CVE-2026-68820 Turns a Windows Foothold Into SYSTEM
Microsoft’s August 2026 security updates fix a WinSock driver vulnerability already exploited in attacks. It is not a remote entry point, but it can turn an existing low-privilege foothold into full SYSTEM control.
Microsoft released its August 2026 security updates on 11 August. The release covers 421 Microsoft CVEs, including 236 affecting Windows, 98 affecting Office and 30 affecting SharePoint Server. One vulnerability stands above the volume: CVE-2026-68820, an elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock.
Microsoft says exploitation has been detected. That changes the patching decision. This is no longer a theoretical weakness to place somewhere in a normal monthly queue; it is a confirmed post-compromise route to the highest local privilege level on Windows.
Update: Lazarus used the flaw against defence firms
Check Point has now linked the observed exploitation to the North Korean Lazarus group. Its researchers say CVE-2026-68820 was used from early July in a new wave of Operation Dream Job, a long-running campaign that approaches employees with fraudulent recruitment offers. The latest targets included defence, aerospace and aviation organisations in Europe and India, particularly companies working on surveillance sensors, drones and robotics.
In at least one case, the attackers compromised an organisation in France and used its infrastructure in spear-phishing against additional targets. Check Point also observed successful targeting in France and Germany, with activity extending into Brazil and other parts of South America.
Lazarus incorporated the exploit into a new version of its FudModule kernel-mode rootkit for Windows 11 builds 26100 and 26200. FudModule can interfere with endpoint-security products and disable telemetry, while a newly documented backdoor called Troy supports reconnaissance, file transfer, hidden command execution, process termination and in-memory DLL injection. The exploit therefore sat in a complete intrusion chain rather than being used as a standalone entry point.
What happened
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. Microsoft rates it Important with a CVSS base score of 7.0.
The attack is local. A threat actor first needs a way to run code as a locally authenticated, low-privileged user on an affected system. The attacker can then launch a specially crafted application and try to win a race condition inside the vulnerable driver. No additional user interaction is required.
If the race succeeds, Microsoft says the attacker can gain SYSTEM privileges.
That distinction is important. CVE-2026-68820 does not, by itself, let an anonymous attacker compromise a Windows machine over the internet. It is the privilege-escalation stage of an attack chain: something an intruder can use after phishing, stolen credentials, malicious software, an exposed service or another initial-access technique has already created a foothold.
Microsoft lists affected updates across a broad Windows estate, including supported Windows 10 and Windows 11 releases and Windows Server 2012 R2, 2016, 2019, 2022 and 2025. Administrators should use the product table in Microsoft’s advisory to match each operating-system version to the correct cumulative or hotpatch update.
Why it matters
A CVSS score of 7.0 can look less urgent than a remotely exploitable Critical vulnerability. Real-world exploitation is the stronger signal.
SYSTEM is Windows’ highest local privilege tier. A successful privilege escalation can give an attacker the authority needed to access protected data, interfere with security controls, establish persistence and use the compromised machine as a stronger position for further attacks. Other defensive controls can still limit those actions, but the operating-system boundary has been crossed.
This is why local privilege-escalation vulnerabilities are frequently valuable in multi-stage intrusions. Initial access often lands with the rights of one user or service account. That access may be noisy, constrained and easier to remove. Kernel-level or SYSTEM access gives the intruder a much more powerful operating position.
The affected product range also increases the operational risk. The same remediation decision can touch employee laptops, administrative workstations, remote-desktop hosts, application servers and legacy systems covered by extended security support. Inconsistent patching leaves attackers a choice of targets even when the newest endpoints are protected.
Microsoft has not publicly described the attacks in which CVE-2026-68820 was observed. The advisory does not identify an attacker, campaign, malware family, victim profile or initial-access method. It also says the vulnerability was not publicly disclosed before the update. Those unknowns are a reason to avoid speculative attribution, not a reason to delay the fix.
How to respond
Organisations should move CVE-2026-68820 to the front of the August Windows rollout while retaining normal testing and recovery discipline.
- Identify affected systems. Inventory supported Windows client and server versions, including extended-security-update estates and systems that are managed outside the primary patch platform.
- Match the correct update. Use Microsoft’s CVE product table and August release notes to identify the applicable cumulative update, monthly rollup or eligible hotpatch package for each operating-system version.
- Prioritise likely foothold targets. Patch user workstations, administrator endpoints, RDS and VDI hosts, shared systems, build workers and servers on which untrusted or externally supplied code could run.
- Pilot quickly. Test the update on a representative client and server group, confirm application and network compatibility, then expand deployment without waiting for the end of a long maintenance cycle.
- Complete the installation. Track download, installation and reboot state. A device that reports an installed package but still has a pending restart may not yet be fully protected.
- Verify by build and vulnerability state. Confirm the post-update build numbers against Microsoft’s advisory and ensure endpoint or vulnerability-management tools no longer report the system as exposed.
- Investigate deployment failures. Treat machines that repeatedly miss the update, remain offline or fall outside central management as a separate risk queue rather than assuming estate-wide compliance.
Patching closes the vulnerability; it does not remove an attacker who exploited it before the fix arrived. Security teams should review endpoint telemetry around suspicious local program execution and subsequent SYSTEM-level activity. Useful signals include unexpected service or scheduled-task creation, security-tool tampering, unusual privileged child processes, new persistence and unexplained privilege changes.
Microsoft has not published campaign-specific indicators in its advisory. Check Point’s report does provide indicators and a YARA rule for related malware, but defenders should still focus on behaviour and evidence of an earlier foothold. Review fake recruitment lures, unusual kernel-driver activity, security-tool tampering, hidden command execution and outbound communications from systems used by defence, aerospace and engineering staff.
The practical lesson
The August release is large, but patch volume should not decide priority. Exploitation status, reachable attack paths and business exposure matter more than the headline number of CVEs.
CVE-2026-68820 requires local access and a difficult race condition. Those constraints are real, yet attackers are already overcoming them. For defenders, the correct response is equally concrete: deploy the applicable Windows update, verify that it is active across the estate and hunt for evidence that a low-privilege foothold became SYSTEM before the patch was installed.
Official sources and further reading
- Microsoft: August 2026 Security Updates
- Microsoft: CVE-2026-68820 advisory
- Check Point Research: Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack
- BleepingComputer: Lazarus hackers exploited Windows zero-day to target defence firms
- Microsoft Update Catalog
- Microsoft: Security Update Guide FAQs
- MITRE: CWE-416 Use After Free
Microsoft may revise affected-product details or deployment guidance after publication. Confirm the current advisory and product-specific known issues before broad rollout.
