A Windows Socket Driver Bug Handed Lazarus SYSTEM Access

The bug that matters in Microsoft's August bundle is not the biggest number in it. It is CVE-2026-68820, a use-after-free in afd.sys, the kernel-mode Ancillary Function Driver that sits underneath the Windows Sockets API. A locally authenticated attacker runs a crafted program, wins a race condition inside the driver, and gets SYSTEM. Check Point Research attributes in-the-wild use of it to Lazarus, inside the long-running Operation Dream Job campaign, and CISA added it to the Known Exploited Vulnerabilities catalog on August 11.

Its CVSS score is 7.0. That is the part most dashboards will get wrong this week.

RelatedCISA Flags TeamCity RCE: An XStream Allowlist Left Open

Why does afd.sys keep showing up?

Every Windows machine that opens a network socket goes through afd.sys. It is the kernel side of Winsock: user-mode code calls into it constantly, from any process, at any integrity level, without needing a single special privilege. That combination is what makes it such durable attacker real estate. You do not need to reach it through some exotic feature that a hardened build might have disabled. It is always loaded, and it is always reachable from the low-privilege code an attacker already controls after phishing their way onto a box.

This is the fourth afd.sys zero-day caught in active exploitation since 2022. That is not coincidence, and it is not sloppiness in one team. It is what happens when a large, old, performance-sensitive driver with a huge attack surface sits on the boundary between untrusted user code and ring 0.

What does the race condition actually buy an attacker?

Microsoft's advisory describes it plainly: a locally authenticated attacker runs a specially crafted application to trigger a race condition, and successful exploitation grants SYSTEM. The mechanics behind that sentence are the familiar shape of a kernel use-after-free. Two threads touch the same driver object. One frees it. The other still holds a reference and keeps using it. If the attacker can get their own controlled data allocated into the memory the freed object used to occupy, the driver then operates on attacker-shaped data while running in kernel context.

Race conditions have a reputation for being finicky, and plenty of them are. This one is evidently not, because a state-sponsored group put it into an active campaign rather than filing it away as a research curiosity. Treat "requires a race" as a description of the technique, not as a mitigating factor.

Why a 7.0 is worse than the 9s next to it

CVSS rewards remote, unauthenticated, no-interaction bugs. A local privilege escalation loses points for needing local access, which is exactly why scores mislead here. Real intrusions are two-stage. The attacker gets code execution as a user through a phish, a malicious npm package, or a stolen session, and then needs to climb. CVE-2026-68820 is the second half of that pair, the reliable rung that turns a nuisance foothold into domain-wide trouble.

The scoring gap is why we track exploitation status rather than severity alone on the CVE watchlist. A 9.8 in a product you do not run is noise. A 7.0 in a driver on every Windows machine you own, with confirmed nation-state use, is this week's work.

1. Aug 2024CVE-2024-38193 exploited in the wild afd.sys, privilege escalation
2. Feb 2025CVE-2025-21418 exploited in the wild afd.sys again, same escalation goal
3. May 2025CVE-2025-32709 exploited in the wild Third afd.sys zero-day in under a year
4. Aug 11, 2026CVE-2026-68820 added to CISA KEV Use-after-free, tied to Lazarus
5. Sep 2, 2026Typical KEV remediation deadline for federal agencies Three weeks from catalog entry

What else shipped this month?

The headline count depends on who is counting. SecurityWeek tallies 421 CVEs including third-party entries such as the TPM 2.0 reference implementation. The Hacker News counts 398 Microsoft-owned flaws. Both are describing the same release; the difference is whether bundled non-Microsoft advisories are folded in. Either way it is one of the heaviest Patch Tuesdays on record, and the volume is concentrated in Windows itself with 236 entries, plus roughly 196 across Office and Office 2016.

A few beyond the zero-day are worth pulling forward.

RelatedSCTPhantom: an 18-year-old Linux bug that hands out root

CVE-2026-62832 deserves a second look. Microsoft flagged it as publicly disclosed and assessed exploitation as likely. A disclosed privilege-escalation bug with no patch lag is the kind of thing that shows up in commodity tooling within weeks, well after the news cycle has moved on.

Who is actually exposed?

Anyone running Windows endpoints, which is to say almost everyone. But the risk is not evenly spread. Organizations where users routinely run unsigned or unvetted code, developer laptops especially, are the sharp end. So are environments that rely on standard-user accounts as a security boundary, because that boundary is precisely what this bug erases.

Defense-adjacent and aerospace employers have a specific reason to care. Operation Dream Job is a Lazarus campaign built around fake recruiter outreach aimed at engineers in those sectors. The lure gets code running as the user. This bug is what happens next.

Our take

The interesting story is not that Microsoft shipped a huge patch bundle. It is that the same driver has now produced four exploited zero-days in two years, and the industry response each time is to patch and move on. afd.sys is doing what old, hot, privileged code does. The structural fix is memory-safe rewriting of the highest-exposure kernel paths, and Microsoft has done exactly that elsewhere in Windows. Winsock's kernel driver has not been on the receiving end of that effort in any visible way.

Until it is, plan for the fifth one. Practically, that means treating the standard-user boundary as soft, keeping application allowlisting on developer machines where it is most annoying and most necessary, and prioritizing by exploitation evidence rather than by CVSS. This month, that reordering puts a 7.0 above everything else in a 400-CVE pile.

Original analysis by GenZTech, based on Microsoft's MSRC advisory, the CISA KEV catalog entry of August 11, 2026, and published breakdowns of the August 2026 security release. Source: SecurityWeek.