CVE-2026-68820: The Windows Driver Bug Lazarus Used Four Times on the Same Targets

A use-after-free bug in a driver most Windows admins have never heard of is now the reason North Korean state hackers got SYSTEM access on defense-sector machines they’d already phished their way into. CVE-2026-68820 sits in afd.sys, the kernel driver every networked Windows application depends on, and CISA’s Known Exploited Vulnerabilities catalog says it has been under active exploitation since before it was even patched. Federal agencies have until August 25 to fix it. Everyone else should treat that date as their deadline too.

What’s actually broken

afd.sys, the Ancillary Function Driver for WinSock, is the kernel-mode component that backs Windows’ socket API. Every process that opens a TCP or UDP connection, which is to say nearly every process on a modern Windows machine, routes through it. CVE-2026-68820 is a use-after-free in that driver: a specific sequence of socket operations frees a piece of kernel memory the driver later reuses, and an attacker who controls the timing can get their own data written into that freed memory before the driver reads it back as trusted data.

The result is local privilege escalation. A process running with a normal, unprivileged user account can trigger the bug and walk away with SYSTEM, the top of the Windows privilege hierarchy. That’s not remote code execution on its own, an attacker can’t reach out over the network and pop a fully patched machine cold. What it does is turn “I have a foothold on this box” into “I own this box completely,” which is precisely the step that separates a contained phishing click from a full compromise.

Who’s using it, and how

Researchers tracking Lazarus Group’s long-running Operation Dream Job campaign identified CVE-2026-68820 in active use since early July, weeks before Microsoft’s patch shipped. The campaign’s initial access hasn’t changed in years because it keeps working: a fake recruiter, often impersonating a real defense or aerospace company, reaches out on LinkedIn or by email with a job opportunity, then sends a “coding assessment” or “offer document” that’s actually a loader. Once that first-stage payload runs with the logged-in user’s normal privileges, CVE-2026-68820 is the second stage, the piece that turns a compromised user session into full SYSTEM access on the box.

The same reporting notes Lazarus has hit some of the same defense-sector targets more than once using this exact combination, which tells you two things. First, the recruiter lure still works well enough that a well-resourced group keeps reusing it instead of innovating. Second, a local privilege escalation bug this reliable is worth stockpiling and reusing across multiple operations rather than burning on a single target, which is exactly what “actively exploited since July, publicly disclosed and patched in August” implies about how these campaigns actually run.

Stage 1: Initial access
  Fake recruiter (LinkedIn/email) -> malicious "assessment" document
  -> user opens it -> code runs with standard user privileges

Stage 2: Privilege escalation (CVE-2026-68820)
  Use-after-free in afd.sys triggered via crafted socket operations
  -> attacker-controlled data lands in freed kernel memory
  -> attacker gains SYSTEM

Result: full local compromise, ready for lateral movement or data theft

Why “local” doesn’t mean “low priority”

It’s tempting to triage local privilege escalation bugs below remote code execution, and in isolation that’s often the right call. The problem is that almost no real intrusion is a single vulnerability. Attackers chain an initial-access bug (phishing, a malicious document, an exposed service) with a privilege escalation bug to turn limited access into complete control, and CVE-2026-68820 is a well-documented, currently-weaponized half of exactly that chain. CISA’s KEV listing exists specifically to flag this: not “this is theoretically dangerous” but “this is the bug real attackers are using right now, patch it on the same clock you’d use for anything actively exploited.”

The same logic applies to every KEV addition: severity score alone under-describes risk. A CVSS-moderate local privilege escalation that’s confirmed in active use by a capable group is a more urgent patch than a theoretical critical bug nobody has bothered to weaponize yet.

What to actually do

There’s no configuration workaround here worth documenting, because there isn’t one. AFD.sys can’t be disabled, blocked, or filtered around without breaking Winsock networking for every application on the host, browsers, email clients, VPN software, all of it. The fix is Microsoft’s August 2026 cumulative update.

1. Confirm the August 2026 Patch Tuesday update is installed on every Windows endpoint and server in your environment, not just the ones your patch management dashboard flags as high-priority.
2. Prioritize internet-facing and defense/aerospace-adjacent targets first if you’re staggering the rollout. Operation Dream Job specifically targets that sector, and a reused recruiter lure means your team’s exposure to the initial-access stage may be higher than a generic phishing baseline.
3. Re-check phishing awareness training against the current lure, specifically LinkedIn recruiter outreach with an attached “assessment.” It’s an old pattern that keeps working because it doesn’t look like a typical phishing email.
4. Audit for signs of prior compromise if any endpoint went unpatched through July or early August, since exploitation predates the public patch by weeks. A patch closes the door going forward; it doesn’t undo an escalation that already happened.

If your organization runs any kind of formal vulnerability management program, this is a textbook case for why KEV-driven prioritization beats CVSS-only triage: a moderately-scored local bug, paired with a well-worn phishing lure and a state-sponsored group actively using it, is exactly the kind of thing a pure severity filter misses and a KEV feed catches. If you’re auditing your patch cadence against actively exploited vulnerabilities rather than just monthly severity scores, our team can walk through what a KEV-first triage process looks like for your environment.