CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.
- CISA set an August 25 patch deadline; no workaround exists and a device restart is required
- Check Point found Lazarus impersonated Lockheed Martin and Enveil recruiters with malicious PDFs
- The Winsock flaw lets malware escalate from limited access to complete system control
- Targets spanned defense sectors in France, Germany, Brazil and India
- The same Winsock component was previously exploited by Lazarus Group in 2024
- CVEs
- CVE-2026-68820
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1068 Exploitation for Privilege Escalation
- Vendors
- MicrosoftCheck Point
- Threat actors
- Lazarus Group
- Victims
- Lockheed MartinEnveil
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | 9% | KEV | KEV |
From the original article
3 min read at therecord.media
Federal agencies were ordered to patch a Windows vulnerability used by North Korean hackers to target people applying to jobs in the defense and aerospace industry. The Cybersecurity and Infrastructure Security Agency (CISA) and Microsoft confirmed on Tuesday that CVE-2026-68820 is being exploited.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.