Microsoft's August Patch Tuesday was one of the largest on record, and buried in it was a flaw that had already been used against real targets.
CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for
WinSock — afd.sys. CISA's catalogue entry describes it plainly:
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.
CISA added it to the Known Exploited Vulnerabilities catalogue on 11 August with a remediation deadline of 25 August.
Why this driver
afd.sys is the kernel component that sits underneath the Winsock API. Every ordinary
Windows process that opens a network socket goes through it, which makes it reachable
from code running at low privilege without anything unusual having to happen first.
That combination — kernel-mode, reachable from a sandbox, no special preconditions — is
why AFD has been a recurring target for privilege-escalation research rather than a
one-off.
A use-after-free here is not a crash bug. It is a write primitive inside the kernel, and the standard payoff is SYSTEM.
What it was used for
Check Point researchers have attributed exploitation to North Korean operators, who used it to load a kernel-mode rootkit as part of the long-running Operation Dream Job campaign. (Attribution and campaign linkage are Check Point's; verify against their published research before republishing as fact.)
That detail is the part worth dwelling on. A local privilege escalation is often filed as second-tier next to remote code execution, because an attacker needs a foothold first. But an LPE is precisely what turns a foothold into a rootkit: it is the step between "we ran code as a user" and "we own the kernel and you cannot see us any more." Chained behind a phishing lure, which is exactly what Dream Job is built on, it is the whole game.
What to do
Patch. The August cumulative update carries the fix, and the CISA deadline for federal civilian agencies has already passed — which is a reasonable signal for everyone else.
If you cannot patch immediately, the useful mitigations are the ones that break the chain rather than the bug: application allow-listing, blocking the initial-access vector, and EDR rules that flag unsigned or newly-registered kernel drivers. A rootkit still has to load.
On the numbers
Reporting on the size of this Patch Tuesday varies — different outlets counted 394, 400 and 421 CVEs. The discrepancy is mostly about whether Edge/Chromium CVEs and republished third-party advisories are folded into the total. If the exact figure matters to you, count it yourself from the MSRC update guide rather than trusting a headline.