Lazarus-Linked Actors Exploit Windows Ancillary Function Driver Zero-Day; Adobe Commerce and Magento Hit by Separate Skimming Chain

Microsoft's August 2026 patch release shipped fixes for 421 vulnerabilities across the Windows, Office, Azure, and .NET stacks, anchored by an emergency update for CVE-2026-68820, a Windows Ancillary Function Driver for WinSock local-privilege-escalation zero-day that Microsoft has confirmed is being actively exploited by Lazarus-linked actors. Adobe separately released an urgent fix for CVE-2026-71362 affecting Adobe Commerce and Magento Open Source, addressing a separate skimming-chain exploitation that was already in use against mid-market retailers.

CVE-2026-68820: How the Exploit Works

The vulnerability stems from a race condition in the Ancillary Function Driver for WinSock (afd.sys) handling of overlapped I/O completion. Successfully exploited, the bug grants an authenticated local user SYSTEM privileges on the target machine. Microsoft's exploitability assessment, classified "Exploitation Detected," credits research from the Microsoft Threat Intelligence Center and notes overlap with Lazarus group tradecraft observed in earlier 2026 incidents. Patched builds are available for Windows 10, 11, Server 2019, 2022, and 2025.

CVE-2026-71362: The Adobe Commerce Skimming Chain

The Adobe patch addresses CVE-2026-71362, a server-side template injection vulnerability in Adobe Commerce and Magento Open Source that allowed unauthenticated attackers to inject web-skimming JavaScript into checkout flows. Adobe confirmed limited in-the-wild exploitation against U.S. and European retailers, with payment-card harvesting confirmed by several incident-response firms. Stores running Magento 2.4.7 or earlier should apply the patch immediately and rotate any keys shared with payment processors.

City-Forum: A 17-Month Salesforce/ServiceNow Exposure

Separately, security firm Reco this week disclosed what it calls the "City-Forum" campaign: an actor that spent 17 months extracting records from misconfigured Salesforce and ServiceNow portals worldwide before detection. Affected portals included CRM exports, support-ticket content, and contract metadata. Reco said thousands of organizations were exposed, and that the actor primarily pursued sectors where Salesforce and ServiceNow co-deploy: financial services, healthcare providers, and federal contractors.

Operational Guidance

Three actions follow. First, IT teams should prioritize CVE-2026-68820 patching given the Lazarus-linked activity, alongside the standard Patch Tuesday workload. Second, Adobe Commerce and Magento stores should apply the CVE-2026-71362 patch, rotate payment keys, and audit checkout templates for unsanctioned JavaScript. Third, Salesforce and ServiceNow administrators should run the Reco-published portal-config audit script to confirm that community-license and guest-access controls match current guidance.