Microsoft’s August 2026 Patch Tuesday addresses hundreds of security vulnerabilities, but one issue stands out because attackers were already exploiting it before a fix became available. CVE-2026-68820 is a high-severity elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock, or AFD.sys, that can allow a local attacker to escalate privileges to SYSTEM.
The flaw carries a CVSS score of 7.0 and resides in a core Windows kernel driver responsible for supporting socket operations used by the Windows Sockets API. Although exploitation requires an attacker to already have code running on the target machine, successful abuse effectively turns an existing foothold into full system-level control without requiring additional user interaction.
The vulnerability has also been linked to real-world nation-state activity. Check Point Research attributed exploitation to the North Korea-linked Lazarus group as part of its long-running Operation Dream Job campaign, where attackers used the zero-day to deploy a new version of the FudModule kernel-mode rootkit after initially compromising targeted systems.
CVE-2026-68820 analysis
At a technical level, CVE-2026-68820 is a use-after-free vulnerability in AFD.sys caused by improper synchronization when multiple threads interact with socket-related state concurrently. Under specific race conditions, one code path can free a memory object while another continues to access it, creating a memory corruption condition that can be weaponized for privilege escalation.
An attacker must first obtain local authenticated access or otherwise achieve code execution on the target. A specially crafted application can then repeatedly trigger the race condition until the vulnerable timing window is reached. Successful exploitation provides a kernel read/write primitive that can ultimately be leveraged to obtain SYSTEM privileges.
The most important details for CVE-2026-68820 are therefore its role in a multi-stage intrusion rather than initial access. Attackers cannot simply target a Windows device remotely through AFD.sys from the internet. Instead, the bug becomes valuable after malware, stolen credentials, phishing, or another vulnerability has already provided a foothold.
That pattern was observed in Lazarus’ Operation Dream Job. Check Point researchers found the group using fake employment opportunities aimed heavily at defense, aerospace, aviation, drone, robotics, and military technology organizations. The campaign used malicious PDF-related lures and trojanized software to gain initial execution before deploying additional malware modules.
During one infection chain, the MISTPEN in-memory downloader performed reconnaissance, established persistence, and loaded an exploit module targeting the Windows networking driver. After successful privilege escalation, the attackers executed FudModule with SYSTEM rights, giving the kernel-mode rootkit the privileges necessary to interfere with security monitoring and support deeper compromise.
CVE-2026-68820 affects a broad range of supported Windows client and server releases, including Windows 10, Windows 11, and multiple Windows Server generations. This makes the flaw relevant not only to employee workstations but also to enterprise servers where an existing low-privileged compromise could be escalated to complete system control.
At the time of writing, neither of the requested reports points to a public CVE-2026-68820 PoC. Check Point also intentionally withheld full technical exploitation details immediately after Microsoft released the patch, reducing the amount of information available for straightforward reproduction while organizations deploy updates.
There are likewise no Microsoft-published CVE-2026-68820 IOCs that uniquely identify exploitation of the race condition itself. However, defenders investigating possible Operation Dream Job activity can correlate privilege-escalation events with the malware, infrastructure, and file indicators released as part of Check Point’s campaign research.
CVE-2026-68820 Mitigation
Microsoft addressed the vulnerability in its August 11, 2026 Patch Tuesday updates. Because the flaw has already been exploited in real attacks, affected Windows endpoints and servers should be prioritized for immediate remediation even though its CVSS score is lower than several critical remote code execution issues included in the same update cycle.
CVE-2026-68820 detection should focus on both patch status and behavior associated with local privilege escalation. Security teams should identify Windows systems that have not received the August security updates and investigate unexpected transitions from ordinary user or application contexts to SYSTEM-level execution.
To Detect CVE-2026-68820 exploitation or related post-compromise activity, defenders should pay particular attention to:
- Unexpected processes obtaining SYSTEM privileges after execution from a user context
- Suspicious activity involving AFD.sys immediately before privilege escalation
- Kernel-level malware or attempts to interfere with EDR visibility
- Unusual process, thread, registry, or security callback manipulation
- Evidence of DLL sideloading or malicious PDF-related delivery chains
- New persistence mechanisms appearing shortly before kernel-level activity
Organizations should also remember that patching the local privilege-escalation flaw does not remove malware or persistence already established on systems compromised before the update. Hosts showing indicators consistent with Lazarus activity should be treated as potential incidents and investigated beyond simple patch verification.
For high-risk organizations, particularly those in defense, aerospace, aviation, robotics, and related technology sectors, remediation should therefore combine rapid Windows patching with endpoint hunting, privilege-escalation monitoring, credential review, and investigation of suspicious job-themed lures or trojanized software recently executed by users.
FAQ
What is CVE-2026-68820 and how does it work?
CVE-2026-68820 is a use-after-free elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock, also known as AFD.sys. A locally authenticated attacker can run a specially crafted application that triggers a race condition in the driver. Successful exploitation can provide kernel-level memory access and allow the attacker to elevate privileges to SYSTEM.
When was CVE-2026-68820 first discovered?
Check Point Research reported the vulnerability to Microsoft Security Response Center on July 28, 2026. Microsoft confirmed the issue on July 31, assigned the CVE identifier on August 5, and released the security fix on August 11, 2026 as part of Patch Tuesday. Check Point observed the zero-day being exploited in Operation Dream Job since at least early July 2026.
What is the impact of CVE-2026-68820 on systems?
Successful exploitation grants SYSTEM privileges, giving an attacker the highest practical level of control over a Windows host. This can enable security-tool interference, credential access, persistence, malware deployment, data theft, and additional lateral movement across the environment.
Can CVE-2026-68820 still affect me in 2026?
Yes. Windows systems that have not received Microsoft’s August 2026 security updates can remain vulnerable. The risk is particularly urgent because exploitation was confirmed before the patch was released and the vulnerability has already been incorporated into a sophisticated nation-state intrusion campaign.
How can I protect myself from CVE-2026-68820?
Apply Microsoft’s August 2026 security updates immediately and confirm that updates and required reboots have completed across Windows endpoints and servers. Organizations should also hunt for suspicious SYSTEM privilege escalation, kernel-level malware, and indicators associated with Lazarus’ Operation Dream Job, especially on systems that may have been compromised before patching.