Exploited vulnerabilitiesBriefConfirmed by two or more outlets
Windows AFD.sys use-after-free (CVE-2026-68820)
Exploited as a zero-day by Lazarus. August Patch Tuesday, about 400 CVEs.
- Disclosed
What happened
- Exploited as a zero-day by Lazarus. August Patch Tuesday, about 400 CVEs. In KEV.
- A CISA emergency directive on this is reported by one blog only: UNVERIFIED.
Live scores
Live scores
CVE-2026-68820- EPSS
- 0.086
some chance of attack soon - VEDAS
- 0.531
some exploit evidence - On CISA KEV
- Yes, since 2026-08-11
- Detection rule
- Out of scope (local)
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
- https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.