North Korean hackers were already inside a use-after-free flaw in Windows for weeks, using it to plant a kernel-level rootkit, before Microsoft even had a patch ready. That is the detail buried in the middle of Microsoft's routine August 2026 Patch Tuesday release, which fixed 421 separate vulnerabilities on August 11. Most of those flaws will never make headlines. One of them already has an attribution, a toolset, and a named nation-state operator attached to it.

The Flaw That Was Already Being Used

The vulnerability at the center of this story is CVE-2026-68820, a use-after-free bug in the Ancillary Function Driver for WinSock, known as afd.sys, a kernel-mode component that handles the core networking operations every Windows machine relies on to move data across a socket connection. Microsoft's own advisory describes the mechanics plainly: "A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition. Successful exploitation could allow the attacker to gain SYSTEM privileges. User interaction is not required." SYSTEM is the highest privilege level on a Windows machine, meaning an attacker who successfully triggers this flaw effectively owns the device outright, with no security boundary left standing between them and anything on it.

Microsoft rated the bug "Important" rather than "Critical," a CVSS score of 7.0 that, on paper, would place it well down most security teams' priority queues behind the month's flashier remote-code-execution bugs. That rating turned out to be misleading in the way severity scores often are for privilege escalation flaws: they measure technical mechanics, not whether someone is actively using the bug against real targets right now.

Who Was Already Inside, and What They Built

Someone was. Researchers at Check Point Software identified the exploitation and attributed it to North Korea's Lazarus Group, the state-sponsored hacking unit responsible for some of the most consequential cyberattacks of the past decade. According to Check Point's threat intelligence director, Sergey Shykevich, the group's analysts first observed attackers battering this specific vulnerability at the beginning of June, roughly two months before Microsoft's public fix arrived. "We are familiar with one successful implementation of the CVE," Shykevich told The Register, "but we assume it was used widely in the campaign."

The purpose of the intrusion was not simple data theft. According to Check Point's research, Lazarus used the elevated privileges gained through CVE-2026-68820 to deploy a new version of FudModule, the group's kernel-mode rootkit, as part of an ongoing operation the security industry has tracked for years under the name Operation Dream Job. That campaign's signature method involves posing as recruiters or employers to lure targets, typically employees at defense contractors, cryptocurrency firms, and technology companies, into opening malicious files disguised as job offers. A kernel-mode rootkit is about as deep as malware gets: it operates at the same privilege level as the operating system itself, making it extraordinarily difficult for standard antivirus tools to detect, since the rootkit can manipulate what the operating system reports back to the security software monitoring it.

Not Lazarus's First Trip Through This Exact Door

What makes this specific vulnerability class worth tracking is not that it exists, but that it keeps reappearing. Tenable senior staff research engineer Satnam Narang noted that this is not an isolated incident for this particular Windows component. "Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193," Narang said, adding that the 2024 flaw was reportedly exploited by North Korean hackers linked to the same Lazarus group. Four zero-days in the same driver over roughly two years, with the same threat actor implicated in at least two of them, is not a coincidence. It reflects a threat actor that has identified a specific, recurring seam in Windows's networking architecture and keeps returning to probe it every time defenders patch the previous hole.

That pattern matters for how defenders should think about this fix. Patching CVE-2026-68820 closes this specific door. It does not mean afd.sys itself has been made structurally safe, given the component's track record of yielding a new exploitable flaw roughly once a year since 2022.

A Second Flaw Riding Along in the Same Release

CVE-2026-68820 was not the only urgent item in August's update. Microsoft also disclosed CVE-2026-62832, a flaw in the Windows User Profile Service that allows an authenticated attacker who already has credentials for one local account to load another user's registry hive and gain administrator privileges. Unlike the Lazarus flaw, Microsoft has not confirmed active exploitation of this one, but the company flagged it as publicly known, meaning technical details were already circulating before a patch existed, a condition security researchers generally treat as accelerating the timeline until real-world attacks appear. Splashtop's security analysis grouped both flaws together as the two vulnerabilities this month where the real-world risk clearly outpaces the official severity label, a judgment call that requires looking past the CVSS number to the actual exploitation signals Microsoft and outside researchers are reporting.

Why 421 Patches in One Month Isn't Actually the Story

It is tempting to lead with the raw scale of this release, and outlets did: 421 CVEs is a genuinely enormous number for a single month, though Redmondmag's analysis notes it is actually smaller than July's release, which topped 500 fixes, part of what has become, by their account, a new normal of massive monthly Windows security drops. But raw volume is a misleading way to measure urgency. The overwhelming majority of those 421 fixes address flaws nobody has been caught exploiting, sitting in components most organizations rarely expose to untrusted users. Security teams that spend their patch cycle treating all 421 as equally urgent are solving the wrong problem. The one that actually mattered this month was a single Important-rated bug, quietly weaponized by a nation-state group for roughly two months before the rest of the world learned it existed.

The Broader Pattern This Fits Into

This is not the only recent story about a flaw sitting undiscovered in widely deployed software for far longer than anyone expected, though the mechanism here is entirely different: Lazarus found this bug through old-fashioned human security research and exploit development, not an AI system probing code at scale. That distinction is worth drawing out precisely because AI-assisted vulnerability discovery, the kind that surfaced a serious flaw in Cursor within hours of a new model's release, is becoming a parallel and increasingly significant track for how vulnerabilities get found in 2026's software landscape. Nation-state groups like Lazarus are not waiting for AI tools to catch up. They are still finding and weaponizing kernel-level Windows flaws through direct human expertise, on a cadence that has now produced four distinct afd.sys zero-days in under three years.

Both tracks, AI-driven vulnerability discovery and old-fashioned nation-state exploit research, ultimately feed into the same downstream risk that made JADEPUFFER's fully autonomous ransomware operation possible earlier this year: a growing population of exploitable flaws in production software, being found by increasingly capable adversaries, faster than most organizations can patch and verify. The August Patch Tuesday release, buried under 421 line items, is a monthly reminder of exactly how wide that gap remains, and precisely which one item in the pile actually needed attention within the first 24 hours rather than the next two weeks.