The vulnerability CVE-2026-68820 is a use-after-free flaw in Windows afd.sys that enables attackers to trigger a race condition and escalate privileges to System level. North Korean Lazarus Group has exploited this zero-day in a campaign targeting aerospace and defense organizations, primarily in Europe and India, since early 2026. Attackers use social engineering via fake job offers to deliver malicious payloads involving DLL sideloading and malware downloaders. The exploitation chain culminates in deploying the ForestTiger backdoor. Additionally, a trojanized PDF viewer named SecurityPDF is used to deploy the Troy backdoor in memory. The attackers' infrastructure includes compromised Roundcube webmail and CMS platforms vulnerable to CVE-2025-49113, hosting a PHP webshell called RelayShell for command relay. Microsoft patched the vulnerability on August 11, 2026, and CISA has mandated patching within two weeks for federal agencies.

Successful exploitation allows attackers to gain full System privileges on affected Windows systems, enabling complete control over the victim machine. This facilitates deployment of persistent backdoors such as ForestTiger and Troy, enabling extensive espionage capabilities including file operations, shell access, process manipulation, and data exfiltration. The campaign targets sensitive sectors like defense and aerospace, potentially compromising critical intellectual property and operational security. The use of sophisticated infection chains and web-based command infrastructure increases stealth and persistence.

Microsoft released an official patch for CVE-2026-68820 on August 11, 2026, as part of Patch Tuesday updates. Organizations, especially in defense, aerospace, and aviation sectors, should prioritize applying this update immediately. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and urges federal agencies to patch within two weeks. Security teams should also scrutinize unsolicited recruitment communications and avoid downloading unverified payloads. Reviewing indicators of compromise related to ForestTiger, Troy backdoors, and associated infrastructure is recommended. No vendor advisory indicates that no action is required; patching is the primary mitigation.