Microsoft's August 2026 Patch Tuesday release covers 421 CVEs, and one of them — CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) — was already exploited as a zero-day by North Korea's Lazarus Group before the fix shipped. The group paired the bug with a new build of its FudModule kernel rootkit and a never-before-seen backdoor named Troy during the latest wave of its Dream Job job-scam campaign against defense-sector targets in Europe and India. Also in this cycle: the publicly known privilege-escalation flaw CVE-2026-62832, plus two ZDI-reported issues researchers say deserve faster patching than Microsoft's exploitability ratings imply.

A heavy but not record-setting patch cycle

Microsoft patched 421 vulnerabilities across its own product line this month — roughly 200 fewer CVEs than the previous cycle, which closed out at a record 622. The company expects counts in this range to become the norm as AI-assisted vulnerability discovery and remediation continue to surface and fix more flaws per release cycle.

CVE-2026-68820: a kernel zero-day in afd.sys

The headline item is CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock. Per Microsoft's advisory, a locally authenticated attacker can run a specially crafted application on an affected system to trigger a race condition, and successful exploitation could let the attacker execute code with SYSTEM-level privileges — with no user interaction required. The NVD entry characterizes it as a use-after-free that lets an authorized attacker elevate privileges locally, while third-party tracking via the VulnRadar-Demo alert lists a CVSS base score of 7.0 and a CISA Known Exploited Vulnerabilities (KEV) listing.

Check Point researchers Moshe Marelus and David Driker are credited with finding and reporting the flaw. Check Point's threat-intel team first observed attackers abusing it at the start of June, at the opening of the current Dream Job wave, and the vulnerability was patched on the August 11 Patch Tuesday release. Check Point is withholding full technical detail on the bug, but notes at a high level that the exploit takes advantage of how afd.sys handles a socket that is created and then accessed concurrently by several threads at once — a classic race window in a kernel driver.

Sergey Shykevich, Check Point's director of threat intelligence, said analysts are aware of one confirmed successful implementation of the CVE and assume it was used more widely across the campaign.

Operation Dream Job: fake offers, fake Enveil sites, and a new backdoor

Lazarus is an umbrella label for Pyongyang's government-backed hacking teams, active since at least 2009 and known for cryptocurrency theft, extortion attacks, and IT-worker scams — most infamously the 2014 Sony Pictures Entertainment intrusion and the 2017 WannaCry ransomware outbreak. Its Dream Job campaigns date to 2020 and rely on social engineering: dangling fake offers for high-profile positions to lure job seekers into clicking malicious links or opening malware-laced documents. The goals span stealing intellectual property and other sensitive data, running cyber-espionage missions, and collecting financial information.

This new wave focuses on the defense sector in Europe and India, with fictitious roles impersonating Lockheed Martin and privacy-tech firm Enveil. Attackers built at least three fake Enveil sites, some of which ranked as the top search result to make the phishing more convincing. Check Point says the campaign expanded its delivery methods by combining impersonation websites with search engine optimization to distribute trojanized applications, boosting credibility and evading some phishing-oriented detections.

The attackers distribute a modified PDF viewer named SecurityPDF that is designed to execute malicious payloads embedded within attacker-crafted PDF files when the user opens them. Those PDFs drop a previously unseen backdoor that Check Point named Troy. During the intrusions, the group exploited CVE-2026-68820 as a zero-day to deploy a new version of FudModule, Lazarus's kernel-mode rootkit. Shykevich characterized the campaign as evidence that the actor keeps developing new tools like Troy while continuing to find and weaponize fresh Windows vulnerabilities to stay ahead of detection.

The rest of the notable August list

Microsoft flags only CVE-2026-68820 and CVE-2026-62832 as "notable" for this cycle. CVE-2026-62832 is an elevation-of-privilege flaw that is publicly known and rated "exploitation more likely." Per the advisory, an authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive; success could let the attacker access or modify another user's data and gain administrator privileges, with no user interaction required.

Trend Micro's Zero Day Initiative separately calls out five additional CVEs worth attention, two of which it has direct knowledge of:

  • CVE-2026-62893 — a critical remote code execution flaw in the Windows Deployment Services (WDS) TFTP Server that requires no authentication and no user interaction. It was disclosed through ZDI's bug-reporting program. ZDI's Dustin Childs noted that TFTP has no auth mechanism and is reachable remotely over UDP port 69; he urged blocking UDP 69 at the perimeter and warned the service could easily be used by attackers for lateral movement within an enterprise, recommending quick testing and deployment of the fix for anyone using WDS for deployments.
  • CVE-2026-62911 — one of this cycle's many Exchange bugs, demonstrated at ZDI's Pwn2Own contest in Berlin. It enables privilege escalation via an authentication bypass, and exploitation could let an attacker take over the mailboxes of all Exchange users — sending emails, reading emails, and downloading attachments. Microsoft rated exploitation "less likely," a call ZDI rejects, noting that working exploits were handed over and that the issue should be treated as a real threat, advising readers to ignore Microsoft's exploitability and Exploit Code Maturity ratings.

Technical background

Use-after-free bugs arise when a program keeps a pointer to a memory region after that region has been freed and later dereferences it. Combined with a race condition — multiple threads touching the same object without proper synchronization — an attacker can win the race and influence what occupies the freed memory before the vulnerable code uses it. In a kernel driver such as afd.sys, a stale pointer can be made to reference attacker-controlled data, turning a flaky race into code execution at elevated privilege. The generic pattern looks like this (illustrative only, not the CVE-2026-68820 exploit):


/* Generic check-then-use race — illustrative only */
if (is_valid(sock)) {          /* thread A: check passes */
    /* race window: thread B frees sock here */
    use_after_teardown(sock);  /* thread A: dereferences freed object */
}

Standard hardening against this class of bug includes reference counting (freeing objects only when no references remain), serializing access with locks, and validating pointers before dereference. For defenders, patching is the primary control, since the August 11 update resolves CVE-2026-68820.

For the WDS TFTP flaw, the practical mitigations are network-level. Because TFTP over UDP 69 carries no authentication, admins should confirm whether the service is actually needed and block the port where it is not:


# Confirm whether anything is listening on UDP 69 (TFTP)
Get-NetUDPEndpoint -LocalPort 69

# Check the Windows Deployment Services server service
Get-Service WDSServer

# Block inbound UDP 69 at the host level
New-NetFirewallRule -DisplayName "Block TFTP (UDP 69)" -Direction Inbound -Protocol UDP -LocalPort 69 -Action Block

Advisory and research links