What Happened: Lazarus and CVE-2026-68820

A new Windows 11 zero-day is being actively exploited in the wild, and the group behind it is a familiar name in state-linked hacking circles: Lazarus. The vulnerability, tracked as CVE-2026-68820, lives inside AFD.sys, the Ancillary Function Driver for WinSock that Windows relies on to handle network socket communications at the kernel level. According to the reporting, the exploit is precisely targeted, checking specifically for Windows 11 24H2 and 25H2 builds before it fires, which suggests the attackers have done their homework on which systems are worth going after.

The goal of the exploit is privilege escalation. Once triggered, it allows an attacker who already has some foothold on a machine to elevate their access to SYSTEM level, the highest privilege tier in Windows. That is a meaningful jump: SYSTEM access means an attacker can bypass most of the restrictions that separate a regular user account from full control of the operating system.

Why AFD.sys Keeps Showing Up

If the name AFD.sys sounds familiar, it should. This same driver has been a recurring target for Lazarus and similar threat actors, and Microsoft has previously had to patch a Windows zero-day tied to a Lazarus rootkit that exploited a related weakness. The pattern is telling: kernel-level drivers like AFD.sys sit deep in the operating system, handle a huge amount of low-level network traffic, and are complex enough that bugs can persist for years before anyone notices them being abused.

This also isn't the first time Windows 11 has faced a fresh zero-day shortly after a patch cycle. Earlier this year, a new Windows 11 zero-day emerged just days after July's Patch Tuesday, and researchers have separately demonstrated working Windows 11 and Edge exploits at Pwn2Own Berlin 2026. None of this means Windows 11 is uniquely fragile. It reflects the reality that a modern operating system used by hundreds of millions of people is a constant target, and sophisticated groups are always probing for the next opening.

Privacy Implications of SYSTEM-Level Access

The privacy angle here matters as much as the technical one. SYSTEM privileges are not just about running commands with fewer restrictions. They give an attacker the ability to read and modify almost anything on a device: browser session data, saved credentials, locally cached files, and security software configurations. On a compromised machine, that level of access can also be used to disable or tamper with security tools, intercept network traffic, or quietly monitor what a user does, including VPN connections, DNS queries, and other traffic that people often assume is protected simply because encryption is in place.

Encryption protects data in transit and at rest, but it does not protect against an attacker who has already taken over the operating system underneath it. That is the real risk of a privilege escalation bug like this one: it does not need to break your VPN or your browser's security, it just needs to get underneath them.

Lazarus has a track record of pairing technical exploits like this with social engineering, including fake job offers and recruiter outreach used to get initial access onto a target's device, as seen in the group's ongoing Operation Dream Job campaign against defense and aerospace firms. A kernel-level exploit is often the second stage of an attack, not the first, which is a useful reminder that the initial compromise usually starts with something far simpler, like a convincing email or a malicious attachment.

What This Means For You

For most everyday Windows 11 users, the immediate risk from this specific Windows 11 zero-day is limited. Lazarus and similar groups tend to focus their most advanced tools on high-value targets: government agencies, defense contractors, financial institutions, and research organizations. That said, zero-days like CVE-2026-68820 have a way of getting incorporated into broader toolkits over time, so it is worth taking seriously even if you are not an obvious target today.

Until Microsoft ships an official fix, there is no direct patch to apply. The most effective defense right now is reducing the chances that an attacker gets the initial foothold needed to exploit the flaw in the first place.

Actionable Takeaways

  • Keep Windows Update turned on and check for updates regularly so you receive the patch as soon as Microsoft releases it.
  • Be cautious with unsolicited job offers, recruiter messages, and unexpected attachments, since these remain common entry points for groups like Lazarus.
  • Run reputable endpoint security software that can flag unusual privilege escalation attempts, not just known malware signatures.
  • Limit the use of administrator accounts for daily tasks, since a standard user account narrows what an attacker can do even after gaining a foothold.
  • If you work in a sector known to be targeted by state-linked groups, such as defense or aerospace, treat this as a reminder to review endpoint monitoring and patch management processes rather than waiting for a formal advisory.

Zero-days affecting core Windows components are unsettling, but they are also a normal part of the ongoing back-and-forth between attackers and defenders. Staying current on updates, questioning unexpected outreach, and layering your security tools remain the most practical ways to stay ahead of threats like this one.