Windows Zero-Day Alert: What Las Vegas Businesses Must Patch

What Happened: A Windows Zero-Day Is Already Being Exploited

On August 11, 2026, Microsoft’s monthly Patch Tuesday release addressed CVE-2026-68820, a use-after-free vulnerability in AFD.sys — the Windows Ancillary Function Driver for WinSock, a kernel-level component that handles socket operations for nearly every networked Windows 11 machine. What makes this one different from the hundreds of other fixes bundled into the same update is simple: it was already being used in real attacks before the patch existed.

Security researchers linked the exploitation to Lazarus, the North Korean state-sponsored group behind the long-running “Operation Dream Job” campaign, which lures targets with fake recruiter messages and job offers before delivering malware. Once Lazarus gets a foothold on a machine — typically through a convincing fake job posting or a malicious attachment sent to someone in HR or recruiting — this flaw lets the attacker escalate from a low-level user account to full SYSTEM control. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog and gave federal agencies a two-week deadline to patch. Small and mid-sized businesses don’t get a CISA deadline, but they’re just as exposed, and typically far slower to patch.

How the Attack Actually Works

This isn’t a flaw an attacker can exploit from across the internet with no help from anyone inside your business. It’s a privilege-escalation bug, which means it turns a small foothold into a much bigger problem. Here’s the mechanical chain, in plain terms:

• Initial access: An employee opens a malicious file or link, often from a fake recruiter, vendor, or job-offer email — the classic Lazarus playbook.
• Race condition: The attacker’s code repeatedly triggers a timing flaw in AFD.sys, where one process frees a piece of memory while another process is still using it.
• Kernel access: That memory corruption gives the attacker read/write access inside the Windows kernel — the most trusted layer of the operating system.
• Full control: With kernel access, the attacker elevates from a standard user account to SYSTEM privileges, effectively owning the machine, able to disable security tools, harvest credentials, and move to other devices on the network.

CVE-2026-68820 doesn’t stand alone this month, either. Microsoft’s August release also patched a critical remote code execution flaw in on-premises SharePoint Server (rated “exploitation more likely” by Microsoft) and a critical elevation-of-privilege bug in on-premises Exchange Server. Any Las Vegas business still running its own Exchange or SharePoint server — common among healthcare practices, law firms, and government contractors that keep systems in-house for compliance reasons — has two more reasons to patch this cycle, not just one.

• ⚠Any unpatched Windows 11 workstation (builds 26100/26200) is a viable target the moment an attacker gets a single click from an employee.
• ⚠HR and recruiting inboxes are the highest-risk entry point right now — they’re built to open attachments from strangers.
• ⚠On-premises Exchange or SharePoint servers carry critical, actively-targeted flaws this cycle — not just cloud-hosted Microsoft 365 tenants.
• ⚠Once an attacker has SYSTEM privileges on one machine, ransomware deployment and lateral movement across your network become far easier.
• ⚠Businesses without centralized patch management often take weeks or months to fully roll out a “critical” update across every device.

Where Las Vegas Businesses Fall Short — and How to Fix It

Defending Las Vegas with CMIT Solutions

CMIT Solutions of Las Vegas manages patching, endpoint monitoring, and security awareness training for businesses across Clark County — from hospitality and healthcare to law firms and government contractors. When a CVE like this one lands on a Tuesday, our clients don’t have to track it themselves; we already know which of their machines are exposed and get them patched on our schedule, not an attacker’s.