Windows kernel bug already under attack as Microsoft ships nearly 400 fixes

Key points

• Microsoft released its monthly security updates on Patch Tuesday, fixing 398 flaws in total.
• One bug, tracked as CVE-2026-68820, is already being used in attacks and is the only zero-day in this batch.
• The flaw sits in a core Windows kernel driver that handles network socket operations, the plumbing that lets programs talk over the internet.
• It carries a severity score of 7.0 out of 10 and lets an attacker who is already on a machine take full control of it.
• Security teams are being told to install this patch first, ahead of the rest.

Microsoft has pushed out its monthly round of security fixes, and one bug in the batch is already being used by attackers in the wild.

The flaw lives deep inside Windows, in a driver that handles network socket operations. That is the piece of code that lets apps on your computer send and receive data over the internet. Attackers who can already run code on a machine, say through a booby-trapped document or a foothold from an earlier break-in, can use the bug to promote themselves to SYSTEM, the highest level of access Windows offers. Once there, you can turn off security tools or install whatever you want.

Microsoft is tracking the issue as CVE-2026-68820, with a severity score of 7.0 out of 10. It's the only bug in this month's release flagged as actively exploited, and Microsoft is telling admins to deploy it before the rest. The wider update, first reported by The Hacker News, closes 398 vulnerabilities across Windows and related products.

This CVE is one we've been watching: our first report on it ran 11 August 2026, when an AFD.sys hole in the same kernel driver family was already being used to plant a rootkit.

Who is behind the attacks?

Microsoft hasn't named an attacker, and no vendor has published a public cluster identifier for this activity yet. Treat any attribution you see this week with caution.

Kernel privilege escalation bugs of this shape are bread-and-butter tooling for ransomware crews, access-broker campaigns, and nation-state intrusion sets tracked under names like Lazarus (Microsoft's Diamond Sleet) and various China-nexus clusters. Capability is not intent, though. Until a vendor publishes indicators or overlapping infrastructure, we don't know which of those groups, if any, is behind the current exploitation. I'd put confidence in any single-source attribution at low for now.

What does this mean for ordinary users?

For most people at home, let Windows Update run. The fix will arrive automatically on machines set up normally, and a reboot finishes the job.

This bug isn't a way for a stranger on the internet to reach into your PC on its own. An attacker needs a foothold first, and that usually starts with a phishing email, where criminals send fake messages to trick you into opening an attachment or clicking a link, or with software downloaded from somewhere sketchy. Install the update and be careful with unexpected attachments. If a work laptop is involved, your IT team will likely push the patch out this week.

Why does this one jump the queue?

Because it's already being used, and because of what it gives an attacker.

A privilege escalation bug on its own isn't glamorous. Chained with a phishing lure or a browser exploit, it turns a limited break-in into a full takeover. That's the pattern defenders have watched play out again and again, from cybercrime affiliates to state-linked intrusion sets, and it's why this specific CVE is at the top of every patching list this week.