Vulnerability Analysis

CVE-2026-68820: Windows AFD.sys Use-After-Free Zero-Day Exploited by Lazarus Group — How to Detect, Patch & Harden

Executive Summary

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access through a race condition. North Korea's Lazarus Group exploited it as a zero-day for at least five weeks before Microsoft patched it on August 11, 2026 — weaponizing it as part of the Operation Dream Job campaign to deploy a kernel-mode rootkit against defense sector targets in Europe and India. CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog and mandated federal agencies patch by August 25, 2026.

1. What Is This Vulnerability?

The Windows Ancillary Function Driver (afd.sys) is a kernel-mode component that services socket I/O requests from user-mode applications via the Windows Sockets (Winsock) API. Every Windows process that performs network I/O passes through this driver.

CVE-2026-68820 is a use-after-free (UAF) flaw: a memory region associated with a socket object is freed prematurely, but a reference to that region remains in a concurrent code path. By carefully timing competing threads — winning a race condition — an attacker can redirect execution to attacker-controlled data in the freed buffer, ultimately achieving arbitrary kernel-mode code execution under the SYSTEM account.

How the Race Condition Works

At a conceptual level, the exploit pattern looks like this:

Thread A:                          Thread B (attacker-controlled):
1. Kernel allocates socket object  
2. Pointer stored in afd.sys       
                                   3. Trigger object free (racing)
4. afd.sys dereferences stale ptr  ← use-after-free occurs here
5. Attacker heap-sprays freed slot
   with malicious data
6. Kernel executes attacker payload → SYSTEM

Because the race window is narrow, the attack complexity is rated High — but Lazarus built a reliable exploit that worked against Windows 11 builds 26100 and 26200, suggesting they invested significant time in reliability engineering.

Attack Vector

The vulnerability requires local access — the attacker must already have a foothold on the target machine (even a standard, unprivileged user session). Exploitation yields:

  • Privilege escalation from low integrity → NT AUTHORITY\SYSTEM
  • Kernel-mode code execution (rings 0 trust)
  • Ability to disable security tooling (EDR/AV blind spots)
  • Persistence through kernel-mode rootkits

Real-World Impact — Operation Dream Job

Check Point Research disclosed that Lazarus Group weaponized CVE-2026-68820 in a multi-stage intrusion chain dubbed Operation Dream Job:

  1. Lure delivery: Targets in the defense sector received fake job offers impersonating Enveil (a privacy tech company), directing them to download "SecurityPDF" — a trojanized open-source PDF viewer.

  2. Initial compromise: Opening a specially crafted PDF decrypted and launched MISTPEN, a lightweight downloader that communicates via Microsoft Graph API and OneDrive for C2 traffic blending.

  3. Privilege escalation: MISTPEN loaded an in-memory LPE module exploiting CVE-2026-68820 in afd.sys.

  4. Rootkit deployment: Successful exploitation executed FudModule, Lazarus' signature kernel-mode rootkit, at SYSTEM privileges — giving the attackers the ability to blind EDR sensors.

  5. Long-term access: The ForestTiger backdoor was installed for persistent remote access.

Check Point reported the vulnerability to Microsoft on July 28, 2026. Microsoft confirmed the bug on July 31, assigned the CVE on August 5, and shipped a fix on August 11 — meaning Lazarus ran the exploit undetected for at least five weeks.

2. Who Is Affected?

All of the following are affected without the August 2026 Patch Tuesday update applied:

Platform Affected Versions
Windows 10 1607, 1809, 21H2, 22H2
Windows 11 24H2, 26H1
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025

Highest-risk environments:

  • Multi-user systems (RDS, VDI, Citrix) where untrusted users share a host
  • Development/CI machines where contractors or third parties have accounts
  • Internet-facing Windows servers accessible by standard user accounts
  • Defense, government, and critical infrastructure (primary Lazarus targets)

Not affected:

  • Azure SQL Database (separate CVE-2026-56162)
  • macOS, Linux
  • Fully patched Windows systems with August 2026 updates applied

3. How to Detect It (Testing)

Check Patch Status First

Before testing, determine if the patch is already applied:

# Check Windows Update history for August 2026 Patch Tuesday
Get-HotFix | Where-Object { $_.InstalledOn -ge "2026-08-11" } | 
    Select-Object HotFixID, Description, InstalledOn | 
    Format-Table -AutoSize

# Check OS build (patched builds will have updated afd.sys)
[System.Environment]::OSVersion.Version

# Verify afd.sys file version (patched version will be higher)
Get-Item "C:\Windows\System32\drivers\afd.sys" | 
    Select-Object VersionInfo | Format-List

Manual Testing Steps

Step 1 — Confirm unpatched state Check that the August 12, 2026 (or later) cumulative update is NOT installed. On unpatched systems, the afd.sys driver version will be lower than the patched baseline.

Step 2 — Simulate race condition trigger (safe PoC) No public PoC is available; however, you can validate exploitability by checking driver version against Microsoft's security update guide entry for CVE-2026-68820.

Step 3 — Hunt for active exploitation indicators Look for processes that anomalously acquired SYSTEM-level tokens after launching from a user context:

# Hunt for unexpected SYSTEM-level child processes spawned by user-level parents
Get-WinEvent -LogName Security -FilterXPath `
  "*[System[EventID=4688] and EventData[Data[@Name='SubjectUserSid']='S-1-5-18']]" |
  Select-Object TimeCreated, Message | Format-List

Automated Scanning

Tenable / Nessus

  • Plugin ID: Search for CVE-2026-68820 in the plugin library
  • Run authenticated credentialed scan against all Windows endpoints
  • Expected finding: Missing Microsoft Security Update — August 2026

Qualys

  • QID for CVE-2026-68820 available post-August 12, 2026 signature update
  • Run PC scan with Windows authentication

CrowdStrike / SentinelOne / Microsoft Defender for Endpoint

  • Query for CVE-2026-68820 in vulnerability management dashboards
  • Both platforms flag unpatched afd.sys versions in their asset inventory

Microsoft Defender Vulnerability Management (MDVM)

// KQL: Find devices missing the August 2026 patch
DeviceTvmSoftwareVulnerabilities
| where CveId == "CVE-2026-68820"
| project DeviceName, OSPlatform, SoftwareVersion, RecommendedSecurityUpdate
| summarize count() by DeviceName

Code Review / IOC Checklist

Look for these Lazarus/Dream Job indicators of compromise:

  • Presence of SecurityPDF.exe or SecurityPDF_Installer.exe on endpoints
  • Outbound connections to Microsoft Graph API (graph.microsoft.com) from unusual processes
  • OneDrive API calls from non-Office processes (MISTPEN C2 channel)
  • Unsigned or anomalously-signed DLLs loaded into PDF viewer processes
  • FudModule artifacts: kernel callbacks being removed or driver communication threads
  • Process token integrity suddenly changing to SYSTEM from standard user
  • ForestTiger backdoor signatures (check vendor TI feeds)

4. How to Fix It (Mitigation)

Step-by-Step Remediation

1. Apply the August 2026 Patch Tuesday update immediately

This is the only complete fix. Apply Microsoft's August 11, 2026 cumulative update to all affected Windows endpoints and servers.

2. Prioritize by exposure

Patch in this order:

  1. Internet-facing Windows Servers accessible to non-admin users
  2. Remote Desktop / VDI / Citrix session hosts
  3. Developer machines and CI/CD build agents
  4. Corporate workstations (standard users)
  5. Air-gapped or isolated internal systems

3. Deploy via your patch management platform

# Windows Update (standalone)
Install-Module PSWindowsUpdate -Force
Import-Module PSWindowsUpdate
Get-WindowsUpdate -Install -AcceptAll -AutoReboot

# SCCM/MECM — deploy via Software Center or push deployment
# Intune — create a compliance policy requiring August 2026 feature update
# WSUS — approve the August 2026 cumulative update for all target groups

4. Force restart to apply kernel-level patch

afd.sys is a kernel driver — the patch only takes effect after a full system restart. Do not defer reboots for this vulnerability.

# Schedule restart during maintenance window
shutdown /r /t 3600 /c "CVE-2026-68820 security patch restart"

5. Verify patch applied (post-reboot)

# Confirm updated afd.sys
(Get-Item "C:\Windows\System32\drivers\afd.sys").VersionInfo.FileVersion

# Confirm cumulative update installed
Get-HotFix | Where-Object { $_.InstalledOn -ge "2026-08-11" } | 
    Select-Object HotFixID, InstalledOn

Interim Mitigations (If Patching is Delayed)

If you cannot immediately patch (e.g., due to change freeze):

  • Restrict local logon access: Remove non-administrator accounts from systems where they aren't needed. The vulnerability requires an existing local session.
  • Enable Windows Defender Credential Guard and Exploit Protection to increase kernel exploitation difficulty.
  • Deploy AppLocker or WDAC policies to block unauthorized executables (disrupts the Dream Job delivery chain).
  • Monitor for MISTPEN C2 patterns: Block or alert on graph.microsoft.com and onedrive.live.com connections from non-Microsoft-signed processes.
  • Restrict USB and download of unsigned executables to reduce the initial trojanized PDF delivery vector.

No Workaround Exists

Microsoft has confirmed there is no registry key, feature flag, or configuration workaround that mitigates CVE-2026-68820 without applying the patch. Patching is the only complete remediation.

5. How to Test the Fix (Validation)

Regression Test Scenarios

  • Scenario A: Confirm patch is installed and afd.sys is updated to post-August 11 version
  • Scenario B: Validate standard-user processes cannot anomalously acquire SYSTEM tokens
  • Scenario C: Confirm normal Winsock / network functionality is unaffected post-patch
  • Scenario D: Verify Dream Job IOCs are not present on patched systems

Security Test Cases

Test Case 1: Verify patch is applied

  • Precondition: System rebooted after applying August 2026 cumulative update
  • Steps: Run Get-HotFix and check afd.sys version
  • Expected Result: Update KB listed, driver version incremented

Test Case 2: Privilege escalation attempt fails

  • Precondition: Patch applied and system rebooted
  • Steps: Attempt to run a kernel-mode privilege escalation test tool (e.g., local security assessment scripts) as a standard user targeting the AFD.sys race condition attack surface
  • Expected Result: Escalation fails; process remains at user integrity level

Test Case 3: Winsock functionality unaffected

  • Precondition: Patch applied
  • Steps: Run standard network connectivity tests, socket operations, application smoke tests
  • Expected Result: No regression in network behavior

Automated Post-Patch Validation

# Automated patch validation script
$cve = "CVE-2026-68820"
$patchDate = [datetime]"2026-08-11"
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -ge $patchDate }
$afdVersion = (Get-Item "C:\Windows\System32\drivers\afd.sys").VersionInfo.FileVersion

Write-Host "=== $cve Patch Validation ===" -ForegroundColor Cyan
Write-Host "Hotfixes installed since Aug 11, 2026: $($hotfixes.Count)"
Write-Host "afd.sys Version: $afdVersion"

if ($hotfixes.Count -gt 0) {
    Write-Host "STATUS: PATCHED - August 2026 update detected" -ForegroundColor Green
} else {
    Write-Host "STATUS: UNPATCHED - Apply August 2026 cumulative update immediately" -ForegroundColor Red
}

6. Prevention & Hardening

Best Practices

  • Maintain a regular patch cadence: CVE-2026-68820 was exploited for 5+ weeks before the patch. Organizations on monthly patch cycles missed the entire window of undetected exploitation. Shorten your patch SLA for CVSS ≥7.0 vulnerabilities to 14 days or less.
  • Enforce least privilege: The vulnerability requires an existing local session. Eliminate unnecessary standard-user access to sensitive servers, especially RDS and build systems.
  • Apply WDAC / AppLocker: Code integrity policies block unsigned or untrusted executables, disrupting the Dream Job delivery chain before afd.sys exploitation ever becomes possible.
  • Monitor CISA KEV: Subscribe to CISA's Known Exploited Vulnerabilities feed. When a vulnerability is actively exploited and KEV-listed, treat it as a 48–72 hour patch priority.

Monitoring & Detection

Even after patching, maintain detection for residual compromise from the pre-patch exploitation window:

// Microsoft Defender for Endpoint - Detect MISTPEN-style Graph API C2
DeviceNetworkEvents
| where RemoteUrl has "graph.microsoft.com"
| where InitiatingProcessFileName !in~ 
    ("outlook.exe","teams.exe","msedge.exe","WINWORD.exe","EXCEL.exe","onedrive.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl
| order by Timestamp desc

// Detect unexpected SYSTEM token acquisition
DeviceProcessEvents
| where AccountSid == "S-1-5-18"  // NT AUTHORITY\SYSTEM
| where InitiatingProcessAccountSid != "S-1-5-18"
| where InitiatingProcessIntegrityLevel in ("Low","Medium")
| project Timestamp, DeviceName, FileName, InitiatingProcessFileName, 
          InitiatingProcessIntegrityLevel
| order by Timestamp desc

Alert priorities:

  • PDF viewer processes making outbound Graph API calls → Critical
  • Standard-user processes spawning SYSTEM children → Critical
  • Unsigned DLLs loaded by PDF or document applications → High
  • New scheduled tasks or services created after PDF open events → High

Threat Intelligence Feeds

Subscribe to these to catch future Lazarus/Dream Job activity:

References

Latest from the blog

See all →