Windows AFD.sys CVE-2026-68820: Lazarus zero-day for SYSTEM privileges and the FudModule rootkit

What happened

Microsoft fixed CVE-2026-68820 on 11 August 2026, part of a Patch Tuesday that Tenable counted at 398 CVEs. It is a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys). A local, authenticated attacker can run a crafted program to trigger a race condition and get SYSTEM privileges. It is rated CVSS 7.0 and needs local code execution first (Tenable; BleepingComputer; CVE record).

Moshe Marelus and David Driker of Check Point reported it. Check Point attributes the in-the-wild use to Lazarus, which built the exploit into a new version of its FudModule kernel rootkit (BleepingComputer). According to Check Point’s findings, as reported by BleepingComputer (BleepingComputer):

• Lazarus used the zero-day from at least early July 2026 in “Operation Dream Job,” which uses fake recruitment offers to reach employees.
• Targets were defense, aerospace and aviation organizations in Europe and India, with activity also in Brazil, France and Germany. One compromised French organization was used to spear-phish others.
• The exploit supported Windows 11 builds 26100 and 26200 (24H2 and 25H2).
• The new FudModule disables EDR telemetry, interferes with security products and tampers with Smart App Control. A new backdoor, Troy, has 17 commands, including in-memory DLL injection and exfiltration.

CISA added the CVE to KEV on 11 August with a due date of 25 August (CISA KEV).

Am I affected?

Every supported Windows client and server version without the August 2026 update is affected. Fixed builds from the CVE record (CVE record):

# Build and update revision on this machine
$v = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
"$($v.CurrentBuild).$($v.UBR)"

Indicators from Check Point’s report (Check Point Research):

• Lures: encrypted ZIPs with fake job descriptions (one impersonating Lockheed Martin, another impersonating Enveil), a signed PDF viewer with a malicious libmupdf.dll side-loaded next to it, or a trojanized viewer named SecurityPDF.exe.
• Files: libmupdf.dll, SecurityPDF.exe, new.exe in %TEMP%, Afd4Eop12_x64.dll, Release_GetInfoPlugin_x64.dll, Release_PvPlugin_x64.dll, OneScreenCapture64.dll.
• Network: envell.xyz, enveil.online, uxtramine.org, 135.181.67.203, 135.181.185.158.
• SHA-256: FudModule 3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d; SecurityPDF.exe 743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1; Troy 590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6. The report lists more.
• Behaviour: FudModule removes kernel callbacks and minifilters, stops the NT Kernel Logger, disables 94 ETW providers, suppresses crash dumps and sets the Smart App Control value VerifiedAndReputablePolicyState to zero. A SYSTEM msiexec.exe spawned through two hops is part of its chain.

What to do now

1. Install the August 2026 cumulative update or later on all Windows machines, starting with Windows 11 24H2 and 25H2, the builds the exploit targeted.
2. Hunt on machines of people who got recruiter approaches since early July 2026, especially in defense, aerospace and aviation. Look for job-offer documents or “assessment” programs run from email or messaging apps, then for the Check Point indicators above. Check whether VerifiedAndReputablePolicyState was changed on machines that use Smart App Control.
3. Treat a sudden loss of EDR telemetry as a signal. FudModule’s job is to switch off security tooling. An endpoint that stops reporting, or whose security product stops without an admin action, needs a look from outside the machine.
4. If you find FudModule or Troy, rebuild the machine. A kernel rootkit means you cannot trust anything the host reports about itself.
5. Patch internet-facing Roundcube. The same Check Point report describes Lazarus compromising at least 17 Roundcube servers through CVE-2025-49113 to install a PHP web shell called RelayShell (BleepingComputer).

Sources

• Microsoft Security Update Guide: CVE-2026-68820
• Tenable: Microsoft’s August 2026 Patch Tuesday addresses 398 CVEs
• BleepingComputer: Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
• BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms
• Check Point Research: Shattering the Dream
• CVE record: CVE-2026-68820
• CISA Known Exploited Vulnerabilities catalog