CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

1. Executive summary

CVE-2026-68820 is a use-after-free vulnerability (CVSS 7.0, HIGH) in the Windows Ancillary Function Driver for WinSock (afd.sys) — the kernel driver behind Windows socket connections on effectively every endpoint. The flaw allows a locally authenticated, low-privilege attacker to trigger a race condition via a specially crafted application to gain SYSTEM-level privileges with no user interaction. Microsoft and multiple independent sources confirm active exploitation in the wild as a zero-day. Check Point attributes this exploitation to North Korea's Lazarus Group as part of Operation Dream Job, using it to deploy the FudModule kernel-mode rootkit; this attribution is unconfirmed by MITRE ATT&CK profiling in the verified reference data. EMEA financial services should treat this as an urgent local privilege-escalation risk on all Windows endpoints, particularly those exposed to phishing or multi-user interactive login.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism: CVE-2026-68820 is a use-after-free (CWE-416) in afd.sys, the Windows Ancillary Function Driver for WinSock. The CVSS v3 vector is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting local access, high attack complexity (race condition), low privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. At a high level, the exploit takes advantage of how afd.sys handles a socket when it is created and accessed concurrently by several threads at once, triggering a use-after-free condition. Successful exploitation yields SYSTEM-level code execution.

Confirmed attack chain (Operation Dream Job context — single-sourced to Check Point; verify before enforcement)

1. Initial access: Lazarus Group lures defence-sector job seekers via impersonation websites (at least three fake Enveil sites, some SEO-optimised to top search results) and fake Lockheed Martin job offers. Social engineering via Operation Dream Job.
2. Payload delivery: Victims are tricked into downloading a trojanised PDF viewer called SecurityPDF, designed to execute malicious payloads embedded within attacker-crafted PDF files when opened.
3. Backdoor execution: Opening the trojanised PDF executes a previously undocumented backdoor Check Point named Troy.
4. Privilege escalation: During the intrusion, the attacker exploits CVE-2026-68820 as a zero-day to escalate from the low-privilege foothold to SYSTEM. The exploit must be "thrown over and over until the timing lands" due to the race condition.
5. Rootkit deployment: With SYSTEM privileges, the attacker deploys a new version of FudModule, Lazarus' kernel-mode rootkit, to evade detection and maintain deep persistence.

Affected versions (from NVD CPE data)

• Windows 10 Version 1607 (32-bit, x64): < 10.0.14393.9418
• Windows 10 Version 1809 (32-bit, x64): < 10.0.17763.9115
• Windows 10 Version 21H2 (32-bit, ARM64, x64): < 10.0.19044.7663
• Windows 10 Version 22H2 (32-bit, ARM64, x64): < 10.0.19045.7663
• Windows 11 Version 23H2 (ARM64, x64): < 10.0.22631.7517
• Windows 11 Version 24H2 (ARM64, x64): < 10.0.26100.9168
• Windows 11 Version 25H2 (ARM64, x64): < 10.0.26200.9168

Attribution caveat: The Lazarus Group / Operation Dream Job attribution rests solely on Check Point's reporting as cited by The Register. No MITRE ATT&CK profile for the actor is present in the verified reference data; treat the attribution as unconfirmed. The CISA KEV catalogue entry confirms active exploitation but does not name a threat actor.

Discrepancy note: The SANS ISC report describes CVE-2026-68820 as "Important-severity" with CVSS 7.0, while the verified NVD reference data classifies it as HIGH severity at the same CVSS score. Both are consistent — NVD maps CVSS 7.0 to HIGH; Microsoft's severity rating uses a different label. The verified HIGH classification is authoritative for this advisory.

4. Mitigation & containment

P1 — Within 24 hours

• Apply the August 2026 Patch Tuesday update for CVE-2026-68820 on all affected Windows endpoints and servers. Target the fixed build numbers listed in §3. Prioritise systems that permit interactive local login, multi-user environments (RDS, VDI, jump hosts, developer workstations), and any endpoint with confirmed or suspected phishing exposure.
• If patching is not immediately feasible, restrict interactive local logon to low-privilege accounts on critical servers where feasible as a compensating control — the exploit requires local code execution with low privileges.
• Hunt for indicators of the Operation Dream Job delivery chain: look for the executable SecurityPDF on endpoints, and review web proxy logs for traffic to fake Enveil or Lockheed Martin recruitment domains.

P2 — Within 72 hours

• Complete patching across the full Windows estate, including all server cores, ARM64 builds, and legacy Windows 10 1607/1809 systems still in production.
• Review EDR telemetry for afd.sys race-condition exploitation patterns: multiple concurrent thread creation targeting socket operations from a single low-privilege process, followed by privilege escalation to SYSTEM.
• Check for FudModule rootkit artefacts: kernel-mode driver artefacts consistent with known FudModule IoCs from prior campaigns (CVE-2025-32709, CVE-2025-21418, CVE-2024-38193 also targeted this driver).
• Block known fake Enveil impersonation domains at web proxy/DNS gateway (specific domain names not provided in source material — obtain from Check Point's published blog).

P3 — Within 7 days

• Validate patch deployment via endpoint inventory reconciliation; confirm no systems remain below the fixed build numbers.
• Review user awareness controls for recruitment-themed social engineering, particularly for staff in defence-adjacent or technology roles.
• Assess whether the two related afd.sys EoP vulnerabilities patched this month (CVE-2026-61348, CVE-2026-70307, both CVSS 7.0, no known exploitation) are also patched — they share the same attack surface.

5. Indicators of compromise

The source material names specific malware and tooling but does not provide atomic indicators (hashes, IPs, domains, file paths beyond the executable name). The following are derived from the source narrative.

filename  SecurityPDF
malware  Troy
malware  FudModule
driver  afd.sys

Behavioural indicators

6. Detection

rule Trojan_SecurityPDF_Lazarus_DreamJob {
    meta:
        author = "Adverse Trace"
        date = "2026-08-11"
        reference = "https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483"
        description = "Detects trojanised PDF viewer SecurityPDF associated with Lazarus Operation Dream Job"
    strings:
        $name1 = "SecurityPDF" ascii nocase
        $name2 = "SecurityPDF.exe" ascii nocase
    condition:
        1 of them
}

title: Suspicious Privilege Escalation via afd.sys Race Condition
id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects a low-privilege process triggering a race condition in afd.sys followed by SYSTEM privilege acquisition, consistent with CVE-2026-68820 exploitation
references:

    - https://nvd.nist.gov/vuln/detail/CVE-2026-68820
    - https://isc.sans.edu/diary/rss/33236
author: Adverse Trace
date: 2026/08/11
tags:

    - attack.privilege_escalation
    - attack.t1068
logsource:
    product: windows
    category: process_creation
detection:
    selection_child:
        ParentImage|contains:

            - 'SecurityPDF'
    selection_system:
        IntegrityLevel:

            - 'System'
    condition: selection_child and selection_system
falsepositives:

    - Legitimate applications named SecurityPDF (unlikely)
level: high

title: Trojanised SecurityPDF Execution
id: 8b4d2e3f-9c5a-4f7b-ad6c-2e3f4a5b6c7d
status: experimental
description: Detects execution of trojanised PDF viewer SecurityPDF associated with Lazarus Operation Dream Job
references:

    - https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483
author: Adverse Trace
date: 2026/08/11
tags:

    - attack.execution
    - attack.t1204.002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|contains:

            - 'SecurityPDF'
    condition: selection
falsepositives:

    - Legitimate application with the same name (unlikely)
level: high

CVE assessment

1 referenced CVE

7. Sources

• NVD, CVE-2026-68820 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-68820, 2026-08-10
• GitHub Security Advisories, GHSA-v9vm-9353-cg37, https://github.com/advisories/GHSA-v9vm-9353-cg37, 2026-08
• SANS Internet Storm Center, Microsoft Patch Tuesday August 2026, https://isc.sans.edu/diary/rss/33236, 2026-08-11
• Tenable Research, Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs, https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820, 2026-08-11
• Krebs on Security, Microsoft Plugs Nearly 400 Security Holes, https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/, 2026-08-11
• The Register, 421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one, https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483, 2026-08-11
• ANSSI France CERT, Multiples vulnérabilités dans Microsoft Windows, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0869/, 2026-08

8. Adverse Trace position

CVE-2026-68820 is a HIGH-severity (CVSS 7.0) local privilege-escalation vulnerability in a core Windows kernel driver present on effectively every Windows endpoint. It is actively exploited in the wild per CISA KEV and Microsoft. The attack chain — phishing to low-privilege foothold to SYSTEM via race condition to kernel rootkit — is a credible threat pattern for EMEA financial services, particularly for firms with defence-sector exposure, large remote workforces, or multi-user interactive endpoints. The Lazarus Group attribution is single-sourced (Check Point via The Register) and unconfirmed by MITRE profiling in the verified reference data; clients should enforce on the vulnerability and the described behaviours, not on the attribution alone. Patching to the August 2026 Patch Tuesday builds is the primary remediation. Adverse Trace will monitor for release of Check Point's full technical blog with atomic IOCs and update this advisory if the IOC set expands or if additional exploitation campaigns are identified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.