Windows Zero-Day Under Active Attack: CVE-2026-68820 Exploited to Deploy a Kernel Rootkit
A newly patched Windows zero-day is a reminder that not every dangerous vulnerability needs to allow remote code execution.
The flaw, tracked as CVE-2026-68820, affects AFD.sys, the Windows Ancillary Function Driver for WinSock. The vulnerability is a use-after-free issue that allows an attacker with an existing foothold on a vulnerable Windows machine to escalate privileges to SYSTEM.
On paper, the vulnerability has a CVSS score of 7.0. It requires local access, low privileges and a successful exploitation of a race condition.
In reality, the vulnerability was already being actively exploited.
Security researchers linked the attacks to the Lazarus Group, a North Korean state-sponsored threat actor, which reportedly used the zero-day as part of its long-running Operation Dream Job campaign. The objective was not simply privilege escalation.
The attackers used SYSTEM-level access to deploy an updated version of the FudModule kernel rootkit.
That changes the severity of the incident significantly.
What Is CVE-2026-68820?
CVE-2026-68820 is a use-after-free vulnerability in AFD.sys, a core Windows kernel driver responsible for supporting Windows socket operations.
AFD.sys is not an optional component installed by a small number of users. It is part of the Windows networking infrastructure and supports the Windows Sockets API.
The vulnerability allows a locally authenticated attacker with limited privileges to potentially escalate those privileges to SYSTEM.
SYSTEM is one of the most powerful security contexts available in Windows.
Once an attacker reaches that level, the compromise can move far beyond the permissions of the initially infected user.
Potential consequences include:
- executing code with SYSTEM privileges,
- accessing sensitive processes and protected resources,
- deploying kernel-level malware,
- interfering with security software,
- establishing persistence,
- stealing credentials,
- preparing the system for further lateral movement.
This is why local privilege escalation vulnerabilities are often much more dangerous than their CVSS score initially suggests.
The vulnerability itself may not provide the initial entry point.
Instead, it can become the second stage of a much larger attack.
Lazarus Used the Zero-Day as Part of a Larger Attack Chain
The reported exploitation of CVE-2026-68820 was connected to the Lazarus Group and its long-running Operation Dream Job campaign.
Operation Dream Job is known for targeting individuals through fake job offers, recruitment messages and employment-related lures.
Rather than immediately attacking Windows through the vulnerability, attackers first need to establish a foothold on the target system.
Once malicious code is running with limited privileges, a local privilege escalation vulnerability such as CVE-2026-68820 becomes extremely valuable.
The attack chain can look roughly like this:
- A target receives a fake job offer or malicious recruitment-related file.
- The victim executes the malicious content.
- Malware gains an initial foothold with normal user privileges.
- The attackers deploy the exploit targeting
AFD.sys. - The exploit attempts to elevate privileges to SYSTEM.
- A kernel-level payload is deployed.
- The attackers gain deeper control over the compromised machine.
This is an important distinction.
CVE-2026-68820 is not a vulnerability that allows an attacker to simply scan the internet and remotely compromise every unpatched Windows computer.
However, once attackers already have access to a system, the vulnerability can help transform a limited compromise into a complete system takeover.
The Real Objective: Deploying the FudModule Rootkit
Privilege escalation was only one part of the attack.
The more serious objective was the deployment of an updated version of FudModule, a kernel-mode rootkit associated with Lazarus.
Kernel-level malware operates at a much deeper level than ordinary user-mode malware.
Security products such as antivirus and Endpoint Detection and Response platforms operate within the operating system and depend on the integrity of the environment they are monitoring.
A malicious component running in the Windows kernel can potentially interfere with that visibility.
This can make detection significantly more difficult.
A kernel rootkit may potentially be used to:
- hide malicious activity,
- interfere with security software,
- manipulate operating system behavior,
- maintain persistence,
- bypass or weaken security controls.
The use of CVE-2026-68820 to deploy FudModule demonstrates why attackers continue investing resources into Windows privilege escalation vulnerabilities.
The initial infection may only provide limited access.
A successful kernel exploit can give attackers a much stronger position inside the compromised system.
AFD.sys Is Becoming a Repeated Target
One of the most interesting aspects of this incident is that Lazarus has repeatedly targeted the same Windows component.
AFD.sys has appeared in multiple Windows zero-day cases in recent years.
That suggests attackers are not randomly discovering vulnerabilities across the entire Windows codebase.
Instead, certain threat actors may be investing long-term research into components that have repeatedly proven useful for privilege escalation.
For an attacker, a kernel driver with a large attack surface and widespread deployment is an attractive target.
For defenders, this creates an important lesson.
A vulnerability may be patched, but the underlying component remains.
Attackers can continue researching the same driver and search for a completely new vulnerability.
The result can become a cycle:
vulnerability discovered → zero-day exploited → patch released → attackers return to the same component → another vulnerability is discovered.
The fact that AFD.sys continues to appear in high-profile Windows exploitation campaigns makes this pattern particularly concerning.
Why a CVSS Score of 7.0 Can Be Misleading
Security teams often use CVSS scores to prioritize vulnerabilities.
That approach is useful, but it has limitations.
CVE-2026-68820 has a score of 7.0 because exploitation requires local access and involves a technically complex race condition.
However, attackers rarely operate according to CVSS scores.
A vulnerability does not need to be remotely exploitable to become extremely valuable.
Consider an attacker who has already compromised an employee’s computer through:
- phishing,
- a malicious attachment,
- a fake job offer,
- a trojanized application,
- stolen credentials,
- another software vulnerability.
At that point, the attacker may only have access to a standard user account.
That is where a local privilege escalation vulnerability becomes extremely important.
CVE-2026-68820 can potentially provide the next step.
From a normal user account to SYSTEM.
From limited malware execution to a kernel-level compromise.
From an initial foothold to a much more difficult-to-detect attack.
This is why actively exploited vulnerabilities should not be prioritized solely according to their numerical CVSS score.
The exploitation context matters.
From Fake Recruitment Offers to SYSTEM Privileges
Operation Dream Job demonstrates how modern cyberattacks combine technical vulnerabilities with social engineering.
The exploit itself may be highly sophisticated, but attackers do not necessarily begin with sophisticated exploitation.
Sometimes the first step is simply convincing someone to open a file.
A fake recruiter contacts a potential target.
The target receives what appears to be a legitimate job opportunity.
The attachment or application appears harmless.
Malware gains initial execution.
Only then does the attacker use a zero-day to escalate privileges.
This combination is dangerous because the victim may never realize that the initial interaction was the beginning of a multi-stage attack.
The final compromise can involve:
- social engineering,
- malware,
- in-memory execution,
- privilege escalation,
- kernel-level rootkits,
- credential theft,
- command-and-control infrastructure.
Each individual stage increases the difficulty of detection.
Why Kernel-Level Malware Is a Serious Problem
The Windows kernel is the core of the operating system.
Applications normally operate in user mode, where Windows applies restrictions and isolation mechanisms.
Kernel-mode components have much deeper access.
Legitimate drivers need this access because they interact directly with hardware and critical operating system functions.
Unfortunately, if attackers can successfully execute malicious code in the kernel, they may gain similar levels of control.
This is why vulnerabilities affecting kernel components are attractive to advanced persistent threat groups.
A successful privilege escalation exploit can become a bridge between ordinary malware and a much more powerful rootkit.
The attacker no longer needs to operate only inside the limitations of the compromised user account.
The attack can move much deeper into the operating system.
Microsoft Has Released a Patch
Microsoft addressed CVE-2026-68820 in the August 2026 security updates.
Organizations using supported versions of Windows should ensure that the latest security updates have been deployed.
This is especially important because the vulnerability was already being exploited before the patch became available.
The affected environment may include systems running:
- Windows 10,
- Windows 11,
- Windows Server.
Administrators should not assume that a local privilege escalation vulnerability is irrelevant simply because their systems are not directly exposed to the internet.
The vulnerability becomes relevant as soon as an attacker gains any form of local code execution.
That could happen through phishing, malware, malicious software or another compromised application.
What Organizations Should Do
The most important action is straightforward.
1. Install the latest Windows security updates
Organizations should prioritize deployment of the Microsoft security updates that address CVE-2026-68820.
This should include workstations as well as Windows servers.
2. Review systems for signs of compromise
Patching removes the known vulnerability, but it does not automatically remove malware that may already be present.
Security teams should investigate suspicious activity that occurred before patch deployment.
3. Monitor unusual privilege escalation
Unexpected processes gaining SYSTEM privileges should be investigated.
Particular attention should be paid to unusual child processes, suspicious DLL loading and abnormal driver activity.
4. Protect against the initial infection vector
The zero-day was part of a larger attack chain.
Organizations should continue improving protection against phishing, malicious attachments and social engineering.
Technical patching alone does not eliminate the risk of the first-stage compromise.
5. Review EDR and endpoint telemetry
Because the reported campaign involved kernel-level malware, organizations should verify that endpoint security products are functioning correctly.
Unexpected gaps in telemetry can be as important as an obvious malware alert.
The Bigger Lesson for Windows Security
CVE-2026-68820 demonstrates an important reality of modern cyberattacks.
Attackers do not need a single vulnerability that does everything.
They can combine multiple weaknesses.
A phishing email provides initial access.
A malware loader establishes persistence.
A privilege escalation vulnerability provides SYSTEM access.
A kernel rootkit reduces security visibility.
Stolen credentials provide access to additional systems.
This approach makes individual vulnerabilities difficult to evaluate in isolation.
A local privilege escalation vulnerability might appear less dangerous than a critical remote code execution flaw.
But in the hands of an advanced threat actor, it can become one of the most important parts of an attack chain.
The Lazarus campaign is also a reminder that attackers continue investing heavily in Windows kernel research.
Even after previous vulnerabilities in the same component have been patched, the component itself remains an attractive target for further vulnerability research.
Conclusion
CVE-2026-68820 is not just another Windows security update.
The vulnerability was actively exploited as a zero-day and reportedly used by Lazarus to escalate privileges and deploy the FudModule kernel rootkit.
The attack demonstrates how a vulnerability with a CVSS score of 7.0 can still play a critical role in a sophisticated cyberattack.
The exploit does not provide attackers with an initial entry point.
Instead, it helps them turn an existing foothold into SYSTEM-level access.
That is often exactly what an advanced attacker needs.
The case also highlights a broader problem for Windows security: kernel components remain valuable targets, and attackers can repeatedly return to the same attack surface in search of new vulnerabilities.
For organizations, the message is clear.
Patch Windows systems, investigate suspicious activity that occurred before the update, and remember that a local vulnerability can become a critical component of a much larger attack.
In modern cyberattacks, the most dangerous exploit is not always the one that gets attackers into the system.
Sometimes it is the exploit that gives them complete control after they are already inside.
AI Agents Went Beyond Their Instructions During Security Tests — A New Warning for the AI Industry Artificial intelligence security Czytaj dalej
ChainDrop: How a Self-Propagating npm Worm Compromised More Than 400 Packages Software supply-chain attacks are becoming one of the most Czytaj dalej
