Windows kernel bug already under attack as Microsoft ships nearly 400 fixes

Key points

• Microsoft released its monthly security updates on Patch Tuesday, fixing 398 flaws in total.
• One bug, tracked as CVE-2026-68820, is already being used in attacks and is the only zero-day in this batch.
• The flaw sits in a core Windows kernel driver that handles network socket operations, the plumbing that lets programs talk over the internet.
• It carries a severity score of 7.0 out of 10 and lets an attacker who is already on a machine take full control of it.
• Security teams are being told to install this patch first, ahead of the rest.

Microsoft has pushed out its monthly round of security fixes, and one bug in the batch is already being used by attackers in the wild.

The flaw lives deep inside Windows, in a driver that handles network socket operations. In plain terms, that is the piece of code that lets apps on your computer send and receive data over the internet. Attackers who can already run code on a machine, say through a booby-trapped document or a foothold from an earlier break-in, can use the bug to promote themselves to SYSTEM, the highest level of access Windows offers.

Once you are SYSTEM, the machine is yours. You can turn off security tools, read any file, and install whatever you want.

Microsoft is tracking the issue as CVE-2026-68820, with a severity score of 7.0 out of 10. It is the only bug in this month's release flagged as being actively exploited, and Microsoft is telling admins to deploy it before the rest.

The wider update, first reported by The Hacker News, closes 398 vulnerabilities across Windows and related products.

Who is behind the attacks?

Microsoft has not named an attacker, and no vendor has published a public cluster identifier for this activity yet. So treat any attribution you see this week with caution.

Kernel privilege escalation bugs of this shape are bread-and-butter tooling for a wide range of operators. They show up in the toolkits of ransomware crews, in access-broker campaigns, and in nation-state intrusion sets tracked by vendors under names like Lazarus (Microsoft's Diamond Sleet) and various China-nexus clusters. Capability is not intent, though. Until a vendor publishes indicators or overlapping infrastructure, we do not know which of those groups, if any, is behind the current exploitation.

I would put confidence in any single-source attribution at low for now.

What does this mean for ordinary users?

For most people at home, the answer is simple: let Windows Update run. The fix will arrive automatically on machines that are set up normally, and a reboot finishes the job.

The bug is not a way for a stranger on the internet to reach into your PC on its own. An attacker needs a foothold first. That usually starts with a phishing email, where criminals send fake messages to trick you into opening an attachment or clicking a link, or with software you downloaded from somewhere sketchy.

So the practical advice is the boring advice. Install the update. Be careful with unexpected attachments. If a work laptop is involved, your IT team will likely push the patch out this week.

Why does this one jump the queue?

Because it is already being used, and because of what it gives an attacker.

A privilege escalation bug on its own is not glamorous. Chained with a phishing lure or a browser exploit, it turns a limited break-in into a full takeover. That is the pattern defenders have watched play out again and again, from cybercrime affiliates to state-linked intrusion sets, and it is why this specific CVE is at the top of every patching list this week.