August 2026 Patch Tuesday: Lazarus Group Exploited WinSock Zero-Day to Deploy Kernel Rootkit

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Infrastructure, cloud security, and DevSecOps for US and EU products

The short answer

CVE-2026-68820: the actively exploited WinSock zero-day

CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the Ancillary Function Driver for WinSock — the kernel-mode component that underpins the Windows Sockets API on every Windows installation. A locally authenticated attacker can trigger a race condition inside the driver to escalate privileges to SYSTEM. The flaw carries a CVSS v3 score of 7.0 and is rated Important, but severity ratings become secondary when a zero-day has already been weaponized in active nation-state campaigns.

Check Point Research attributed the in-the-wild exploitation to North Korea's Lazarus Group, who used CVE-2026-68820 in their ongoing Operation Dream Job campaign — a long-running social engineering and supply-chain attack series targeting software developers and financial institutions. Researchers at Check Point first observed exploitation as early as June 2026, meaning this flaw was silently weaponized for roughly six weeks before disclosure today.

The attack requires existing code execution on the target — typically obtained through phishing or a separate initial-access exploit — and then leverages the race condition in afd.sys to reach SYSTEM-level privileges and deploy the next-stage payload.

FudModule and Operation Dream Job

Once Lazarus achieved SYSTEM privileges via CVE-2026-68820, the group deployed a new version of FudModule — their kernel-mode rootkit that has evolved significantly since it was first documented in 2022. A kernel rootkit operating at SYSTEM level can blind or disable security software, including endpoint detection and response (EDR) agents, antivirus engines, and Windows Defender. Hosts infected with FudModule may appear clean to standard monitoring tools while remaining fully under attacker control.

For enterprise teams building software on Windows infrastructure — development workstations, CI/CD build agents, Windows Server-based staging environments — the combination of a local privilege escalation zero-day and a kernel rootkit represents a particularly severe threat to the integrity of the software supply chain. Compromised build systems can inject malicious code into software artifacts downstream, affecting every customer or service that consumes them.

Teams with cloud and DevOps operations running Windows-based agents in Azure DevOps Pipelines or GitHub Actions self-hosted on Windows should treat CVE-2026-68820 as a critical infrastructure risk, not just an endpoint hygiene item.

Three unauthenticated CVSS 9.8 flaws

Beyond the actively exploited zero-day, August 2026 Patch Tuesday includes three additional critical vulnerabilities requiring no authentication and carrying CVSS scores of 9.8 — the practical maximum for a network-exploitable flaw. None of these have been reported as exploited in the wild yet, but their attack complexity is low and the patches available now:

• CVE-2026-62878 — Windows DNS Server (CVSS 9.8): A stack-based buffer overflow in the DNS Server service, exploitable without authentication over the network. Organizations running Windows Server as an authoritative or recursive DNS resolver are exposed. DNS servers are typically reachable from broad network segments, making this high-priority.
• CVE-2026-62893 — Windows Deployment Services (CVSS 9.8): A flaw in the TFTP handling component of WDS, exploitable without authentication. Organizations using WDS for OS deployment at scale — common in enterprise data centers — should patch or take WDS offline until patched.
• CVE-2026-62815 — Microsoft QUIC Implementation (CVSS 9.8): A vulnerability in Microsoft's QUIC (HTTP/3) transport library, exploitable without authentication. This library is used across multiple Microsoft services and .NET applications. .NET-based applications built with the MsQuic library may require a dependency update in addition to the OS patch.

The three CVSS 9.8 flaws are not yet under exploitation, but history shows that unauthenticated network-exploitable flaws at this severity level attract proof-of-concept code within days of Patch Tuesday disclosure. The exploitation window is short; patch velocity matters.

SharePoint RCE chain is now complete

July 2026 Patch Tuesday introduced CVE-2026-55040, a critical authentication bypass in SharePoint Server (CVSS 9.1). At the time, it was assessed as a serious flaw requiring chaining with a second vulnerability to achieve remote code execution. August 2026 Patch Tuesday delivers that second link: CVE-2026-63520, a SharePoint RCE component that, when combined with the July auth bypass, creates a fully exploitable chain for unauthenticated remote code execution against on-premises SharePoint Server.

Organizations that patched July's CVE-2026-55040 are partially protected but must still apply August's patch to close the complete chain. Organizations that have not yet patched either vulnerability have an open unauthenticated RCE path against their SharePoint deployment today.

What it means for US & EU dev teams

Windows developer workstations are a direct target surface for CVE-2026-68820. Lazarus Group's Operation Dream Job has historically targeted software engineers with job-offer-themed spear phishing, followed by malware delivered through fake interview assignments or trojanized code repositories. A developer who opens a malicious file gives the attacker initial access; CVE-2026-68820 then converts that access into SYSTEM-level persistence. Development machines typically hold source code, credentials, cloud API tokens, and access to internal systems — exactly the high-value targets Lazarus Group pursues.

Azure cloud workloads need patch assessment today. The August update addresses multiple critical flaws across Azure SQL, Azure Kubernetes Service, Azure Logic Apps, and Exchange Server. Teams running Microsoft-managed Azure services will receive patches automatically, but self-managed Windows VMs, Azure Arc-connected servers, and on-premises Exchange deployments require manual update cycles. Verify your Azure patch posture against the Microsoft Security Response Center advisory before end of day.

Regulated industries face compliance obligations. For FinTech teams operating under DORA or SOC 2, and for HealthTech teams under HIPAA, an actively exploited zero-day in a core Windows component represents a material vulnerability that belongs in the risk register with a documented remediation timeline. DORA Article 9 requires financial entities to maintain ICT security resilience — an unpatched kernel privilege escalation exploited by a nation-state actor is not consistent with that posture. Document patch deployment dates and any compensating controls applied in the interim.

Build and CI infrastructure deserves elevated urgency. Compromising a build agent gives an attacker the ability to tamper with software artifacts, inject malicious dependencies, or exfiltrate signing keys. The integrity of every software release built on an unpatched Windows CI agent is uncertain until the machine is patched and audited. If your organization cannot patch immediately, consider isolating Windows-based build agents from developer workstations and limiting their network access while patching is underway.

What to do now

If your organization runs a formal vulnerability management program, register CVE-2026-68820 as a critical finding with a 24-hour patch SLA and the three CVSS 9.8 flaws with a 72-hour SLA. The SharePoint chain warrants a 48-hour SLA given the availability of both exploit components as of today.

FAQ