Microsoft on August’s Patch Tuesday fixed more than 400 known vulnerabilities. The number of vulnerabilities is lower than the 657 vulnerabilities that were fixed last month. Among these 400 fixes, close to 176 fixes were to address escalation of privilege flaws, and 110 were fixes for remote code execution vulnerabilities.
The burning question is ‘Which patches should you prioritize?’
However, for cybersecurity teams, the number is of less importance when compared to the exposure and exploitability of these vulnerabilities within your organization. A known, actively exploited vulnerability on endpoints must be fixed with much more urgency than some flaw which might affect a small fraction of systems in an isolated environment.
CVE-2026-68820
One of most exploited flaws that was patched this cycle was CVE-2026-68820. This flaw was in an ancillary function driver in the Windows utility WinSock and is commonly referred to as afd.sys kernel driver.
The vulnerability was classified as a use-after-free flaw. Basically, the function kept pointing to a section of memory even after that memory section was released. This allowed malicious manipulation of the reused memory to change how the program is executed.
To leverage this vulnerability, the attacker doesn’t have to provide any other input apart from executing the malicious program as a locally authenticated user with basic permissions or standard user privileges. This app would then leverage the vulnerability in the kernel driver to gain SYTEM privileges, the highest permission anyone can have on an endpoint.
Why this Vulnerability Concerns You?
Privilege Escalation is the second step of a cyberattack which an attacker uses after the initial compromise of an endpoint. Initial access can be gained with methods like phishing, malicious PDFs, browser exploitation, and compromised credentials.
For example, let's analyze how this vulnerability was repeatedly and successfully exploited in the Dream Job attacks.
Anatomy of an Attack: How Lazarus Exploited CVE-2026-68820
By combining social engineering tactics with advanced zero-day exploitation, North Korea’s Lazarus Group turned a simple recruitment lure into total endpoint compromise. The attack chain relies on moving seamlessly from initial, low-privilege access to complete kernel control.
1.Social Engineering & Phishing Lure
Attackers pose as recruiters on professional networking platforms, targeting employees with lucrative job opportunities. Targets receive a ZIP archive containing three items: a legitimately signed binary named SecurityPDF.exe, a malicious DLL, and an encrypted PDF payload.
2.DLL Side-Loading
When the victim opens the trusted SecurityPDF application, it unwittingly side-loads the malicious local DLL. Because the host executable is legitimate and digitally signed, local security controls fail to flag the initial startup.
3.In-Memory Execution & Decoy Display
The hijacked DLL extracts and decrypts the payload hidden inside the PDF file, executing it directly in system memory (fileless execution). To avoid raising suspicion, a harmless decoy document opens simultaneously in the foreground.
4.Reconnaissance & Persistence Setup
Once running, the executable performs environment checks to ensure it isn't running in a sandbox or security researcher's analysis environment. It then establishes persistence by modifying registry settings to launch automatically on every system reboot.
5.Kernel Exploitation & Rootkit Deployment
With basic access secured, the malware targets the zero-day use-after-free vulnerability (CVE-2026-68820) in the Windows Ancillary Function Driver (afd.sys). Exploiting this flaw escalates permissions straight to SYSTEM privileges, allowing the attackers to deploy FudModule - a sophisticated kernel-mode rootkit designed to blind EDR tools and blindside security telemetry.
This attack highlights how threat actors use social engineering to gain basic access to endpoints and leverage zero-day vulnerabilities to escalate privileges and gain complete control over the machine.
What should you do?
You must install the Patch immediately. Knowingly allowing known and actively exploited vulnerabilities to exist in the organization is extremely risky.
Perpetrators of the Operation Dream Job targeted software developers and technical staff within crypto companies and defense organizations to gain access to valuable systems. So, prioritizing these at-risk endpoints and users for deploying the patch is advisable.
Just deploying the patch will not evict intruders who are inside the system. Scan and analyze logs on existing endpoints for signs of compromise. Ensure your EDR solutions are running appropriately.
How Least Privilege and Granular Application Control Would Have Helped?
While least privilege and application control doesn’t entirely prevent all zero-day vulnerability exploits that manipulate kernel level flaws to gain SYSTEM privileges, it would have helped neutralize some attack vectors used in this attack specifically.
If a robust allowlisting policy was deployed and enforced at the endpoint, the PDF reader would not have been executed at all. Since the tool was downloaded by the user, it would not have been given explicit trust by the administrator beforehand, and therefore its execution would have been blocked, nipping the attacks in the bud.
