Redmond addressed 421 bugs in its August Patch Tuesday release — and North Korea’s Lazarus Group reportedly weaponized one of them as a zero-day in early June.
CVE-2026-68820, afd.sys, and Lazarus' zero-day use
Microsoft patched CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), on the August 11 Patch Tuesday fix. According to Microsoft, “a locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition,” and successful exploitation could allow an attacker to execute code with SYSTEM-level privileges with no user interaction required. Check Point researchers Moshe Marelus and David Driker are credited with finding and reporting the flaw.
Check Point's threat intelligence director, Sergey Shykevich, told The Register his team “first observed attackers - namely North Korea’s Lazarus Group - battering this CVE at the beginning of June.” He added, “We are familiar with one successful implementation of the CVE - but we assume it was used widely in the campaign.” The company said it will not disclose full technical details because the bug has been patched, but described the exploit at a high level: it “takes advantage of how afd.sys handles a socket is created when it is accessed concurrently by several threads at once.”
During the intrusions, the actor deployed a new kernel-mode rootkit — a new version of FudModule — and used a previously unseen backdoor named Troy. Delivery in this campaign combined a modified PDF viewer called SecurityPDF, malicious PDFs crafted to execute payloads when opened, and impersonation websites that boosted credibility through search engine optimization (SEO).
Patch volume, AI-assisted trends, and the publicly known CVE
Microsoft’s August release fixed 421 vulnerabilities across its products — roughly 200 fewer CVEs than the previous month, a difference the reporting links to what it calls “the new norm with AI-assisted vulnerability disclosures and fixes.” Microsoft explicitly lists one other publicly known vulnerability in this cycle: CVE-2026-62832, an elevation-of-privilege flaw that the company says exploitation is “more likely.”
Per Microsoft’s advisory, “an authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive,” which could allow access or modification of another user’s data and the gain of administrator privileges. User interaction is not required for successful exploitation, so administrators and defenders are urged to prioritize the update.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleZero Day Initiative highlights: CVE-2026-62893 and CVE-2026-62911
Trend Micro’s Zero Day Initiative (ZDI) flagged five additional flaws it considers notable and exploitable. One of those, CVE-2026-62893, is a critical remote code execution issue in Windows Deployment Services’ TFTP server disclosed through ZDI’s program. ZDI’s Dustin Childs emphasized the risk of the TFTP service: “TFTP has no auth mechanism and is available remotely vid UDP port 69,” and advised that “UDP port 69 should be blocked at your perimeter,” while urging quick testing and deployment of the patch for organizations that use WDS.
Another ZDI-highlighted issue, CVE-2026-62911 — one of this month’s Exchange vulnerabilities — was demonstrated at ZDI's Pwn2Own in Berlin. Microsoft characterized it as a privilege escalation via an authentication bypass and oddly judged “exploitation less likely.” Dustin Childs disputed that assessment: “Ignore Microsoft’s exploitability and Exploit Code Maturity ratings,” he wrote. “We handed them working exploits, so this is a real threat.”
What this means for technologists, defense-sector targets, and enterprise admins
- Technologists and security teams: Prioritize patches for CVE-2026-68820 and CVE-2026-62832, and review detection and endpoint controls for kernel-mode rootkits like FudModule and the new backdoor Troy. Expect attackers to combine zero-days with social engineering and SEO-boosted impersonation sites.
- Defense-sector organizations and job seekers: Lazarus’ Operation Dream Job specifically targeted defense-sector entities in Europe and India using fake job offers that impersonated Lockheed Martin and Enveil. Be alert to trojanized applications distributed via bogus recruitment sites and top-ranked search results.
- Enterprise administrators and procurement leaders: If you use Windows Deployment Services, treat CVE-2026-62893 as high priority and consider blocking UDP port 69 at your perimeter as ZDI recommended; deploy Exchange and WDS patches swiftly where applicable.
Conclusion: social engineering, SEO and zero-days in the same campaign
The August fixes close a window on a campaign that married traditional social engineering — fake job offers and trojanized PDF viewers — with an exploited Windows zero-day that elevated privilege to SYSTEM. Check Point notes that the actor “continues to develop new tools (like Troy), and [to be] finding and implementing new vulnerabilities in Windows to evade detection.” Microsoft shipped the patch for CVE-2026-68820 on Aug. 11; defenders and administrators now face the familiar work of testing and deploying those fixes while tracing the campaign’s prior intrusions and potential follow-on activity.
