CVE-2026-68820 carries a CVSS score of 7.0 and requires local access. By the usual triage heuristics, that puts it well behind the 42 Critical remote code execution flaws in the same August release.
It is the only flaw in that release Microsoft confirms is being exploited, and Check Point Research ties its use to Lazarus in the Operation Dream Job campaign, where it was used to deploy a new build of the FudModule kernel-mode rootkit.
That chain — local foothold, SYSTEM, kernel rootkit — is why the score is the least interesting fact about it.
The bug
afd.sys is the Ancillary Function Driver for WinSock: the kernel-mode driver that sits behind the Windows Sockets API. Every socket operation any process performs goes through it.
The flaw is a use-after-free reachable through a race condition in how the driver handles a socket accessed concurrently by several threads. An attacker running a crafted application creates the concurrent access pattern, wins the race, and gets a freed kernel object reused under their control. Winning it yields SYSTEM.
Two properties make this a durable target class rather than a one-off.
It is reachable from the lowest privilege level by design. Any process, including one in a sandbox or running as an unprivileged user, can create sockets. That is the entire point of the driver. So the attack surface is available to every piece of code on the machine, with no permission gate to remove.
Race conditions are retryable. Exploitation is probabilistic — you may not win on the first attempt — but nothing stops an attacker from trying repeatedly. A 1-in-1000 race is a reliable exploit given a loop. Probabilistic is not the same as difficult.
Tenable's Satnam Narang noted that historical tradecraft targeting afd.sys pointed toward nation-state operators before attribution landed. That read was correct.
Why "requires local access" is the most misread phrase in vulnerability management
The reasoning that defers this class goes: the attacker already needs code execution on the box, so they have already won — this only makes things marginally worse.
Both halves are wrong.
Getting local execution is the cheap part. A phishing attachment, a malicious npm package running in a build, a compromised IDE extension, a drive-by, a malicious document. Every one of these routinely yields unprivileged code execution on a workstation. The industry has spent a decade making that step commodity.
Unprivileged execution is genuinely constrained. In a modern environment, low-privilege code runs alongside EDR it cannot touch, cannot read other users' data, cannot install a driver, cannot clear the event log, and cannot persist below the user profile. It is a foothold, not control.
Privilege escalation is what converts one into the other. It is the load-bearing middle link, and it is systematically underweighted because scoring systems evaluate it in isolation — the same structural problem we described with Cisco's CVSS 5.3 that Cisco itself rated High.
What SYSTEM buys, and why the rootkit is the point
Lazarus did not escalate for its own sake. They escalated to load FudModule, a kernel-mode rootkit.
That sequencing matters. Once code runs in the kernel:
- EDR and AV can be blinded or disabled. Security products run with high privilege but the kernel outranks them. This is the primary reason sophisticated actors invest in kernel access at all.
- Detection telemetry becomes untrustworthy. Your logs are generated by a system the attacker controls beneath the logging layer. Absence of evidence stops meaning anything.
- Persistence survives the usual responses. Reimaging the user profile, resetting credentials, and removing user-mode implants do not reach it.
- Everything on the host is readable, including credentials in memory, keys, and tokens.
So the honest way to state the risk of CVE-2026-68820 is not "an attacker gains SYSTEM." It is: an attacker turns off your ability to see what happens next. Every detection-based control downstream of the kernel is contingent on this bug not being exploited.
The Operation Dream Job connection
Operation Dream Job is Lazarus's long-running campaign of approaching engineers and developers with fabricated job offers, then delivering malware through the "assessment" or "coding challenge" that follows.
The target selection is deliberate and it should worry anyone in software. Developers hold source access, cloud credentials, CI/CD access, package publish rights, and signing keys. A developer workstation is a supply chain position, which is why Lazarus keeps returning to it — the same logic behind their software supply chain campaigns and the 3CX compromise.
Read the full chain: a social-engineering lure lands unprivileged code on a developer's machine, CVE-2026-68820 lifts it to SYSTEM, FudModule blinds the endpoint tooling, and the attacker is resident on a host holding credentials to your repositories, your cloud, and your release pipeline. Every incident this quarter — keyv, TeamCity, Nx — converges on the same objective from a different starting point.
What to do
Patch inside 24–48 hours on every multi-user system and every workstation. Not the normal EoP cadence. This has confirmed nation-state use.
Prioritise developer and administrator endpoints first. Given the campaign's targeting, those are the machines where a foothold is most valuable and most likely.
Do not rely on EDR to catch the follow-on. The payload's function is to defeat it. Detection has to happen before the escalation — at the initial execution — or outside the host entirely, in network telemetry and identity logs the compromised kernel cannot edit.
Reduce what a compromised workstation reaches. This is the durable control. If a developer machine holds no standing long-lived credentials to production, SYSTEM on that machine is a serious incident rather than a supply chain event.
Treat unexplained SYSTEM-level activity in the exposure window as an incident, not an anomaly to close.
How Safeguard helps
Exploitation-weighted prioritisation. A 7.0 with confirmed use by a named actor outranks 42 unexploited Criticals. Safeguard ranks on KEV membership, exploit availability, EPSS, and reachability rather than base score — which is the only ordering that surfaces this one correctly.
Developer endpoints treated as supply chain assets. Safeguard's Supply Chain Core inventories IDE extensions, CLI agents, MCP servers, and installed software on developer machines alongside packages and containers, so the endpoints this campaign targets are actually enumerated.
Lion for the blast radius that survives a kernel compromise. Lion enforces just-in-time secret brokering so workstations hold no resident long-lived credentials, capability scoping to bound reach, egress allowlists that break command-and-control, and signed audit trails written outside the host. That last property matters specifically here: when the kernel is untrustworthy, your evidence needs to live somewhere the kernel cannot reach.
Eagle for scoping after a rootkit. When host telemetry cannot be trusted, exposure has to be reconstructed from what the host touched — identity logs, credential usage, repository and registry activity. Eagle works from those records rather than from the compromised endpoint's own account of itself.
If you triage by CVSS, this flaw is in next month's batch. It is the one that is already being used.
Sources: MSRC advisory for CVE-2026-68820 · The Register · SecurityWeek · Tenable · The Hacker News
