By ByteBot
North Korea’s Lazarus Group spent five weeks exploiting a zero-day in Windows’ network socket driver before Microsoft patched it on August 11. The vulnerability, CVE-2026-68820, lives inside AFD.sys — the kernel component that handles Windows Sockets. Exploitation escalates a local low-privilege account to full SYSTEM access, no user interaction required. Lazarus used that escalation to drop the FudModule rootkit, which killed 94 security-monitoring channels on compromised machines. The patch is out. Federal agencies have until August 25, 2026 to apply it. If your Windows fleet hasn’t been updated, that’s your one actionable item today.
What the Vulnerability Actually Does
AFD.sys is a kernel-mode driver that sits below the Windows Sockets API, handling network I/O for every application on the machine. CVE-2026-68820 is a use-after-free flaw triggered by a race condition in the driver’s IOCTL handlers. When two threads interact with socket-related state at the right moment, one path can free a kernel object while another still holds a reference to it. That stale pointer becomes a write primitive.
Lazarus weaponized this into a full privilege escalation chain: trigger the vulnerable path, race to reallocate the freed memory chunk with a crafted object, and win a kernel read/write primitive that chains into SYSTEM privileges. Microsoft rated this CVSS 7.0 — “Important,” not “Critical.” Ignore that label. The score reflects the local-only attack requirement. What it doesn’t capture is that any existing foothold — a phishing payload, stolen credentials, a supply chain compromise — becomes a complete OS takeover the moment this exploit runs.
How Lazarus Got In: Operation Dream Job
The exploitation vector was not a technical trick. It was a LinkedIn message. Operation Dream Job is Lazarus’s long-running social engineering campaign targeting defense, aerospace, and aviation professionals. Victims receive convincing recruiting pitches, open a document or run an executable, and hand Lazarus its initial foothold. CVE-2026-68820 took it the rest of the way.
Once at SYSTEM level, the group deployed FudModule v3.1, the latest version of their kernel-mode rootkit. The rootkit’s primary job is staying invisible: it blinds over 90 ETW (Event Tracing for Windows) providers — the same telemetry channels that endpoint detection and response tools depend on. A compromised machine with FudModule running looks clean to most security products. Check Point Research discovered the exploitation and reported it to Microsoft on July 28. The rootkit artifact was compiled July 7, confirming five weeks of unchecked access before the patch landed.
The CISA Deadline and Who It Applies To
CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog on August 11 — the same day Microsoft published the fix. Under Binding Operational Directive 26-04, federal agencies must remediate KEV entries within 3 to 14 days depending on risk profile. That puts the hard deadline at August 25, 2026.
Private organizations are not bound by BOD 26-04. But the KEV catalog is not bureaucratic noise — every entry represents a vulnerability with confirmed, real-world exploitation by actual threat actors. If it’s in KEV, someone is actively using it against production environments right now. Treat August 25 as a useful target even if you’re not a federal agency.
The Fix: KB Numbers by Windows Version
The patch shipped as part of August 2026 Patch Tuesday. Apply it via Settings → Windows Update → Check for updates → Install → Restart:
- Windows 11 24H2 / 25H2: KB5121003 (builds 26100.9168 / 26200.9168)
- Windows 11 23H2 (Enterprise/Education): KB5120240
- Windows 10 (Extended Security Updates): KB5120249
Verify the correct KB appears in your update history. For enterprise environments, WSUS and Intune policies targeting the August cumulative update will pull the correct KB automatically — but confirm deployment is complete before the 25th, not after.
Two More CVEs That Warrant Immediate Attention
CVE-2026-68820 is the most urgent because it’s actively exploited, but August Patch Tuesday shipped 421 fixes. Two others deserve attention alongside it:
- CVE-2026-62893 (CVSS 9.8): Remote code execution in Windows Deployment Services TFTP Server. No local access required. If you run WDS, this is a remote takeover waiting to happen.
- CVE-2026-62869 (CVSS 8.8): Spoofing vulnerability in Microsoft Entra ID. If your organization relies on Entra for authentication, this deserves attention for its potential blast radius.
Patch Developer Machines First
Operation Dream Job targets technical professionals, and developer machines are high-value targets. A compromised developer workstation hands Lazarus access to source code repositories, cloud credentials, CI/CD pipeline configurations, and signing keys. The fake job offer that starts this attack chain is credible enough to fool experienced engineers — it has happened repeatedly. If you’re triaging a large fleet, start with developer workstations.
Lazarus had this exploit for five weeks. They are not slowing down, and a patch you delayed is effectively a gift. KB5121003 is waiting in Windows Update. This one is worth interrupting your sprint for.
