CVE-2026-68820: Actively Exploited Windows AFD.sys Zero-Day Enables SYSTEM Privilege Escalation

Microsoft’s August 2026 updates patched CVE-2026-68820, a use-after-free in the Windows AFD.sys driver that permits local privilege escalation to SYSTEM; the flaw was exploited in the wild by the Lazarus group as part of Operation Dream Job to escalate an initial foothold (via malicious PDFs/trojanized software and the MISTPEN downloader) and deploy the FudModule kernel rootkit, so organizations should prioritize the August patches and hunt for post-compromise indicators and privilege-escalation activity.