One exploited flaw in a very large stack
Microsoft's August 2026 Patch Tuesday landed with 398 CVE fixes, 62 of them rated critical, a batch large enough that most enterprise patch management teams will be triaging for days. Buried inside it is CVE-2026-68820, a use-after-free vulnerability in afd.sys, the Ancillary Function Driver that handles low-level WinSock networking calls on every supported version of Windows. Microsoft confirms it is under active exploitation, and Check Point Research has tied that exploitation to Lazarus, the North Korea-linked group best known for its Operation Dream Job campaign targeting engineering, defense and cryptocurrency personnel with fake recruiter outreach.
The CVSS score on this one, 7.0, undersells its operational importance. It is not the flashiest bug in the release relative to the four unauthenticated 9.8-rated remote-code-execution flaws shipping in the same batch, covering Windows DNS Server, Windows Deployment Services, Microsoft QUIC and HPC Pack. But it is the one with confirmed real-world exploitation attached to a named, well-resourced threat actor, and that combination should move it to the top of any rational patch-priority list regardless of the raw severity number.
What the vulnerability actually does
AFD.sys sits deep in the Windows networking stack, translating WinSock API calls from user-mode applications into kernel operations. A use-after-free bug there means an attacker who already has code execution on a machine, even at low privilege, can manipulate the driver's memory handling to escalate to SYSTEM. That is the key detail: this is not an initial-access vulnerability. It requires the attacker to already be on the box, running as a limited user, before this flaw does anything useful for them.
That makes it a force multiplier for whatever gets an attacker onto the box in the first place. Lazarus's Operation Dream Job typically gets initial access through spear-phishing, fake job offers with malicious attachments, or trojanized developer tooling aimed at people in roles with access to source code, financial systems or crypto wallets. Once that initial payload lands and runs with standard user privileges, CVE-2026-68820 gives the operator a fast, reliable path to full administrative control of the endpoint, at which point credential harvesting, lateral movement and persistence become dramatically easier. Patching this flaw removes the escalation step Lazarus depends on to turn a single compromised laptop into a foothold across the network.
The triage problem hiding in the volume
398-CVE months have become routine for Microsoft, and this one creates a real operational challenge: the actively exploited zero-day and the four 9.8-rated unauthenticated RCEs are all competing for the same limited maintenance-window capacity, the same change-approval cycles, and the same testing bandwidth. Most enterprise patch programs default to CVSS-score ordering, which would put the DNS Server, Deployment Services, QUIC and HPC Pack flaws ahead of the AFD.sys bug on a naive sort. That ordering misses the point.
Active exploitation with named threat-actor attribution should always outrank a higher CVSS score with no known exploitation, because the entire calculus of urgency changes once a capable adversary already has working code against a flaw. The four 9.8 RCEs are serious and belong in this patch cycle's first wave regardless, but security teams should tag CVE-2026-68820 specifically for expedited rollout to any endpoint population that overlaps with Lazarus's known targeting: engineering staff, anyone in blockchain or crypto-adjacent roles, and recruiters or HR staff who regularly open unsolicited attachments as part of their job.
Detection matters as much as the patch
Because this vulnerability requires local code execution before it becomes useful, patching alone closes the door going forward but does not tell you whether Lazarus already used it against you. Organizations should pull EDR telemetry for anomalous process escalation events tied to network stack activity, unexpected SYSTEM-level process spawns following a low-privilege process touching WinSock APIs, in the weeks leading up to Patch Tuesday. Check Point's attribution work ties this specific flaw to an active campaign, which means there is a real chance some environments have already seen exploitation attempts, successful or not.
If your security operations center has not already pulled the specific detection signatures Check Point and Microsoft have published for this CVE, that should happen alongside the patch rollout, not after it. A patched system that was already compromised before the patch went out is still compromised. Treat this as both a patching action and a hunt trigger, and brief your incident response team specifically on Operation Dream Job's tactics, techniques and procedures so a hit gets recognized quickly rather than dismissed as routine endpoint noise.
The prioritization decision for CTOs
The broader lesson from this Patch Tuesday is that raw CVE counts and CVSS scores are increasingly poor proxies for actual risk, and any patch-management program still ordering its queue purely by severity score is going to consistently deprioritize the vulnerabilities attackers are actually using. Build a standing process that cross-references every new Patch Tuesday release against active threat-intelligence feeds before finalizing rollout order, not after. Vendors like Microsoft, Check Point and CrowdStrike all publish exploitation status alongside their advisories now, and that data should feed directly into change-management tooling rather than sitting in a separate report nobody reads before the ticket gets filed.
For a 398-fix month, that means accepting that not everything gets patched in the first wave, and making a defensible, documented decision about what does. CVE-2026-68820 belongs in that first wave because of active exploitation and threat-actor attribution, full stop. The remaining 397 fixes should be triaged against exposure, exploitability and business criticality, but the one flaw with a name attached to it and a confirmed campaign behind it is not a candidate for the second or third wave of your rollout schedule.
