One bug in Microsoft's 421 needs a reboot, a deadline, and an outage window

CISA and Microsoft confirmed on Tuesday that CVE-2026-68820 is under active exploitation, and CISA gave federal agencies until August 25 to install the fix ^[1][2]. It is the only vulnerability in Microsoft's August 2026 release that the company confirms is being used in real-world attacks, and because there is no workaround and the patch requires a device restart, it is an outage to schedule rather than a line item to queue ^[2][3][4].

The flaw is a use-after-free in the Windows Ancillary Function Driver for WinSock, AFD.sys, with a CVSS base score of 7.0 ^[5][6]. Microsoft says a locally authenticated user can run a crafted application to trigger a race condition and gain SYSTEM privileges with no user interaction ^[7]. That is the whole value proposition for an attacker who already has a foothold. Automox CTO Jason Kikta described it as a two-step problem: phish into low-privileged access first, then use this ^[8]. Kikta also said the exploitation pattern is detectable, but only if detection covers kernel-driver race abuse ^[9], which is a narrower claim than most EDR marketing implies.

Check Point says it found the bug while examining the latest wave of Operation Dream Job and disclosed it to Microsoft ^[10]. According to researchers at BleepingComputer's source material, Lazarus has been using it since early July ^[11], which puts roughly five weeks between first observed exploitation and an available fix ^[12]. Check Point reports the targets were defense, aerospace and aviation organisations in France, Germany, Brazil and India, with a focus on surveillance sensors, drones and robotics ^[13][14]. The lure is a fake recruiter on LinkedIn, impersonating Lockheed Martin or the privacy-tech firm Enveil, followed by a malicious PDF or a trojanized PDF viewer ^[15][16].

The post-exploitation chain matters for detection engineering. A downloader called MISTPEN pulls reconnaissance and persistence modules over Microsoft Graph API and OneDrive, then triggers the AFD.sys exploit ^[17]. The privilege escalation feeds FudModule 3.1, an updated kernel-mode rootkit that Lazarus has used since at least 2022; Check Point says it disables EDR telemetry and now tampers with Smart App Control ^[18][19]. A new backdoor, Troy, supports 17 operator commands including archive-based exfiltration, in-memory DLL injection and beacon timing changes ^[20][21]. Check Point observed the exploit built specifically for Windows 11 builds 26100 and 26200 ^[22].

For prioritisation: Microsoft shipped 421 vulnerabilities this month, 62 marked critical, 40 of those RCE ^[23][24]. Exactly one is confirmed exploited ^[3], which is 0.2 percent of the batch ^[25]. Sequence accordingly.

Two things to watch. Check Point reports the same actor scanning and compromising Roundcube installs via CVE-2025-49113 and planting a PHP web shell called RelayShell, with at least 17 infected servers identified ^[26][27]. And in at least one case the actor compromised a French organisation and used it to spear-phish further targets ^[28], so inbound mail from real partners is part of the delivery path. Separately, the FBI is investigating an incident in which an unidentified federal agency mistakenly hired a North Korean IT worker ^[29].