Microsoft has released its August 2026 security updates, addressing 421 Common Vulnerabilities and Exposures (CVEs), including an actively exploited high-severity zero-day flaw in the Windows Ancillary Function Driver (afd.sys). Tracked as CVE-2026-68820, this use-after-free vulnerability has been weaponized in the wild by North Korea’s Lazarus Group to achieve SYSTEM privileges.
The Anatomy of CVE-2026-68820: A Kernel-Level Race Condition
At the core of the Windows Sockets API lies the Ancillary Function Driver, better known as afd.sys. According to detailed technical disclosures, the CVE-2026-68820 flaw is a use-after-free condition. When a socket is created and accessed concurrently by several threads at once, a race condition occurs. Local threat actors can craft specialized applications to trigger this race, leading to memory corruption.
User interaction is not required for successful exploitation. Once the local execution succeeds, attackers gain SYSTEM privileges. According to imtr.net, actors utilizing this zero-day have deployed payloads like the FudModule kernel-mode rootkit, alongside backdoors such as “Troy” and trojanized PDF readers branded as “SecurityPDF.”
Historical precedent underscores why this driver remains a target for nation-state actors. Tenable senior staff research engineer Satnam Narang pointed out that afd.sys has seen three other in-the-wild zero-days exploited since 2022, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193—the latter of which was also tied to North Korean hackers linked to the Lazarus group.
Beyond the Zero-Day: Privilege Escalation and Remote Code Execution Risks
While the active zero-day commands immediate incident response triage, the broader August batch introduces several other flaws demanding swift remediation. Security teams must account for public disclosures that carry imminent weaponization risks.
- CVE-2026-62832: An improper link resolution bug within the Windows User Profile Service. Authenticated local attackers can load another user’s registry hive to access or modify another user’s data and gain administrator privileges without user interaction.
- CVE-2026-62893: A critical remote code execution flaw in Windows Deployment Services (WDS) utilizing the Trivial File Transfer Protocol (TFTP). Because TFTP lacks built-in authentication, this UDP Port 69 vulnerability can be triggered remotely.
- CVE-2026-72971: A link-following flaw inside the Windows Container Isolation FS Filter Driver (
unionfs.sys), which poses local tampering risks. - Remote Execution Vectors: Additional RCE patches target the Windows DNS server (CVE-2026-62878), Microsoft QUIC (CVE-2026-62815), and the Microsoft HPC Pack (CVE-2026-59124).
Securityweek.com notes that ZDI’s Dustin Childs also flagged an elevation of privilege bug in Exchange Server tracked as CVE-2026-62911.
A Breakdown of the August 2026 Patch Distribution
The 421 total fixes are distributed across various architectural layers and product families.
| Product Family | Patch Count |
|---|---|
| Windows OS Components | 236 |
| Microsoft Office & Office 2016 | 196 (98 each) |
| SharePoint Server | 30 |
| Developer Tools | 26 |
| Azure Infrastructure | 17 |
| Exchange Server | 7 |
| Microsoft Defender & Others | 7 |
Two non-Microsoft CVEs also made the list, covering a spoofing bug (CVE-2026-6726) and an information disclosure vulnerability (CVE-2026-6727) inside the TPM 2.0 reference implementation.
Enterprise Remediation and Mitigation Strategy
Kernel-mode vulnerabilities preclude easy software workarounds; patching remains the primary viable defense for CVE-2026-68820. For network-facing risks like the WDS TFTP flaw, administrators should block UDP Port 69 at network perimeters if immediate patching is operationally impossible.
Defenders should prioritize hunting indicators of compromise associated with SEO-poisoned websites impersonating firms like Lockheed Martin or Enveil, alongside unusual local privilege escalation attempts.
