NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksUpdated

Windows zero-day CVE-2026-68820 fixed after Lazarus used it to deploy FudModule rootkit

Lazarus used a Windows flaw to turn an existing foothold into SYSTEM-level control and hide malware. Microsoft released fixes on 11 August. Install current Windows updates; defence-sector staff should also report suspicious recruitment downloads to IT.

What to do

Open Windows Update, install all available security updates and restart when asked; the fixed builds for each affected release are listed below. For a work computer, ask IT to confirm CVE-2026-68820 is patched. If you installed software supplied through an unexpected recruitment approach, contact IT or a trusted security professional to check the computer for compromise.

Check your devices
  • Windows 10 Version 1607fixed in 10.0.14393.9418 and later
  • Windows 10 Version 1809fixed in 10.0.17763.9121 and later
  • Windows 10 Version 21H2fixed in 10.0.19044.7663 and later
  • Windows 10 Version 22H2fixed in 10.0.19045.7663 and later
  • Windows 11 Version 23H2fixed in 10.0.22631.7517 and later
  • Windows 11 Version 24H2fixed in 10.0.26100.9168 and later
  • Windows 11 Version 25H2fixed in 10.0.26200.9168 and later
  • Windows 11 version 26H1fixed in 10.0.28000.2704 and later

What’s happening

CVE-2026-68820 is a memory-handling flaw in AFD.sys, a Windows component that handles network connections. An attacker already running code with limited permissions can use it to gain SYSTEM privileges. Check Point found North Korea-linked Lazarus exploiting it from at least early July in Operation Dream Job, which used fraudulent recruitment offers against defence, aerospace and aviation organisations, particularly in Europe and India. The researchers confirmed the exploit worked on Windows 11 systems fully updated before the fix. Attackers used it to deploy FudModule, malware that interferes with security monitoring. Microsoft released fixes on 11 August; its affected-product list also includes Windows 10 and Windows Server. CISA listed the flaw as exploited that day. Microsoft's CVE record was last updated on 30 October. The reviewed sources do not establish that the campaign has ended or that compromised machines have been cleaned.

What
Flaw
Affects
Microsoft Windows 10, Windows 11 and Windows Server
Affected
Windows 10 Version 1607: 10.0.14393.0 to before 10.0.14393.9418
Windows 10 Version 1809: 10.0.17763.0 to before 10.0.17763.9121
Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7663
Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7663
Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7517
Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9168
Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9168
Windows 11 version 26H1: 10.0.28000.0 to before 10.0.28000.2704
Windows Server 2012, including Server Core: 6.2.9200.0 to before 6.2.9200.26280
Windows Server 2012 R2, including Server Core: 6.3.9600.0 to before 6.3.9600.23338
Windows Server 2016, including Server Core: 10.0.14393.0 to before 10.0.14393.9418
Windows Server 2019, including Server Core: 10.0.17763.0 to before 10.0.17763.9121
Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5499
Windows Server 2025, including Server Core: 10.0.26100.0 to before 10.0.26100.33296
Fixed in
Windows 10 Version 1607: 10.0.14393.9418
Windows 10 Version 1809: 10.0.17763.9121
Windows 10 Version 21H2: 10.0.19044.7663
Windows 10 Version 22H2: 10.0.19045.7663
Windows 11 Version 23H2: 10.0.22631.7517
Windows 11 Version 24H2: 10.0.26100.9168
Windows 11 Version 25H2: 10.0.26200.9168
Windows 11 version 26H1: 10.0.28000.2704
Windows Server 2012, including Server Core: 6.2.9200.26280
Windows Server 2012 R2, including Server Core: 6.3.9600.23338
Windows Server 2016, including Server Core: 10.0.14393.9418
Windows Server 2019, including Server Core: 10.0.17763.9121
Windows Server 2022: 10.0.20348.5499
Windows Server 2025, including Server Core: 10.0.26100.33296
CVE
CVE-2026-68820
Since
11 Aug 2026

Timeline

  1. Vendor revised

    Microsoft updated its published CVE record. Its current affected-version list covers Windows 10, Windows 11 through 26H1, and Windows Server 2012 through 2025, with fixed-build boundaries for each.

  2. Update

    BleepingComputer reported that the observed FudModule variant supported Windows 11 builds 26100 and 26200 and interfered with security monitoring.

  3. CISA added

    CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks.

  4. New fixFixed

    Microsoft released the fix in its August security updates. Check Point publicly linked CVE-2026-68820 to Lazarus attacks deploying the FudModule rootkit.

  5. Update

    Microsoft confirmed the vulnerability, according to Check Point's disclosure timeline.

  6. UpdateNo fix yet

    Check Point reported the Windows AFD.sys flaw to Microsoft. Its investigation found Lazarus exploiting it since at least early July.

Sources

  1. Microsoft CVE record: Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft · 30 Oct 2026
  2. Shattering the Dream – When a Job Offer Becomes a Zero-Day AttackCheck Point Research · 11 Aug 2026
  3. Lazarus hackers exploited Windows zero-day to target defense firmsBleepingComputer · 12 Aug 2026
  4. CVE-2026-68820: Microsoft CVE record and CISA exploitation listingCIRCL Vulnerability-Lookup · 29 Sept 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from August 2026 · JSON · RSS