYSTEM privileges with no additional user interaction required. Check Point Research discovered and reported it to Microsoft on July 28; the CVE was assigned August 5; the patch shipped August 11. Lazarus had already been exploiting it since early July.

The Lazarus Group’s Operation Dream Job campaign used fake job recruitment emails to target employees at defense, aerospace, and aviation companies, then deployed CVE-2026-68820 to escalate from initial access to SYSTEM. Their updated FudModule rootkit disabled EDR telemetry and bypassed Smart App Control — standard anti-forensics to maintain persistence. BleepingComputer’s detailed writeup covers the full attribution chain. CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch within two weeks. For everyone else, treat that timeline as the maximum, not the target.

The threat model here is clear: this is a local privilege escalation, not a remote exploit. An attacker needs code running on your machine first — via phishing, a supply chain compromise, or a malicious VS Code extension. Once they have that foothold, CVE-2026-68820 turns it into full kernel control. Run Windows Update now.

Related: GitHub Copilot Security Flaw Hits Snowflake: 5-Day Exploit

Your Code Editor Is Now a Patch Priority

Developer tools took 26 CVEs this month — the category Microsoft explicitly labels “Developer Tools.” Three of those are remote code execution vulnerabilities in Visual Studio Code: CVE-2026-59113, CVE-2026-69320, and CVE-2026-70336, all rated CVSS 8.8. CVE-2026-59113 is the sharpest: missing authorization allows an unauthenticated attacker to execute code over a network against a running VS Code instance. All three are fixed in VS Code 1.132.1. Open the editor, go to Help > About, and verify your version. If VS Code auto-updates silently, you may already be covered — but verify anyway.

PowerShell picked up an RCE (CVE-2026-70337) that directly affects CI/CD pipelines and infrastructure automation running on Windows. .NET Framework and Core received seven elevation-of-privilege fixes plus an additional RCE (CVE-2026-70354). The Python VS Code extension has a security bypass (CVE-2026-54981). The pattern is clear: the developer toolchain is an increasingly valuable attack surface, and this month Microsoft’s August update confirms it with 26 patches aimed directly at developer environments.

Three CVSS 9.8 Vulnerabilities Your Infrastructure Cannot Ignore

None of the following are exploited in the wild yet — but ZDI analysts explicitly reject Microsoft’s “Exploitation Less Likely” labels for vulnerabilities this severe, and history backs them up. CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server with a CVSS score of 9.8. No authentication required. No user interaction required. Wormable — meaning it can propagate automatically between DNS servers once weaponized. Patch every Windows DNS Server in your environment immediately.

CVE-2026-62815 patches a QUIC/HTTP3 unauthenticated RCE affecting approximately 13.5 million websites using Microsoft’s HTTP/3 implementation. If you run services behind Microsoft’s QUIC layer, this is infrastructure patching, not optional. CVE-2026-62893 is a TFTP server RCE transmitted over UDP port 69 without authentication; it’s typically blocked at perimeters but presents serious lateral movement risk inside enterprise networks. The Zero Day Initiative’s full analysis covers the technical details for each.

Publicly Disclosed: The Clock Is Already Running

CVE-2026-62832, a Windows User Profile Service privilege escalation, is publicly disclosed with Microsoft rating it “Exploitation More Likely.” Public disclosure means the technical details are already in attackers’ hands. This flaw lets an attacker access or modify other users’ profile data and escalate to admin on shared Windows systems — relevant for developer workstations with multiple accounts and shared development servers. Patch this one the same day as the zero-day: the window between public disclosure and active exploitation continues to shrink.

Key Takeaways

• Patch CVE-2026-68820 (afd.sys) immediately via Windows Update — it’s actively exploited by Lazarus Group and on CISA’s KEV catalog
• Update Visual Studio Code to 1.132.1 now — three CVSS 8.8 RCEs in your editor are not acceptable to leave open
• Priority-patch Windows DNS Server (CVE-2026-62878, CVSS 9.8) and QUIC (CVE-2026-62815) — wormable conditions deserve urgency regardless of current exploitation status
• Watch CVE-2026-62832 (User Profile Service, publicly disclosed) — “Exploitation More Likely” means weaponization is days or weeks away
• Use the CISA KEV catalog as your patch priority guide when 421 CVEs land at once — it cuts through the noise