Microsoft shipped fixes for 421 vulnerabilities this month. Among them sits one already under active attack. The exploited zero-day targets a core networking driver present on virtually every Windows system. And security teams can’t afford to wait.
The SecurityWeek report put the total at 421 CVEs, with roughly 236 affecting Windows itself. That count includes 62 rated critical. Another 357 carry important severity. Numbers vary slightly across analysts because of how they tally overlaps and browser fixes released separately. Yet all agree. This release demands attention.
One driver. Repeated trouble.
CVE-2026-68820 stands out. Microsoft describes it simply. “Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.” The flaw lives in afd.sys. That kernel-mode component underpins the Windows Sockets API. A locally authenticated attacker runs a specially crafted application. It triggers a race condition. Win that race and the system hands over SYSTEM privileges. No user interaction required.
The CVSS base score lands at 7.0. Attack complexity scores high because exploitation hinges on precise timing. Still, the payoff justifies the effort. Attackers gain the highest level of access on the box. Microsoft confirms exploitation in the wild. CISA added the bug to its Known Exploited Vulnerabilities catalog and set a patching deadline of August 25, 2026.
Check Point Research connected the dots to North Korea’s Lazarus group. Their report, “Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack,” details how the actors folded the zero-day into Operation Dream Job. This long-running campaign lures targets with fake employment offers at prestigious firms. Victims in defense and aerospace sectors across Europe and India took the bait.
The attack chain starts with trojanized PDF viewers or DLL sideloading. MISTPEN, a lightweight in-memory downloader, performs reconnaissance and takes screenshots. It then loads a local privilege escalation module. That module exploits CVE-2026-68820 to run a new variant of FudModule, Lazarus’ kernel-mode rootkit. The rootkit disables EDR tools, kills telemetry, tampers with Smart App Control, and maintains persistence. From there the Troy backdoor takes over. It offers 17 commands for file operations, process injection, and command execution.
Researchers Moshe Marelus and David Driker at Check Point discovered and reported the bug. Microsoft credits them in the advisory. The vulnerability first appeared in the wild in early July 2026. Check Point notified Microsoft on July 28. The company assigned the CVE on August 5 and patched it during the August 11 release.
This marks the fourth afd.sys zero-day exploited since 2022. Previous examples include CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. The latter also tied back to Lazarus. The driver has become a favorite target. Its position in the kernel makes it attractive for privilege escalation after initial access.
But CVE-2026-68820 doesn’t stand alone. Microsoft addressed two other publicly disclosed zero-days. CVE-2026-62832 involves improper link resolution in the Windows User Profile Service and could allow elevation of privilege. Microsoft rates exploitation more likely. CVE-2026-72971 concerns link following in unionfs.sys and carries lower risk.
Critical remote code execution bugs appear across DNS Server, TFTP, QUIC, and Microsoft HPC Pack. One critical flaw in Exchange Server enables elevation of privilege. Hyper-V, NTFS, HTTP.sys, and Desktop Window Manager also received fixes. The breadth reflects Microsoft’s expanding attack surface as cloud services and legacy components mingle.
Analysts urge immediate action. Qualys researchers noted 62 critical issues and stressed that “timely patch deployment is crucial to reduce exposure.” They recommend using vulnerability management tools for rapid remediation across endpoints and servers.
Rapid7 pointed out that while the volume sits below July’s record, it still ranks among the largest Patch Tuesday releases ever. The firm highlighted that afd.sys flaws often require winning a race condition, yet adversaries clearly succeed often enough. Their analysis recommends prioritizing systems where untrusted users can run code locally.
Tenable’s review listed 398 CVEs in their count but agreed on the urgency of CVE-2026-68820. They noted two additional elevation-of-privilege bugs in the same driver this month, though neither shows exploitation. CrowdStrike and SANS Internet Storm Center echoed the call to patch the zero-day first.
The Hacker News connected the zero-day directly to Lazarus’ Operation Dream Job, citing Check Point’s findings on the new FudModule variant. SecurityWeek reported that the group used the bug to deploy a kernel-mode rootkit and evade defenses. Recent coverage from Help Net Security and Krebs on Security reinforces the pattern. Nation-state actors probe Windows kernel components for reliable post-exploitation paths.
So what should organizations do? Apply the updates. Test where possible but don’t delay on high-risk systems. Monitor for suspicious privilege escalation events involving afd.sys or unusual kernel driver loading. Review endpoint detection logs for signs of MISTPEN, Troy, or FudModule behaviors such as ETW tampering or minifilter removal.
Microsoft’s update guide lists dozens of affected builds across Windows 10, Windows 11, and Server editions. Cumulative updates address most issues. Some require additional steps for on-premises Exchange or SharePoint. Non-Microsoft flaws in TPM components also received patches.
The scale of these releases has grown. Volumes that once seemed exceptional now appear routine. Administrators face hundreds of CVEs monthly. Prioritization becomes survival. Focus first on exploited bugs, then critical remote code execution flaws reachable from the network, then privilege escalations that pair with initial access vectors.
Lazarus continues to evolve. They combine social engineering, zero-days, custom rootkits, and compromised infrastructure for command and control. Their use of post-quantum key exchange in some campaigns shows increasing technical sophistication. Defenders must match that pace.
Patch Tuesday offers a monthly reset. This one carries higher stakes because real attacks already leverage the flaw. Ignore it and the next intrusion may not stop at initial access. It could own the kernel. And once there, visibility disappears.
Security teams that treat CVE-2026-68820 as optional invite exactly the outcome Microsoft and researchers warned against. Update now. Verify deployment. Watch the logs. The window for easy remediation closes fast when nation-state operators hold working exploits.