What happened
Microsoft's August 2026 Patch Tuesday, released on August 11, closed out roughly 400 security flaws across Windows, Office, Exchange Server, SharePoint Server, Azure, and other products. Counts vary slightly by tracker, but Microsoft's own release lands near 398 Common Vulnerabilities and Exposures (CVE) entries, the standard catalog system used to identify and track publicly known security flaws. Three of those were zero-day vulnerabilities, meaning they were disclosed or already being exploited before an official fix existed. One was confirmed under active attack, and the other two were publicly disclosed without confirmed exploitation.
About 62 of this month's fixes carry a critical rating under the Common Vulnerability Scoring System (CVSS), an industry scale from 0 to 10 used to estimate how easy and damaging a flaw is to exploit.
The one confirmed actively exploited zero-day, tracked as CVE-2026-68820, drew the most attention this month, less for its raw score than for who was caught using it.
The afd.sys flaw explained
CVE-2026-68820 lives inside afd.sys, the Ancillary Function Driver for WinSock, a core Windows kernel component that handles socket operations for nearly every networked application on the system. It is a use-after-free bug, a class of flaw where a program keeps referencing a piece of memory after that memory has already been freed for other use, which an attacker can exploit to hijack how the program behaves.
In this case, two internal code paths inside afd.sys can act on the same socket data at the same time without proper coordination. An attacker who already has some code running on a machine can trigger a race condition, a timing-based bug where the outcome depends on which of two competing operations finishes first, to seize control of that shared memory. Winning the race lets the attacker jump from a limited account to SYSTEM, the highest privilege level on a Windows machine, equivalent to full administrative control over the entire operating system, without needing the victim to click, open, or interact with anything else.
Because exploitation depends on already having some code execution on the target, this is not a remote break-in tool. It is a way to turn a small foothold into complete control of the machine.
Who exploited it, and how
Check Point Research attributes exploitation of CVE-2026-68820 to Lazarus Group, a hacking group widely linked to North Korea's government, operating as part of Operation Dream Job, a years-long espionage campaign. The campaign lures employees at defense, aerospace, and aviation firms with fake recruiter messages and job offers, then convinces them to download what looks like software tied to the fake position. The payload arrives either through sideloading a malicious Dynamic Link Library (DLL), a shared code file that Windows programs load at runtime, or through a trojanized Portable Document Format (PDF) viewer, sometimes reinforced by fake careers sites built to rank well in search results.
Once a victim's machine was compromised, the attackers used CVE-2026-68820 to escalate to SYSTEM and load FudModule, a kernel-mode rootkit Lazarus Group has used for several years to hide its activity. The newest version reportedly blocks visibility for endpoint detection tools, suppresses crash dump generation, and interferes with Windows' Smart App Control feature, all intended to keep defenders from noticing the intrusion. Reported targets span defense and aerospace organizations in Brazil, France, Germany, and India, along with companies working on drones, robotics, and surveillance sensors.
Check Point says it found a freshly compiled version of the rootkit dated July 7, 2026, reported the flaw to Microsoft on July 28, and Microsoft confirmed it days later before shipping the fix on August 11.
Reconciling the CVE count
Coverage of this Patch Tuesday has not settled on one identical number. Some outlets report 398 CVEs, others round to 400, and SecurityWeek counted 421. The gap comes down to counting method rather than a factual disagreement. Some trackers count a shared CVE once, even when Microsoft issues separate advisory entries for it across multiple product versions, such as Office and an older Office release both getting their own listing for the same underlying bug. Others count every one of those product-specific entries separately, which inflates the total. Two additional CVEs came from a non-Microsoft component, the Trusted Platform Module (TPM) 2.0 reference implementation, bundled into the same release. Treat "around 400" as the accurate figure rather than any single exact total, since conventions differ by tracker.
The CISA listing and the deadline
The Cybersecurity and Infrastructure Security Agency (CISA), the US agency responsible for coordinating civilian cyber defense, added CVE-2026-68820 to its Known Exploited Vulnerabilities (KEV) catalog on August 11, the same day Microsoft released the fix. The KEV catalog lists only vulnerabilities CISA has confirmed are being used in real attacks, and inclusion carries a specific consequence: under CISA's binding directive, federal civilian executive branch agencies must patch listed flaws within a set window. For this entry, that window closes on August 25, two weeks after the catalog addition.
What this means in practice
The federal deadline only legally applies to US government agencies, but a KEV listing is a reliable signal for everyone else too, since a flaw only reaches that catalog after confirmed real-world exploitation. Organizations running current Windows versions should prioritize this patch alongside the month's other actively relevant fixes, including the Domain Name System (DNS) Server remote code execution flaw patched the same day, which affects internet-facing servers and does not require an attacker to already be on the network.
For most IT teams, three things follow from this. First, patch machines used by employees who might receive unsolicited recruiter messages or attachments, since Operation Dream Job spreads through exactly that kind of social engineering rather than a network exploit. Second, do not dismiss local privilege escalation bugs as low priority just because they need existing code execution to work. They are precisely what turns one phished employee into a fully compromised machine with rootkit-level persistence. Third, expect continued scrutiny of afd.sys. Researchers have noted that this same driver has been the target of multiple zero-days over roughly the past two years, several tied to North Korean-linked activity, suggesting attackers keep returning to it because it offers a dependable path to SYSTEM once they already have a foothold.
