Lazarus Had Your Windows Kernel for 5 Weeks — Patch Tuesday Fixed It

Microsoft's August 2026 Patch Tuesday landed Monday with 398 security updates — including one zero-day that North Korea's Lazarus Group had already been exploiting for five weeks before anyone outside that group knew it existed. Two vulnerabilities on this month's list demand same-day attention regardless of your patching schedule.

Five Weeks of Free Access (CVE-2026-68820)

The headline vulnerability this month is CVE-2026-68820, a use-after-free flaw in afd.sys — the Windows Ancillary Function Driver that serves as the kernel-mode backbone for the Windows Sockets API. When concurrent threads access the same socket and one code path reads memory that another has already freed, an attacker with code already running on the machine can trigger a race condition that hands them a kernel read/write primitive and, from there, SYSTEM-level privileges.

Check Point Research discovered the flaw and reported it to Microsoft on July 28. Microsoft confirmed it July 31, assigned the CVE on August 5, and shipped the fix August 11. Clean response — except that a compiled FudModule rootkit artifact found in the wild carries a build timestamp of July 7. Lazarus had a working exploit and was deploying it at least three weeks before Check Point found it, and five weeks before the patch existed.

The campaign is a new iteration of what researchers call Operation Dream Job: fake LinkedIn recruiter outreach, a ZIP archive containing a legitimate PDF viewer and a malicious DLL that silently loads alongside it, and a second chain routing targets to a convincing lookalike site for Enveil (a real privacy-technology company) to download a trojanized PDF viewer. Either infection path drops MISTPEN, an in-memory downloader that communicates through Microsoft OneDrive while awaiting instructions.

MISTPEN's final payload is FudModule v3.1, Lazarus's kernel-mode rootkit. Compared to prior versions, this iteration adds Smart App Control tampering — resetting its reputable-policy state to silence the OS-level trust signal — while replacing Defender- and AhnLab-specific bypasses with a generic security-product suppression engine. Behind FudModule comes ForestTiger, a persistent backdoor that gives the group long-term remote access once the EDR stack has been blinded.

Confirmed targets sit in the defense, aerospace, and aviation sectors, with intrusions documented in Western Europe and India. CVE-2026-68820 scores CVSS 7.0 because exploitation requires local code execution first — but that score understates the operational impact. A rootkit that disables your endpoint telemetry before your SOC sees anything is a different class of problem than a plain privilege escalation. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11 with a two-week federal patch deadline.

A CVSS 9.8 DNS Flaw That Could Spread on Its Own (CVE-2026-62878)

If the Lazarus story is the month's most alarming, CVE-2026-62878 may be the most operationally dangerous for businesses running their own DNS infrastructure. This is a stack-based buffer overflow in Windows DNS Server. CVSS 9.8. No authentication. No user interaction. An unauthenticated attacker on the network sends a specially crafted packet and achieves remote code execution at elevated privilege — no credentials, no click required.

Microsoft specifically characterizes this one as potentially wormable, meaning a working exploit could propagate automatically from one unpatched DNS server to the next without a human in the loop. The last time Microsoft attached that word to a DNS flaw was CVE-2020-1350 (SIGRed) in 2020; proof-of-concept code was public within days of that disclosure, and that patch priority held.

The highest-risk configurations are:

• Windows DNS Servers directly internet-facing — the obvious target, most immediately reachable
• DNS resolvers serving remote sites over VPN — reachable from a wider attacker surface than you may assume
• Domain controllers with DNS co-hosted — the most common SMB configuration, and the most dangerous if compromised, because remote code execution on that box is full Active Directory exposure

There is no workaround for CVE-2026-62878. The update is the only fix.

The Rest of the Priority List

Three other CVSS 9.8 RCEs ship this month, all unauthenticated and requiring no user interaction. CVE-2026-62893 is a remote code execution flaw in Windows Deployment Services through its TFTP handler. CVE-2026-62815 hits Microsoft's QUIC Protocol implementation. Both are less likely to be internet-facing in a typical SMB environment, but should be patched promptly.

On-premises SharePoint admins face a two-part fix: CVE-2026-55040 (July, CVSS 9.1 authentication bypass) and CVE-2026-63520 (this month, the RCE component that completes the chain) together enable unauthenticated remote code execution against SharePoint farms. Either patch alone is insufficient — both are required to close the chain. Check your farm version before assuming auto-update handled it.

What to Do Right Now

Prioritization this month is straightforward:

• All Windows systems: Install KB5121003 (Windows 11 24H2/25H2) or KB5120249 (Windows 10 22H2) today. CISA's two-week deadline for federal agencies translates to "end of day" for anyone in a risk-conscious environment.
• DNS servers: Patch immediately, prioritizing any co-located with a domain controller or reachable from outside the LAN. No workaround exists — only the update closes the hole.
• SharePoint farms: Confirm both the July and August cumulative updates are installed. Run a version check; don't rely on memory.
• WDS/PXE infrastructure: Verify whether Windows Deployment Services is running on any box and update those systems (CVE-2026-62893).
• Defense and aerospace contractors: Run a full sweep for FudModule and ForestTiger indicators of compromise. Check Point Research published IOCs alongside their technical write-up, available at research.checkpoint.com.

The Lazarus timeline is worth sitting with: five weeks elapsed between the first known use of CVE-2026-68820 and the patch. In that window, a kernel-mode rootkit was turning off endpoint visibility on compromised machines before defenders could see what was happening. That gap — between first exploitation and public knowledge — is exactly what 24x7x365 NOC monitoring is built to narrow, detecting anomalous kernel-level behavior before a rootkit has had time to blind the rest of the stack.

August is a heavy Patch Tuesday. Treat it like one.