Microsoft Patches Exploited Windows Kernel Flaw Granting Full SYSTEM Access

A race condition in the core network socket driver of Windows gave local attackers a direct ladder to full SYSTEM privileges before Microsoft released a patch. The zero-day vulnerability, tracked as CVE-2026-68820, was already actively exploited in targeted campaigns.

The issue resides in AFD.sys (the Ancillary Function Driver for WinSock), a kernel-mode driver responsible for handling network sockets. According to analysis by Check Point Research, two execution threads could access socket state data simultaneously without proper synchronization. That race condition caused a use-after-free bug (CWE-416), where one thread freed memory while another continued to access it, giving attackers read-and-write primitives inside kernel memory.

Because the flaw requires an attacker to already execute code locally, it is not a remote entry vector. Instead, it serves as a reliable privilege-escalation step. Researchers observed the exploit deployed alongside fake job postings by the Lazarus Group to install FudModule, a kernel-level rootkit, with activity tracked back to at least early July 2026.

The vulnerability spans multiple generations of the operating system, including Windows 10, Windows 11, and Windows Server releases from 2012 through 2025. Following the report, the U.S. CISA added the flaw to its Known Exploited Vulnerabilities catalog.

Primary source: Microsoft Security Response Center

Source: habr