Microsoft patched a Windows zero-day North Korean attackers were already using

Microsoft's August 2026 Patch Tuesday fixed 421 vulnerabilities, and one of them was already being used. CVE-2026-68820 is a flaw in AFD.sys, the Windows kernel driver that sits behind the Windows Sockets API, and it let an attacker who already had a foothold on a machine escalate all the way to SYSTEM — the highest privilege level Windows has. Both outlets we checked attribute the exploitation to North Korean attackers, in a campaign named Operation Dream Job.

What the flaw actually does

AFD.sys is not an obscure component. It is the Ancillary Function Driver for WinSock, the kernel-mode driver underneath essentially every network socket a Windows application opens. The bug is a use-after-free — memory that has been released but is still referenced — and Help Net Security describes the trigger as "a locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition."

(what "local" means, because it gets misread) "Local" makes this sound minor. It is not, and it is worth being precise about why. It means the attacker must already be able to run code on the machine as some user — through a phishing payload, a malicious installer, or a compromised account. That is the first half of most real intrusions, and it is the easier half. A privilege-escalation flaw is what turns that foothold into ownership of the box: from one user's files to every user's, from a process you could kill to a kernel rootkit you cannot see. Both sources report that a kernel-mode rootkit was deployed through this one.

Who was using it

The flaw was reported by researchers at Check Point, and both SecurityWeek and Help Net Security attribute the exploitation to North Korean attackers operating under the long-running Operation Dream Job campaign — a social-engineering effort built around fake job offers aimed at people with access worth having.

(what we are not asserting) Other outlets have reported further specifics: a CVSS score of 7.0, the actor named as the Lazarus Group, the payloads identified as the FudModule rootkit and a ForestTiger backdoor, defence-sector companies as the targets, and a precise disclosure timeline. We could not load Check Point's own writeup, and none of that appears in either source we did read, so we are reporting it as circulating rather than confirmed. The attribution to North Korea and to Operation Dream Job is in both.

421 fixes in one month

The headline number deserves a note. 421 CVEs in a single Patch Tuesday is a very large batch — Help Net Security rounds it to "400+" — and the volume is itself the story for anyone managing more than a handful of machines. Most of those 421 are not being exploited and never will be. Exactly one of them was already in active use, which is the argument for patching on a schedule rather than triaging each advisory on its apparent severity: the one that matters is not reliably the one that looks worst on paper.