Windows AFD.sys CVE-2026-68820: Exploited Zero-Day EoP

What to do

1. Confirm every Windows host runs the August 11, 2026 cumulative update or later; the fixed build numbers per version are in the Microsoft advisory.
2. Patch stragglers first where users open outside documents, job offers or PDF viewers, then servers where many users can run code.
3. Block and hunt for the Check Point indicators: envell[.]xyz, enveil[.]online, uxtramine[.]org, 135.181.67[.]203 and 135.181.185[.]158.
4. Treat any host with signs of this chain as fully compromised: a kernel rootkit was used to blind security tools, so rebuild rather than clean.
5. Remind staff that unsolicited job offers with attached PDF viewers or archives are a known Lazarus lure.

How to check if you are affected or compromised

• Check the build: Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, and compare with the fixed builds.
• Search EDR and file telemetry for Afd4Eop12_x64.dll, SecurityPDF.exe, a sideloaded libmupdf.dll next to a PDF viewer, and %TEMP%\new.exe.
• Search DNS, proxy and firewall logs for the domains and IP addresses Check Point published for this campaign.
• Look for EDR sensors that stopped reporting or Smart App Control that was switched off without an admin change, which match the FudModule v3.1 behavior Check Point describes.

What happened#

On August 11, 2026, Microsoft's Patch Tuesday fixed CVE-2026-68820, a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock, afd.sys. This kernel driver sits under Windows Sockets. A user who can already run code on a machine can use the bug to gain SYSTEM privileges. Microsoft rates it Important, CVSS 3.1 7.0. Attack complexity is high: Microsoft says exploitation "requires an attacker to win a race condition." No user interaction is needed. Microsoft marked it "Exploitation Detected". It was not publicly disclosed before the fix.

Microsoft credits David Driker and Moshe Marelus of Check Point. Check Point Research published its analysis the same day. It tied the exploit to Operation Dream Job, a fake-job-offer campaign it calls "affiliated to DPRK-linked Lazarus group". In the latest wave, victims got lures such as a decoy Lockheed Martin job description, delivered through a sideloaded libmupdf.dll, or a trojanized "SecurityPDF" viewer posing as the company Enveil. The MISTPEN in-memory downloader then loaded an exploit module, Afd4Eop12_x64.dll, which was compiled on July 7, 2026. With SYSTEM rights, the attackers ran FudModule v3.1, a kernel rootkit that blinds security products and tampers with Smart App Control, and then installed the ForestTiger backdoor. Check Point says the zero-day was in use "since at least early July 2026". It is withholding full technical details. CISA added the CVE to the KEV catalog on August 11, with a federal due date of August 25.

Who is affected#

Every supported Windows client and server line is listed in the CVE record. That covers Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1, and Windows Server 2012 through 2025. Builds below the fixed ones are vulnerable, for example 26100.9168 for Windows 11 24H2, 19045.7663 for Windows 10 22H2 and 20348.5499 for Server 2022. The August packages include KB5121003 for Windows 11 24H2/25H2, KB5120240 for 23H2, KB5120249 for Windows 10 (an extended security update, per BleepingComputer), KB5120242 for Server 2022 and KB5120233 for Server 2025. Check Point notes that the FudModule version it saw targets only Windows 11 builds 26100 and 26200. The vulnerability itself is wider than that.

Do you really need to act?#

Yes, but this is a second-stage bug. An attacker needs code running on the box first, such as a malicious document, a trojanized tool or a stolen login. What makes it serious is what comes next: SYSTEM, a kernel rootkit and blinded EDR. Tenable lists three earlier exploited zero-days in this driver: CVE-2024-38193, CVE-2025-21418 and CVE-2025-32709. This is a component attackers keep coming back to.

The fix is now ten weeks old. Cumulative updates include earlier fixes, so September and October 2026 updates also cover it. The real job is finding machines that missed patching: laptops off the network, servers with paused updates, and golden images. This Lazarus wave went after defense, aerospace and drone-sector organizations in Europe, India and South America. Other attackers can reuse a working local exploit.

What to do now#

1. Check the build on each host with Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select CurrentBuild, UBR, or use your patch tool's report, and compare with the advisory.
2. Install the August 11, 2026 update or any later cumulative update. Start with staff who handle outside documents and with shared or multi-user servers.
3. Block the published infrastructure at DNS and the proxy: envell[.]xyz, enveil[.]online, uxtramine[.]org, 135.181.67[.]203, 135.181.185[.]158.
4. Rebuild any host that shows signs of this chain. A kernel rootkit can hide from the tools you would use to clean it.

How to tell if you were hit#

Hunt for the file names Check Point lists: Afd4Eop12_x64.dll, SecurityPDF.exe, a libmupdf.dll loaded by a signed PDF viewer from a downloaded archive, and %TEMP%\new.exe. Match the full hash list in Check Point's report against EDR telemetry. Search DNS and proxy logs for the domains and IPs above. Also check for EDR agents that stopped reporting on otherwise healthy machines, or Smart App Control switched off with no admin change. FudModule is built to cause exactly these gaps. Microsoft has not published its own indicators.

Timeline#

• Jul 7, 2026 — Compile timestamp of the exploit module Check Point recovered.
• Jul 28, 2026 — Check Point reports the bug to MSRC. Microsoft confirms it on July 31.
• Aug 11, 2026 — Microsoft ships fixes and marks the bug exploited. Check Point publishes its research. CISA adds it to KEV.
• Aug 25, 2026 — CISA's remediation deadline for federal agencies.

Vulnerability records

• CVE-2026-68820 · KEV 2026-08-11 · Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Microsoft MSRC — CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability msrc.microsoft.com
2. Microsoft MSRC — August 2026 Security Updates (CVRF data with KB numbers and acknowledgments) api.msrc.microsoft.com
3. CVE record — CVE-2026-68820 cve.org
4. NVD — CVE-2026-68820 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-68820 cisa.gov
6. Check Point Research — Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack research.checkpoint.com
7. Tenable — Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820) tenable.com

Coverage and analysis

1. BleepingComputer — Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days bleepingcomputer.com
2. Help Net Security — Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820) helpnetsecurity.com