Lazarus group exploits zero-day vulnerability for kernel-mode rootkit deployment and system privilege escalation

Summary

Microsoft has released security updates for 400 flaws, including 42 critical vulnerabilities. The update cycle includes one actively exploited zero-day and two publicly disclosed zero-days. Among the most significant fixes is a patch for an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock that is currently being used in the wild to deploy malware.

Technical details

The most urgent flaw, CVE-2026-68820, involves a use-after-free vulnerability within the Windows Ancillary Function Driver for WinSock (AFD.sys). A locally authenticated attacker can trigger a race condition by running a specially crafted application to gain SYSTEM privileges without requiring user interaction.

Check Point reports that North Korean threat actors known as Lazarus have exploited this flaw to deploy a new version of FudModule, their kernel-mode rootkit.

Two other elevation of privilege vulnerabilities were addressed:

• CVE-2026-62832: A "link following" vulnerability in the Windows User Profile Service. An authenticated attacker with credentials for another local account can run a crafted application to load another user's registry hive, allowing them to modify data and gain administrator privileges. This matches the "LegacyHive" flaw disclosed by researcher Nightmare Eclipse.
• CVE-2026-72971: A tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys). Similar to the profile service flaw, an authenticated attacker can use improper link resolution to perform local tampering and gain administrator privileges.

Why this matters for defenders

The exploitation of CVE-2026-68820 by Lazarus represents a high-tier threat because it allows for the deployment of kernel-mode rootkits. Once a rootkit is active in the kernel, it can hide its presence from standard security tools and maintain persistence on a compromised system.

The volume of updates this month is notable; Microsoft has begun using an AI-powered vulnerability discovery system to identify more flaws across its product lines. This shift may result in a higher frequency of reported vulnerabilities moving forward.

Defender guidance

Prioritize the following actions based on the current threat landscape:

1. Patch Windows immediately: Focus on CVE-2026-68820 to prevent local privilege escalation to SYSTEM, especially on systems where users may have local access.
2. Monitor for rootkit activity: Given the Lazarus group's use of the AFD.sys flaw to deploy FudModule, look for indicators of kernel-mode tampering or unusual driver behavior.
3. Address Metabase SQLi: For organizations running Metabase, apply updates immediately to mitigate a critical SQL injection vulnerability that is being actively exploited. If an immediate upgrade is impossible, block the /api/session/reset-password endpoint as a temporary workaround.

What remains unclear

While Microsoft has confirmed the existence of these vulnerabilities, they have not shared specific technical details regarding how the zero-day flaws were discovered or the exact mechanics used by attackers to trigger the race conditions in AFD.sys. Additionally, while the "LegacyHive" connection is noted for CVE-2026-62832, the full scope of its potential impact on various Windows configurations remains unconfirmed by Microsoft.