Patch afd.sys First, Argue About the Other 397 Later

Depending on who's counting, Microsoft's August Patch Tuesday fixed 398 CVEs (Tenable's tally of the day-of drop), 400 (BleepingComputer's), or 421 (SecurityWeek's, which folds in fixes shipped earlier in the month for Azure, Teams, and Office, plus two bugs in the TPM 2.0 reference implementation). It's one of the largest Patch Tuesdays Microsoft has ever shipped. And almost none of that volume matters compared to one seven-out-of-ten bug.

CVE-2026-68820 is a use-after-free in afd.sys — the Ancillary Function Driver for WinSock, the kernel-mode plumbing underneath the Windows Sockets API. An attacker who already has code running on a machine can win a race condition in the driver and come out the other side as SYSTEM. Microsoft confirmed active exploitation, and Check Point attributes the attacks to Lazarus, North Korea's flagship intrusion crew, who used it to load a new build of FudModule, their kernel-mode rootkit.

If that sentence gives you déjà vu, it should.

The same driver, the same rootkit, two years later

In August 2024, Microsoft patched CVE-2024-38193 — a use-after-free in afd.sys, exploited as a zero-day by Lazarus, to install FudModule. Swap the CVE number and you've written this month's advisory. Tenable's Satnam Narang points out that afd.sys zero-days have been turning up in nation-state hands for years, and the driver had already produced CVE-2023-21768, an escalation bug whose public exploit became a staple of post-compromise toolkits within weeks of the patch.

The FudModule arc is the more telling one. Lazarus originally loaded it the classic way: bring-your-own-vulnerable-driver, using a buggy Dell driver as the kernel doorway. When Microsoft's vulnerable-driver blocklist made BYOVD less reliable, they moved to burning zero-days in drivers Windows ships in the box — appid.sys in early 2024, then afd.sys, now afd.sys again. That's not opportunism; that's a supply line. A group that can produce a fresh kernel use-after-free in the same driver roughly every two years has told you something about how much exploitable surface is left in it.

And afd.sys is a plausible place for that surface to live. It's decades-old C, it's reachable from any unprivileged user-mode process that touches a socket — which is every process worth compromising — and it juggles object lifetimes across async I/O paths. That's the exact recipe for race-condition use-after-frees, and it's why the driver keeps showing up in escalation chains while flashier components get the headlines.

Why "CVSS 7.0, Important" undersells it

Microsoft rated this bug Important, not Critical, and the 7.0 score reflects that exploitation requires local code execution first. On paper that's fair. In practice it inverts the real risk ordering, because for the people Lazarus targets, initial code execution is the cheap part.

This crew has spent years going after developers specifically: fake recruiter lures with trojanized "coding assessments," malicious npm and PyPI packages, poisoned GitHub projects. The Check Point attribution ties this campaign to Operation Dream Job, which is precisely that playbook. A developer workstation runs untrusted code dozens of times a day — npm install, a cloned repo's build script, a marketplace extension. Any of those is the "authorized attacker" the advisory politely presumes. CVE-2026-68820 is the step that converts that everyday exposure into SYSTEM, and SYSTEM is where FudModule lives — cutting kernel callbacks and blinding ETW so your EDR agent keeps running but stops seeing.

So the honest developer-facing read is: the bug's severity score describes the exploit's preconditions, and your daily workflow satisfies them.

What to actually do this week

Priority one is boring and absolute: get the cumulative update onto every Windows machine, because afd.sys ships on all of them. Dev workstations and build agents first — they're the machines that execute untrusted code professionally, and CI runners with SYSTEM-level implants are a supply-chain incident, not an endpoint incident. If you manage patch rings through Intune or WSUS, this is the month to use the expedite path rather than the normal deferral window.

For infrastructure, four unauthenticated remote-code-execution bugs scored 9.8. The one to lose sleep over is CVE-2026-62878, a stack buffer overflow in Windows DNS Server that the Zero Day Initiative calls wormable — if you run Microsoft DNS on domain controllers, that patches alongside afd.sys, not after it. CVE-2026-62893 hits the TFTP handling in Windows Deployment Services (Tenable rates exploitation "more likely"; also ask yourself whether WDS should be reachable at all), CVE-2026-62815 hits Microsoft QUIC, and an 8.8 heap overflow in DHCP Server (CVE-2026-62823) rounds out the server-side worry list.

One subtle trap: SharePoint. August's CVE-2026-63520 is the second half of an exploit chain that started with July's CVE-2026-55040 auth bypass. If you patched on-prem SharePoint last month and considered it handled, you're half-patched against a chain Rapid7 saw exploited back in May. Apply both.

Two more zero-days were publicly disclosed but not yet exploited — CVE-2026-62832 in the User Profile Service (the "LegacyHive" bug) and CVE-2026-72971 in the container-isolation filter driver unionfs.sys. Disclosed-with-details bugs rarely stay theoretical long.

The pattern is the story

Microsoft's long-term kernel bets — HVCI, the driver blocklist, admin protection in Windows 11, Rust creeping into kernel components — are real, and the blocklist demonstrably forced Lazarus into more expensive tradecraft. But afd.sys getting exploited twice in two years by the same actor for the same rootkit says the legacy driver surface is being hardened slower than well-funded attackers can mine it. Until that changes, the rational assumption for anyone whose job involves running other people's code is that kernel escalation on Windows is a solved problem for the adversary. Four hundred patches is noise. One driver is the signal — patch it first.