Microsoft Patches 421 Flaws — Lazarus Group Already Exploited One as a Windows Zero-Day

Microsoft’s August 2026 Patch Tuesday fixed 421 CVEs, and one of them was already a live weapon in North Korean hands. CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys), carries a CVSS score of 7.0 — moderate on paper, but Lazarus Group had been exploiting it in the wild for roughly five weeks before the patch shipped, according to Bleeping Computer and SecurityWeek. CISA added it to its Known Exploited Vulnerabilities catalog and gave federal agencies a two-week patch deadline.

The bug sits in a core kernel driver that handles socket operations under the Windows Sockets API. Under a specific race condition, one thread frees a memory object while another thread is still accessing it — classic use-after-free memory corruption, weaponizable into a kernel read/write primitive and, from there, SYSTEM privileges. Exploitation requires local code execution first, which is exactly what Lazarus supplied: posing as recruiters on professional networking platforms, the group convinced targets in the defense, aerospace, and aviation sectors across Europe and India to download a malicious payload, then used the AFD.sys flaw to escalate once inside.

That’s a privilege-escalation chain, not an initial-access exploit — the social engineering got Lazarus onto the box, CVE-2026-68820 got them SYSTEM. It’s a reminder that CVSS scores measure technical severity, not real-world impact. A 7.0 EoP bug chained with a phishing lure is exactly how state-sponsored actors have breached defense contractors for years, and it’s more dangerous in practice than several of the CVSS-9+ bugs in the same patch batch that nobody has exploited yet.

Two of those higher-severity bugs are worth flagging on their own. CVE-2026-62878 is a remote code execution flaw in Windows DNS Server scoring 9.8 — no user interaction required, which makes any exposed DNS server a target the moment a public exploit surfaces. CVE-2026-63520, a high-severity SharePoint RCE, becomes a critical unauthenticated RCE when chained with CVE-2026-55040, the classic pattern of two medium bugs combining into something worse than either alone. Neither is confirmed exploited yet, but both are now public knowledge, which starts the clock.

What to do: Patch CVE-2026-68820 immediately if you run defense, aerospace, or aviation infrastructure, or any environment where credential phishing is a live threat — it’s confirmed exploited. Prioritize CVE-2026-62878 on any internet-facing DNS Server deployment. If you run SharePoint Server, patch both CVE-2026-63520 and CVE-2026-55040 together — patching one without the other still leaves the chain intact. Full details and KB numbers are in Microsoft’s August 2026 Patch Tuesday release notes.

Sources

• August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day
• Lazarus hackers exploited Windows zero-day to target defense firms
• Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)