Windows AFD.sys Zero-Day CVE-2026-68820 Exploited by Lazarus to Deploy Kernel Rootkit
Windows AFD.sys Zero-Day CVE-2026-68820 Exploited by Lazarus to Deploy Kernel Rootkit
August 12, 2026 — Cybersecurity News
A newly disclosed Windows zero-day is attracting immediate attention from security researchers after being actively exploited by the North Korean-linked Lazarus threat group.
The vulnerability, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock (AFD.sys), a kernel-mode component responsible for low-level networking functionality.
According to Check Point Research, Lazarus exploited the vulnerability during a campaign targeting organizations in the defense sector. The attack ultimately allowed the threat actor to deploy an updated version of the FudModule kernel-mode rootkit. Microsoft addressed the vulnerability in the August 2026 Patch Tuesday updates.
Why AFD.sys Is Important
AFD.sys sits deep inside the Windows networking stack.
A simplified architecture looks like this:
Application
|
v
Windows Sockets / Winsock
|
v
AFD.sys
|
v
Windows Kernel
|
v
Network Interface
Because AFD.sys operates in kernel mode, a vulnerability in this component can have significantly greater consequences than a typical application-level bug.
CVE-2026-68820 is classified as an elevation-of-privilege vulnerability. The important issue is therefore not simply gaining execution, but turning an existing foothold into kernel-level control.
From Initial Access to Kernel Compromise
The attack chain described by Check Point demonstrates a familiar pattern in sophisticated intrusions:
Initial Access
|
v
Malicious Application
|
v
CVE-2026-68820
|
v
Kernel Privileges
|
v
FudModule Rootkit
|
v
Persistent / Stealthy Access
This distinction is important.
A vulnerability that provides local privilege escalation may not be sufficient to compromise a machine by itself. However, once attackers already have code execution, an LPE vulnerability can become the bridge from user-level malware to the Windows kernel.
Netbe has previously covered this broader class of Windows vulnerabilities in its analysis of Win32k kernel vulnerabilities and other privilege-escalation techniques.
Lazarus and Operation Dream Job
Check Point Research linked the exploitation to a new phase of Operation Dream Job, a campaign associated with Lazarus.
The campaign has targeted organizations internationally, with a particular focus on the defense sector.
Researchers observed malicious PDF-viewer applications being distributed to victims. In one attack chain, a modified PDF viewer was used to execute malware while presenting the victim with a legitimate-looking document.
This is a classic example of how social engineering and technical exploitation can work together:
Social Engineering
|
v
Malicious Application
|
v
Code Execution
|
v
Windows Kernel Exploit
|
v
Rootkit
The vulnerability is therefore only one part of the complete attack chain.
FudModule: Why the Rootkit Matters
The attackers used an updated version of FudModule, a kernel-mode rootkit associated with Lazarus.
Kernel rootkits are particularly concerning because they operate at a very privileged level of the operating system.
Conceptually:
User Mode
----------------
Applications
Malware
----------------
|
v
Kernel Mode
----------------
Windows Kernel
FudModule
Drivers
----------------
A successful kernel-level compromise can make detection significantly more difficult.
The attacker is no longer operating exclusively inside an ordinary user process.
Why Kernel-Level Malware Is Dangerous
Security monitoring normally observes processes, files, registry activity, network connections and other operating-system events.
A kernel-mode rootkit attempts to operate much closer to the underlying operating system.
The objective can include:
- hiding malicious activity,
- manipulating operating-system behavior,
- interfering with security controls,
- maintaining privileged access,
- making forensic analysis more difficult.
This is why kernel exploitation remains one of the most valuable techniques in advanced intrusion campaigns.
AFD.sys Has Been a Recurring Security Target
CVE-2026-68820 is not the first AFD.sys vulnerability disclosed this year.
The Windows Ancillary Function Driver for WinSock has received multiple security fixes during 2026, including vulnerabilities involving use-after-free conditions, race conditions and other memory-management problems.
This makes AFD.sys an interesting example of how a relatively small kernel component can represent a significant attack surface.
Security researchers have already documented multiple AFD.sys privilege-escalation vulnerabilities during 2026.
The Difference Between RCE and LPE
CVE-2026-68820 is particularly interesting because it highlights the importance of Local Privilege Escalation (LPE).
Remote Code Execution:
Remote Attacker
|
v
Target
|
v
Code Execution
Local Privilege Escalation:
Existing Foothold
|
v
LPE Vulnerability
|
v
SYSTEM / Kernel
Attackers frequently chain these techniques.
The first vulnerability provides access.
The second vulnerability increases privileges.
The third component may establish persistence.
Initial Access
+
Privilege Escalation
+
Persistence
=
Major Compromise
Microsoft Patch Tuesday: Why It Matters
Microsoft released its August 2026 security updates on August 11.
The monthly update addresses hundreds of vulnerabilities across Microsoft products, including Windows. Multiple sources report more than 400 vulnerabilities addressed during this Patch Tuesday, with several zero-days among them.
Microsoft’s own Windows release information recommends installing the August 2026 security update promptly on supported Windows versions.
For organizations, the message is straightforward:
CVE-2026-68820 should not be treated as an ordinary future patching task.
It was exploited in the wild before the fix became available.
What Administrators Should Do
The first step is to verify that Windows systems have received the August 2026 security updates.
A practical workflow:
Inventory
|
v
Identify Windows Versions
|
v
Verify August 2026 Updates
|
v
Patch
|
v
Restart if Required
|
v
Verify Build / Update Status
Netbe’s article Najnowsze luki w Windows 11 – co naprawiają aktualizacje bezpieczeństwa provides additional context on Windows vulnerability management and security updates.
Check for Vulnerable Systems
Organizations should not rely only on Windows Update notifications.
A proper vulnerability-management process should include:
Windows Inventory
|
v
Patch Inventory
|
v
Vulnerability Assessment
|
v
Risk Prioritization
|
v
Remediation
Netbe’s Wykrywanie Dziur w Systemie Windows covers vulnerability scanning, Windows configuration analysis and security assessment techniques.
Defender Is Still Important
A patched operating system is essential, but endpoint protection remains another important layer.
Microsoft Defender can detect suspicious files, processes and behavioral patterns.
Netbe’s Microsoft Defender w Windows 11 – ochrona w czasie rzeczywistym explains how real-time and behavioral protection work in Windows 11.
However:
Defender
≠
Patch Management
The two mechanisms solve different problems.
Why This Attack Is Particularly Interesting
The combination of:
Social engineering
Malicious application
Kernel vulnerability
Privilege escalation
Rootkit
creates a highly effective attack chain.
The important lesson is that modern attacks rarely depend on a single vulnerability.
Instead, attackers combine several weaknesses:
Human Trust
+
Initial Execution
+
Kernel Exploit
+
Rootkit
=
Advanced Intrusion
The Bigger Security Lesson
CVE-2026-68820 is another reminder that the Windows kernel remains one of the most valuable targets for attackers.
A vulnerability in a networking component such as AFD.sys may initially sound like a relatively narrow technical issue.
But the real risk comes from its position inside the operating system:
Network Applications
|
v
Winsock
|
v
AFD.sys
|
v
Windows Kernel
Once attackers cross the user/kernel boundary, the security situation changes dramatically.
Conclusion
The exploitation of CVE-2026-68820 by Lazarus demonstrates how a Windows kernel vulnerability can become a critical component of a sophisticated intrusion.
Microsoft has already released the corresponding security update, so the immediate defensive priority is clear:
Patch supported Windows systems with the August 2026 security updates and verify that critical endpoints and servers are actually protected.
For enterprise environments, patching should be combined with:
- vulnerability scanning,
- EDR monitoring,
- application control,
- least privilege,
- driver and kernel protection,
- incident-response readiness.
The most important lesson is simple:
A Windows vulnerability does not need to provide remote access to become dangerous. A local kernel privilege-escalation flaw can be the missing step between ordinary malware and complete system compromise.
Related articles on Netbe
- Najnowsze luki w Windows 11 – co naprawiają aktualizacje bezpieczeństwa (2026)
- Wykrywanie Dziur w Systemie Windows
- Microsoft Defender w Windows 11 – ochrona w czasie rzeczywistym
- Wbudowane zabezpieczenia Windows 11 – jak działa Microsoft Defender
- Remote Code Execution (RCE) w Windows 11
- Exploity i Zero-Day Vulnerabilities
AI Is Finding Real Security Vulnerabilities in Open Source Software Artificial intelligence is becoming increasingly useful in software security — Czytaj dalej
Five Eyes Warn That Frontier AI Could Reshape Cyber Threats Within Months Cybersecurity agencies from the Five Eyes alliance are Czytaj dalej
