Microsoft patches 421 flaws as Lazarus exploits zero-day

Microsoft’s August Patch Tuesday release closed 421 vulnerabilities across its products, among them a zero-day flaw already exploited by North Korea’s Lazarus Group since early June. The bug, tracked as CVE-2026-68820, resides in the Windows Ancillary Function Driver for WinSock and allows local privilege escalation to SYSTEM level without user interaction. Check Point researchers, who reported the vulnerability, observed Lazarus attackers leveraging it in a campaign dubbed Operation Dream Job, which impersonated defense contractors and privacy-tech firms to distribute trojanized applications and a new backdoor named Troy.

What was fixed

The 421 patches cover a range of severity levels, though Microsoft flagged only two as "notable." CVE-2026-68820, the zero-day, enables code execution at SYSTEM privileges via a use-after-free race condition in the WinSock driver. The second, CVE-2026-62832, is a publicly known elevation-of-privilege flaw in Windows registry handling that Microsoft rates as "more likely" to be exploited. An attacker with local credentials could load another user’s registry hive and gain administrator access without user interaction.

Trend Micro’s Zero Day Initiative highlighted five additional vulnerabilities as particularly critical. Among them, CVE-2026-62893—a remote code execution flaw in Windows Deployment Services TFTP Server—allows unauthenticated attackers to execute code via UDP port 69. Another, CVE-2026-62911, demonstrated at ZDI’s Pwn2Own Berlin, enables Exchange Server privilege escalation through an authentication bypass, granting attackers control over user mailboxes.

How Lazarus exploited the zero-day

Check Point’s threat intelligence team linked the zero-day exploitation to Operation Dream Job, a long-running Lazarus campaign targeting defense and aerospace organizations. Attackers created fake websites impersonating Lockheed Martin and Enveil, using search engine optimization to rank them as top results. Victims were lured with fake job offers, then tricked into downloading a trojanized PDF viewer called SecurityPDF. When opened, the viewer executed a malicious payload embedded in attacker-crafted PDFs, deploying the Troy backdoor and the FudModule rootkit via CVE-2026-68820.

The campaign primarily targeted defense contractors in Europe and India. Check Point noted that Lazarus expanded its tactics to include SEO poisoning and impersonation sites, increasing the credibility of phishing attempts and evading detection. The group’s use of a zero-day in a widely deployed Windows component underscores its ability to identify and weaponize vulnerabilities before patches are available.

What professionals should prioritize

Microsoft’s advisory and third-party analyses agree on three immediate actions. First, patch CVE-2026-68820 and CVE-2026-62832, as both have been exploited in the wild. Second, block UDP port 69 at the perimeter to mitigate CVE-2026-62893, though internal lateral movement remains a risk. Third, prioritize Exchange Server updates, particularly CVE-2026-62911, despite Microsoft’s "less likely" exploitability rating—ZDI confirmed working exploits during Pwn2Own.