{"id":"windows-lazarus-fudmodule-zero-day-aug-2026","category":"patch","status":"live","title":"Windows zero-day CVE-2026-68820 fixed after Lazarus used it to deploy FudModule rootkit","tldr":"Lazarus used a Windows flaw to turn an existing foothold into SYSTEM-level control and hide malware. Microsoft released fixes on 11 August. Install current Windows updates; defence-sector staff should also report suspicious recruitment downloads to IT.","summary":"CVE-2026-68820 is a memory-handling flaw in AFD.sys, a Windows component that handles network connections. An attacker already running code with limited permissions can use it to gain SYSTEM privileges. Check Point found North Korea-linked Lazarus exploiting it from at least early July in Operation Dream Job, which used fraudulent recruitment offers against defence, aerospace and aviation organisations, particularly in Europe and India. The researchers confirmed the exploit worked on Windows 11 systems fully updated before the fix. Attackers used it to deploy FudModule, malware that interferes with security monitoring. Microsoft released fixes on 11 August; its affected-product list also includes Windows 10 and Windows Server. CISA listed the flaw as exploited that day. Microsoft's CVE record was last updated on 30 October. The reviewed sources do not establish that the campaign has ended or that compromised machines have been cleaned.","action":"Open Windows Update, install all available security updates and restart when asked; the fixed builds for each affected release are listed below. For a work computer, ask IT to confirm CVE-2026-68820 is patched. If you installed software supplied through an unexpected recruitment approach, contact IT or a trusted security professional to check the computer for compromise.","product":"Microsoft Windows 10, Windows 11 and Windows Server","audience":"both","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-68820"],"tags":["microsoft","windows","zero-day","lazarus","rootkit","privilege-escalation"],"affected":["Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9418","Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9121","Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7663","Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7663","Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7517","Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9168","Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9168","Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.2704","Windows Server 2012, including Server Core: 6.2.9200.0 to before 6.2.9200.26280","Windows Server 2012 R2, including Server Core: 6.3.9600.0 to before 6.3.9600.23338","Windows Server 2016, including Server Core: 10.0.14393.0 to before 10.0.14393.9418","Windows Server 2019, including Server Core: 10.0.17763.0 to before 10.0.17763.9121","Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5499","Windows Server 2025, including Server Core: 10.0.26100.0 to before 10.0.26100.33296"],"fixed":["Windows 10 Version 1607: 10.0.14393.9418","Windows 10 Version 1809: 10.0.17763.9121","Windows 10 Version 21H2: 10.0.19044.7663","Windows 10 Version 22H2: 10.0.19045.7663","Windows 11 Version 23H2: 10.0.22631.7517","Windows 11 Version 24H2: 10.0.26100.9168","Windows 11 Version 25H2: 10.0.26200.9168","Windows 11 version 26H1: 10.0.28000.2704","Windows Server 2012, including Server Core: 6.2.9200.26280","Windows Server 2012 R2, including Server Core: 6.3.9600.23338","Windows Server 2016, including Server Core: 10.0.14393.9418","Windows Server 2019, including Server Core: 10.0.17763.9121","Windows Server 2022: 10.0.20348.5499","Windows Server 2025, including Server Core: 10.0.26100.33296"],"matches":[{"platform":"windows","app":"Windows 10 Version 1607","bundle":"","fixed":"10.0.14393.9418"},{"platform":"windows","app":"Windows 10 Version 1809","bundle":"","fixed":"10.0.17763.9121"},{"platform":"windows","app":"Windows 10 Version 21H2","bundle":"","fixed":"10.0.19044.7663"},{"platform":"windows","app":"Windows 10 Version 22H2","bundle":"","fixed":"10.0.19045.7663"},{"platform":"windows","app":"Windows 11 Version 23H2","bundle":"","fixed":"10.0.22631.7517"},{"platform":"windows","app":"Windows 11 Version 24H2","bundle":"","fixed":"10.0.26100.9168"},{"platform":"windows","app":"Windows 11 Version 25H2","bundle":"","fixed":"10.0.26200.9168"},{"platform":"windows","app":"Windows 11 version 26H1","bundle":"","fixed":"10.0.28000.2704"}],"sources":[{"kind":"advisory","title":"Microsoft CVE record: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68820.json","by":"Microsoft","date":"2026-10-30"},{"kind":"research","title":"Shattering the Dream – When a Job Offer Becomes a Zero-Day Attack","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/","by":"Check Point Research","date":"2026-08-11"},{"kind":"news","title":"Lazarus hackers exploited Windows zero-day to target defense firms","url":"https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/?trk=article-ssr-frontend-pulse_little-text-block","by":"BleepingComputer","date":"2026-08-12"},{"kind":"advisory","title":"CVE-2026-68820: Microsoft CVE record and CISA exploitation listing","url":"https://vulnerability.circl.lu/vuln/cve-2026-68820","by":"CIRCL Vulnerability-Lookup","date":"2026-09-29"}],"started":"2026-08-11","closed":null,"created":"2026-11-03T21:14:59.549Z","updated":"2026-11-03T21:14:59.549Z","cve_notes":[{"cve":"CVE-2026-68820","name":"Use-after-free in Windows AFD.sys driver","what":"Windows' AFD.sys networking driver can access memory after it has been freed, allowing an attacker with an existing local foothold to gain SYSTEM privileges.","severity":"high","cvss":7}],"timeline":[{"at":"2026-10-30T17:21Z","added":"2026-11-03T21:11:13.172Z","kind":"vendor-revised","text":"Microsoft updated its published CVE record. Its current affected-version list covers Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025, with fixed-build boundaries for each.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68820.json","by":"Microsoft","patch":null},{"at":"2026-08-12","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"BleepingComputer reported that the observed FudModule variant supported Windows 11 builds 26100 and 26200 and interfered with security monitoring.","url":"https://www.bleepingcomputer.com/news/security/lazarus-hackers-exploited-windows-zero-day-to-target-defense-firms/?trk=article-ssr-frontend-pulse_little-text-block","by":"BleepingComputer","patch":null},{"at":"2026-08-11","added":"2026-11-03T21:11:13.172Z","kind":"cisa-added","text":"CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.","url":"https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/68xxx/CVE-2026-68820.json","by":"CISA, via the CVE Program","patch":null},{"at":"2026-08-11","added":"2026-11-03T21:11:13.172Z","kind":"new-fix","text":"Microsoft released the fix in its August security updates. Check Point publicly linked CVE-2026-68820 to Lazarus attacks deploying the FudModule rootkit.","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/","by":"Check Point Research","patch":"patched"},{"at":"2026-07-31","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Microsoft confirmed the vulnerability, according to Check Point's disclosure timeline.","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/","by":"Check Point Research","patch":null},{"at":"2026-07-28","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Check Point reported the Windows AFD.sys flaw to Microsoft. Its investigation found Lazarus exploiting it since at least early July.","url":"https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/","by":"Check Point Research","patch":"none"}],"url":"https://hard.fyi/live/windows-lazarus-fudmodule-zero-day-aug-2026/","json":"https://hard.fyi/api/live?id=windows-lazarus-fudmodule-zero-day-aug-2026"}