CVE-2026-68820 · Windows Ancillary Function Driver for WinSock Elevation of Privilege…

01 · The Real Story

Like handing a building janitor the master key and the security camera power switch at the same time

CVE-2026-68820 is a use-after-free in afd.sys, the kernel-mode Ancillary Function Driver that underpins all WinSock networking on Windows. Two internal code paths can operate on the same socket state concurrently without synchronization; an attacker wins a race to reclaim freed memory with controlled data, gains an arbitrary kernel read/write primitive, and rewrites the process token to escalate from any standard user context to NT AUTHORITY\SYSTEM. Every supported Windows version is affected — Windows 10 1607 through Windows 11 26H1, plus Server 2012 through Server 2025 — because afd.sys ships in every Windows SKU.

Microsoft scored this 7.0 HIGH with an "Important" severity tag, which is technically defensible given the AV:L/AC:H vector: you need local access and you have to win a race condition. In a vacuum, that's fair. In the real world, it's conservative. Lazarus has already weaponized a stable, reliable exploit as part of Operation Dream Job, chaining it into FudModule v3.1 — a rootkit that kills 94 ETW providers, strips minifilter callbacks, and disables Smart App Control. Once FudModule is resident, your endpoint telemetry stops being evidence. Check Point Research discovered the bug being actively exploited in defense/aerospace targeting before Microsoft even knew about it. CISA added it to KEV on patch day. The 7.0 label undersells the operational risk when a nation-state already owns a production exploit and your detection plane goes dark post-escalation.

"Lazarus-weaponized kernel LPE in afd.sys blinds your EDR after landing SYSTEM — patch now."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Initial compromise via social engineering

Lazarus operators impersonate defense-sector recruiters (e.g., Lockheed Martin) and deliver encrypted ZIP archives containing trojanized PDF viewers or DLL sideloading packages. Two parallel chains exist: a libmupdf.dll sideload and a modified MuPDF-based SecurityPDF.exe. Both converge on deploying the MISTPEN downloader. The initial lure requires a human target to open the archive and execute the payload.

Conditions required:

Target user opens spear-phishing email and executes payload
Endpoint allows execution of unsigned or sideloaded DLLs

Where this breaks in practice:

Requires targeted social engineering — not spray-and-pray
Email gateway, sandboxing, or attachment filtering may intercept the lure
WDAC / AppLocker policy blocks unsigned DLL loads in hardened environments

Detection/coverage: Email gateway threat feeds, sandbox detonation of ZIP/PDF payloads, Sysmon Event ID 7 (image loaded) for libmupdf.dll sideloading from unusual paths.

STEP 02

MISTPEN downloader phones home via MS Graph API

MISTPEN performs host fingerprinting (OS build, installed security products) and uses Microsoft Graph API to retrieve modules from attacker-controlled OneDrive storage. It exchanges keys via Kyber/ML-KEM with GOST-CBC transport encryption, making traffic inspection extremely difficult. This C2 channel abuses a legitimate Microsoft service to blend with normal enterprise traffic.

Conditions required:

Outbound HTTPS to Microsoft Graph endpoints is permitted
Initial payload execution succeeded in Step 1

Where this breaks in practice:

Enterprises with strict OAuth app consent policies may block Graph API abuse
Proxy inspection can flag anomalous OneDrive access patterns from non-browser processes
EDR with behavioral detection may flag the Graph API call chain

Detection/coverage: Monitor for non-browser processes making Graph API calls to OneDrive. Check Point IOCs: envell[.]xyz, enveil[.]online, uxtramine[.]org. MISTPEN sample hash: 590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6.

STEP 03

CVE-2026-68820 race condition triggered in afd.sys

The exploit module targets unsynchronized socket state access in afd.sys. Two code paths are forced to operate on the same socket object concurrently — Path A holds a pointer while Path B frees the underlying allocation. Attacker-controlled data reclaims the freed memory during the race window, yielding an arbitrary kernel read/write primitive. The exploit is tuned per OS build (26100/26200 confirmed, but the underlying driver bug spans all builds).

Conditions required:

Local code execution as any authenticated user (PR:L)
Must win the race condition (AC:H) — timing-sensitive

Where this breaks in practice:

Race condition is inherently non-deterministic; reliability varies across hardware and load
Kernel exploit stability issues may cause BSOD on failure, alerting defenders
Kernel-mode exploit code requires precise build-specific offsets

Detection/coverage: No stock Sysmon or Security log event covers \Device\Afd IOCTL abuse. Requires kernel-mode EDR sensor or ETW Threat Intelligence provider. Post-exploitation token change visible as sudden SYSTEM integrity process with standard-user parent.

STEP 04

Token rewrite escalates to SYSTEM

The kernel read/write primitive is used to locate and overwrite the current process token with the SYSTEM token, elevating the attacker's process to NT AUTHORITY\SYSTEM. This is the standard Windows kernel exploitation technique — no additional vulnerability is needed once arbitrary kernel read/write is achieved. The escalated process can now load kernel-mode code.

Conditions required:

Kernel read/write primitive obtained in Step 3

Where this breaks in practice:

Virtualization-based security (VBS) / Credential Guard can harden token structures on supported builds
Kernel Data Protection (KDP) on Windows 11 24H2+ adds integrity enforcement

Detection/coverage: Process lineage anomalies: a child of an interactive user session suddenly running as SYSTEM. EDR behavioral rules for T1068 (Exploitation for Privilege Escalation).

STEP 05

FudModule v3.1 rootkit deployed

The escalated process spawns a SYSTEM-level msiexec.exe and injects FudModule through the exported function DestroyEnv(). FudModule v3.1 strips telemetry callbacks, kills the NT Kernel Logger, unlinks minifilters, blinds 94 ETW providers, sets VerifiedAndReputablePolicyState to zero (disabling Smart App Control), and applies generic security product suppression. Once resident, your endpoint telemetry stops being evidence — the rootkit operates below your detection plane.

Conditions required:

SYSTEM privileges obtained in Step 4
C2 channel operational from Step 2

Where this breaks in practice:

EDR with kernel-mode tamper self-protection may detect minifilter unlinking
Secure Boot + HVCI can block unsigned kernel-mode code on hardened builds
Kernel-mode code integrity (KMCI) enforcement prevents unsigned driver loads

Detection/coverage: Detection window is *pre-rootkit only*. Once FudModule loads, it actively sabotages the sensors you'd use to detect it. Pre-load: monitor for msiexec.exe spawning from unusual parents with SYSTEM token. Post-load: external log shipping (SIEM) preserves evidence if ETW is killed locally.

03 · Compensating Control

HIGH 8.0→IGNORE 0.0

SEVERITY REDUCED

Apply August 2026 cumulative update and force reboot — This is the definitive fix. The patched afd.sys driver eliminates the race condition entirely. The patch replaces a kernel driver, so a reboot is mandatory — the fix is not active until the host restarts. Because this CVE is KEV-listed with active exploitation, deploy within hours per the noisgate mitigation SLA override. Prioritize Domain Controllers and Tier-0 infrastructure in the first wave, then workstations and member servers within 48 hours.

HIGH 8.0→LOW 3.5

SEVERITY REDUCED

Enforce WDAC or AppLocker to block unsigned/untrusted binaries — Application control prevents the initial exploit payload from executing — the Lazarus chain relies on unsigned DLL sideloading (libmupdf.dll) and custom binaries (SecurityPDF.exe). A properly configured WDAC policy in enforcement mode blocks execution before the LPE is ever attempted. Deploy within 3 days per the noisgate mitigation SLA for this KEV-listed vulnerability. This breaks the chain at Step 1, before the kernel bug is reached.

HIGH 8.0→MEDIUM 5.5

SEVERITY REDUCED

Restrict 'Log on locally' and RDP rights on Tier-0 servers — The exploit requires local code execution (AV:L, PR:L). On Domain Controllers and Hyper-V hosts, restricting who can log on locally shrinks the pool of accounts that could trigger the LPE. Enforce Tier-0 administrative isolation: only dedicated PAW-sourced Tier-0 accounts should have interactive logon rights to DCs. This doesn't fix the bug but limits the blast radius on your most critical hosts. Deploy within 3 days.

HIGH 8.0→MEDIUM 5.0

SEVERITY REDUCED

Enable VBS, HVCI, and Credential Guard on supported builds — Virtualization-based security hardens kernel memory and token structures, making token rewrite exploitation significantly harder. HVCI (Hypervisor-Enforced Code Integrity) blocks unsigned kernel-mode code, which would interfere with FudModule loading. This is a defense-in-depth measure that degrades the exploit's post-exploitation capability even if the race condition is won. Deploy within 30 days per the noisgate remediation SLA for HIGH.

HIGH 8.0→HIGH 7.0

Ship logs externally and monitor for FudModule IOCs — FudModule kills local ETW providers — if your SIEM ingestion relies solely on local telemetry forwarding, you lose visibility post-exploitation. Ensure Windows Event Forwarding (WEF) or a dedicated log shipper sends events to your SIEM before they can be suppressed. Monitor for Check Point IOCs: SecurityPDF.exe hash 743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1, C2 domains envell[.]xyz, enveil[.]online, uxtramine[.]org. Detection-only — does not prevent exploitation.

What doesn't work

Network firewalls / segmentation alone — CVE-2026-68820 is a local privilege escalation; the exploit runs entirely on-host via \Device\Afd IOCTLs. Network-level controls do not intercept local kernel driver interactions.
WAF — not a web application vulnerability. No HTTP traffic is involved in the exploitation chain.
MFA by itself — the attacker already has local code execution when the LPE fires. MFA protects authentication gates; it does not prevent a process with a valid local session from calling kernel IOCTLs.
Disabling afd.sys — afd.sys is the kernel-side WinSock driver. Disabling it breaks all TCP/IP networking on the host. This is not a viable compensating control.
Standard antivirus signature scanning — the exploit operates in kernel memory via race condition. File-based AV signatures cannot detect in-memory kernel exploitation. FudModule actively disables AV once loaded.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Status	Actively exploited by North Korea's Lazarus Group as part of Operation Dream Job, targeting defense, aerospace, and aviation organizations. Check Point Research caught the exploitation in the wild before Microsoft was aware. CISA confirmed and added to KEV on 2026-08-11 (CISA alert).
PoC Availability	Multiple sources. A Chinese-language crash PoC was published 2026-08-09. Researcher Nightmare-Eclipse reportedly released related afd.sys PoC code post-July Patch Tuesday via `projectnightcrawler.dev` (after GitHub/GitLab bans). GitHub repos: `HORKimhab/CVE-2026-68820` (draft), `fevar54/CVE-2026-68820-Mitigation-PoC-` (educational). The Lazarus weaponized exploit is not public but demonstrates full reliability.
EPSS Score	0.00332 (0.33%) as provided — anomalously low for a KEV-listed, actively exploited vulnerability. Shodan CVEDB reports 0.022. EPSS models may lag KEV additions; treat this score as stale. Real-world risk far exceeds what EPSS implies.
KEV Status	Listed 2026-08-11 (same day as patch). CISA BOD 22-01 remediation deadline set to 2026-08-25 (14 days). BOD 26-04 imposes a 3-day deadline for publicly exposed Windows systems.
CVSS Vector	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H` — Local access, high attack complexity (race condition), low privileges required, no user interaction for the vuln itself. Scope unchanged. Triple-high CIA impact reflects full SYSTEM compromise. The `AC:H` is the key friction lever.
Affected Versions	All supported Windows: Win10 1607/1809/21H2/22H2, Win11 23H2/24H2/25H2/26H1, Server 2012/2012 R2/2016/2019/2022/2025. `afd.sys` ships in every Windows SKU — there is no unaffected edition.
Fixed Versions	August 2026 Patch Tuesday cumulative updates. Key KBs: KB5120238 (Win10 1809/Server 2019), KB5120249 (Win10 21H2/22H2), KB5120240 (Win11 23H2), KB5120242 (Server 2022). Patched build thresholds: 14393.9418, 17763.9115, 19044.7663, 19045.7663, 20348.5499, 22631.7517, 26100.9168, 26200.9168, 28000.2704. Reboot required to load updated `afd.sys`.
Scanning / Exposure	Local privilege escalation — no remote attack surface to scan with Shodan/Censys. Exposure is the entire Windows installed base. Qualys QID and Tenable plugin available for authenticated vulnerability scanning. Every unpatched Windows endpoint in your fleet is a potential target once an attacker has any local foothold.
Disclosure Timeline	Check Point reported to Microsoft 2026-07-28. Microsoft confirmed 2026-07-31, assigned CVE 2026-08-05, patched 2026-08-11. Check Point published research 2026-08-12. Total disclosure-to-patch: 14 days.
Credited Researchers	Check Point Research — discovered in-the-wild exploitation during Operation Dream Job investigation. Microsoft advisory credits Check Point (reportedly misspelled in initial MSRC posting). Rapid7 noted this as the standout actively-exploited bug of August 2026 Patch Tuesday.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (8.0/10)

Why this verdict

Active nation-state weaponization: Lazarus Group has a stable, reliable exploit deployed in real intrusions — this is not theoretical. The weaponized chain was discovered *in the wild* before Microsoft knew the bug existed. That eliminates any argument that AC:H meaningfully limits real-world exploitation when a funded adversary has already solved the race.
EDR-blinding post-exploitation multiplier: FudModule v3.1 doesn't just give SYSTEM — it kills 94 ETW providers, strips minifilter callbacks, and disables Smart App Control. Successful exploitation turns your detection infrastructure off *from below*. This is qualitatively worse than a standard LPE because it compounds every subsequent attacker action by removing visibility.
KEV-listed on patch day: CISA added this to KEV simultaneously with the patch release (2026-08-11), confirming active exploitation at disclosure. BOD 22-01 and BOD 26-04 both mandate accelerated remediation timelines. This is not a theoretical future risk.
PoC proliferation risk: Crash PoCs are already public, and Nightmare-Eclipse has published related afd.sys exploit material. The gap between crash PoC and weaponized LPE narrows rapidly once the root cause is known. Copycat exploitation beyond Lazarus is a matter of weeks, not months.
Role multiplier: afd.sys ships on every Windows machine, including Domain Controllers, Hyper-V hosts, backup servers, SIEM collectors, and CI/CD runners. On a Domain Controller, SYSTEM = domain admin = fleet-scale compromise. On a Hyper-V host, SYSTEM = potential guest VM access. DCs + hypervisors represent ≥1% of enterprise Windows fleets. The chain succeeds identically on these high-value roles — the blast radius on a DC is domain/fleet scale. This sets a HIGH floor that friction cannot pull below.
Friction audit — what holds this back from CRITICAL: (1) AV:L means the attacker must already have local code execution — this is a post-initial-access capability, not a first-stage entry point. (2) AC:H means the race condition is non-trivial, though Lazarus has proven it winnable. (3) The Lazarus campaign requires targeted spear-phishing to get local access. (4) afd.sys is a general-purpose kernel driver, not a role-defining component like AD DS — while it's present on DCs, <10% of the Windows installed base occupies high-value roles by definition, so the CRITICAL floor does not engage.

Why not higher?

The CRITICAL floor requires ≥10% of installs to canonically occupy a high-value role. afd.sys is universal infrastructure, not role-defining software like Active Directory Domain Services or ESXi. While the exploit succeeds on DCs and hypervisors, these represent <10% of the Windows installed base by definition — most Windows machines are workstations and member servers. Additionally, the AV:L vector means this is strictly a post-initial-access tool; it cannot be the first link in a kill chain. A CRITICAL rating would overstate the likelihood of exploitation for the median Windows endpoint.

Why not lower?

Active exploitation by a nation-state APT with a production-grade exploit eliminates any downgrade below HIGH. The KEV listing is not advisory — it reflects confirmed real-world compromise. The EDR-blinding capability of FudModule means that once this lands, your entire detection and response posture on that host is neutralized, compounding all subsequent risk. The DC/hypervisor blast radius sets a hard HIGH floor regardless of the local-access prerequisite. A MEDIUM rating would be negligent given the confirmed exploitation and fleet-scale blast radius on high-value hosts.

06 · Verification

Crowdsourced verification payload.

Run on each target Windows host (workstation or server) as any local user — no elevation required. Execute: powershell -ExecutionPolicy Bypass -File Check-CVE202668820.ps1. The script reads the OS build revision from the registry and compares it against known-patched thresholds from the August 2026 cumulative updates. Exit code 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN.

noisgate-verify.ps1

POWERSHELLREAD-ONLYSAFE

<#
.SYNOPSIS
  Check-CVE202668820.ps1 - Detect CVE-2026-68820 patch status
.DESCRIPTION
  Compares current OS build revision (UBR) against minimum
  patched revision per affected Windows build from August 2026
  Patch Tuesday. Covers Win10/11/Server 2012-2025.
.OUTPUTS
  VULNERABLE | PATCHED | UNKNOWN (exit 1 | 0 | 2)
#>
$ErrorActionPreference = 'Stop'
try {
    $ntv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
    $bld = [int]$ntv.CurrentBuildNumber
    $ubr = [int]$ntv.UBR
    $cap = (Get-CimInstance Win32_OperatingSystem).Caption
    Write-Host "[*] Host:  $env:COMPUTERNAME"
    Write-Host "[*] OS:    $cap"
    Write-Host "[*] Build: $bld.$ubr"
    Write-Host ''
    # August 2026 Patch Tuesday - minimum patched UBR per build
    $fix = @{
        9200  = 26279  # Server 2012
        9600  = 23337  # Server 2012 R2
        14393 = 9418   # Win10 1607 / Server 2016
        17763 = 9115   # Win10 1809 / Server 2019
        19044 = 7663   # Win10 21H2
        19045 = 7663   # Win10 22H2
        20348 = 5499   # Server 2022
        22631 = 7517   # Win11 23H2
        26100 = 9168   # Win11 24H2 / Server 2025
        26200 = 9168   # Win11 25H2
        28000 = 2704   # Win11 26H1
    }
    if ($fix.ContainsKey($bld)) {
        $need = $fix[$bld]
        if ($ubr -ge $need) {
            Write-Host "PATCHED - revision $ubr >= $need"
            exit 0
        } else {
            Write-Host "VULNERABLE - revision $ubr < $need (need >= $need)"
            Write-Host "Apply the August 2026 cumulative update and REBOOT."
            exit 1
        }
    } elseif ($bld -gt 28000) {
        Write-Host "UNKNOWN - build $bld is newer than known affected range."
        Write-Host "Verify against MSRC advisory manually."
        exit 2
    } elseif ($bld -lt 9200) {
        Write-Host "UNKNOWN - build $bld predates Server 2012; likely EOL and unpatched."
        exit 2
    } else {
        Write-Host "UNKNOWN - build $bld not in the affected list."
        Write-Host "May be an interim or LTSC build; verify with MSRC advisory."
        exit 2
    }
} catch {
    Write-Host "UNKNOWN - error: $_"
    exit 2
}