Microsoft's August Patch Tuesday release addresses 421 vulnerabilities across its product line, with one critical flaw, CVE-2026-68820, confirmed by Microsoft to have been exploited as a zero-day by North Korea's Lazarus Group. This use-after-free vulnerability resides in the Windows Ancillary Function Driver for WinSock.
According to Microsoft's advisory, a locally authenticated attacker could leverage CVE-2026-68820 by running a specially crafted application to trigger a race condition. Successful exploitation would grant the attacker SYSTEM-level privileges without requiring user interaction. Check Point researchers Moshe Marelus and David Driker are credited with discovering and reporting the vulnerability.
Check Point's threat intelligence lead stated that their analysts first observed attacks targeting CVE-2026-68820 in early June. While confirming one successful implementation, they suspect the vulnerability was widely used in the campaign. These attacks are linked to Lazarus Group's long-running "Operation Dream Job," which typically targets organizations globally, particularly in the defense sector, through social engineering tactics involving fake job offers.
The latest iteration of "Operation Dream Job" has focused on the defense sector in Europe and India, impersonating companies such as Lockheed Martin and privacy-tech firm Enveil. Attackers created at least three fraudulent Enveil websites, some of which achieved top search engine rankings to enhance their credibility. This campaign expanded its delivery methods to include impersonation websites and search engine optimization (SEO) techniques to distribute trojanized applications, aiming to evade phishing detection.
These attacks involved the distribution of a modified PDF viewer named SecurityPDF. This viewer is designed to execute malicious payloads embedded within attacker-crafted PDF files upon opening. The PDFs, when opened, deploy a previously unseen backdoor that Check Point has named "Troy." During these intrusions, Lazarus Group exploited CVE-2026-68820 as a zero-day to deploy a new version of FudModule, their kernel-mode rootkit. The exploit takes advantage of how `afd.sys` handles a socket when accessed concurrently by multiple threads.
Beyond CVE-2026-68820, Microsoft also noted CVE-2026-62832 as publicly known, an elevation-of-privilege flaw with a higher likelihood of exploitation. This vulnerability allows an authenticated attacker with credentials for another local account to load another user's registry hive by running a specially crafted application. This could enable access to or modification of another user's data and potentially lead to administrator privileges, again without user interaction.
While Microsoft highlighted only these two vulnerabilities as "notable" in its August release, other security researchers identified additional critical flaws. Among these is CVE-2026-62893, a critical remote code execution vulnerability in Windows Deployment Services TFTP Server. This flaw does not require user authentication or interaction and could be exploited for lateral movement within an enterprise if UDP port 69 is not blocked at the perimeter.
Another significant vulnerability, CVE-2026-62911, an Exchange bug, was demonstrated at a Pwn2Own contest. This privilege escalation flaw, achieved via an authentication bypass, could allow an attacker to take control of all Exchange user mailboxes, enabling them to send, read, and download emails and attachments. Despite Microsoft's assessment of "less likely" exploitation, the successful demonstration at Pwn2Own indicates a real and immediate threat.
