Microsoft Fixes 398 Vulnerabilities, Including an Active Windows Driver Zero‑Day

Key Takeaways

• Microsoft’s August 2026 Patch Tuesday addressed 398 new CVEs, 62 rated Critical; the most urgent is CVE‑2026-68820, a kernel‑mode privilege‑escalation flaw already being exploited in the wild.
• The exploited bug resides in afd.sys (Ancillary Function Driver for WinSock) and can be leveraged by an attacker who already has code execution on a host to gain SYSTEM privileges via a race‑condition/use‑after‑free.
• Four additional vulnerabilities (CVE‑2026-62878, CVE‑2026-62893, CVE‑2026-62815, CVE‑2026-59124) are unauthenticated remote‑code‑execution flaws affecting Windows DNS Server, Deployment Services, QUIC, and HPC Pack, each scored CVSS 9.8, but none were flagged as actively exploited at release.
• Practical patching priority must weigh exploit status, service exposure, and whether the vulnerable component is installed by default (e.g., HPC Pack is optional).
• The August release also completes a two‑part SharePoint remediation: the authentication bypass (CVE‑2026-55040) fixed in July and the RCE component (CVE‑2026-63520) patched now; chaining the two yields unauthenticated RCE against on‑premises SharePoint farms.
• Administrators should first apply the kernel driver fix on any system where code execution may already exist, then patch exposed DNS, WDS, QUIC, and HPC services, and finally ensure both SharePoint updates are deployed.

Overview of the August 2026 Patch Tuesday Release
Microsoft’s monthly security update released on Tuesday, August 11 2026, contained a large batch of fixes—398 newly identified CVEs, of which 62 were rated Critical. Among these, only one vulnerability was marked as “under active exploitation” at the time of release: CVE‑2026-68820, a kernel‑mode privilege‑escalation flaw. The remaining high‑severity issues, while scoring CVSS 9.8, had no evidence of active abuse when the patches shipped. The release illustrates how exploit status, rather than raw severity alone, drives patch‑priority decisions.

CVE‑2026-68820: Actively Exploited Kernel Privilege‑Escalation
CVE‑2026-68820 (CVSS 7.0) resides in afd.sys, the Ancillary Function Driver for Windows Sockets (WinSock), a core component of the Windows networking stack. The flaw is a use‑after‑free condition that can be triggered by a race condition when handling socket operations. An attacker who already possesses arbitrary code execution on a victim machine—perhaps via a prior compromise, malware, or legitimate administrative tool—can exploit this bug to elevate privileges to the SYSTEM account. Microsoft flagged the vulnerability as actively exploited, citing observations from Check Point Research that linked it to the Lazarus Group’s Operation Dream Job campaign. No public attribution has been released by Microsoft, but the active‑exploitation tag places this flaw ahead of higher‑scoring but unexploited server‑side bugs in the remediation order.

Four Unauthenticated Remote Code Execution Flaws
The update also patches four distinct vulnerabilities that allow remote code execution without any authentication, credentials, or user interaction:

• CVE‑2026-62878 (Windows DNS Server) – a stack‑based buffer overflow reachable via DNS queries; the Zero Day Initiative labels it “wormable” due to its network‑reachable nature, though Microsoft judges exploitation less likely.
• CVE‑2026-62893 (Windows Deployment Services) – a flaw in the service’s TFTP handling that can be triggered remotely with no authentication.
• CVE‑2026-62815 (Microsoft QUIC) – an unauthenticated RCE in Microsoft’s implementation of the QUIC transport protocol.
• CVE‑2026-59124 (HPC Pack) – a remote code execution vulnerability in the High Performance Computing Pack; despite sharing a CVSS 9.8 score, it is rated Important rather than Critical because HPC Pack is not installed by default, and Microsoft judges exploitation as more likely than for the other three.

All four require no user interaction, but their real‑world risk depends on whether the affected service is present, enabled, and reachable from untrusted networks.

Assessing Patch Priority for the Server‑Side Flaws
While CVSS scores suggest equal urgency for the four 9.8‑rated vulnerabilities, administrators must weigh additional factors. Exploit status is a primary driver: none of these flaws were observed in the wild at release, so they rank below the actively exploited kernel bug. Next, service exposure matters—if a DNS server is internet‑facing, CVE‑2026-62878 may warrant immediate attention; similarly, exposed Deployment Services or QUIC endpoints raise the priority of CVE‑2026-62893 and CVE‑2026-62815. Finally, install base influences priority: HPC Pack is optional, so environments without it can defer CVE‑2026-59124 until a later cycle, whereas default‑installed components demand quicker action. A balanced approach—first addressing the exploited driver, then patching any externally reachable, high‑impact services—optimizes risk reduction.

The SharePoint Exploit Chain Completed
August’s release also finishes a two‑part remediation for an on‑premises SharePoint exploit chain first disclosed by Rapid7 Labs in May 2026. The chain combined:

• CVE‑2026-55040 (July patch) – a Critical authentication bypass (CVSS 9.1) allowing a remote, unauthenticated attacker to assume the identity of any SharePoint user or administrator, provided the target’s username is known.
• CVE‑2026-63520 (August patch) – the remote code execution component that, when combined with the authentication bypass, yields unauthenticated RCE.

Rapid7 demonstrated that applying the July fix alone breaks the attack chain, because the attacker can no longer impersonate a privileged user. The August update now closes the RCE side, ensuring that even if the authentication bypass were somehow present, the attacker could not execute code. Organizations running on‑premises SharePoint must therefore have both updates installed to fully mitigate the chain.

Practical Guidance for Administrators
Given the blend of an actively exploited kernel privilege‑escalation and several potent but unauthenticated server‑side RCEs, a staged patching strategy is advisable:

1. Immediate Priority – Deploy the fix for CVE‑2026-68820 on all Windows systems where code execution might already exist (e.g., workstations, servers with exposed services, or endpoints prone to malware). This prevents attackers already inside the network from escalating to SYSTEM.
2. Secondary Priority – Identify and patch any externally reachable instances of Windows DNS Server, Deployment Services, QUIC, and (if present) HPC Pack. Focus first on services that are internet‑facing or accessible from untrusted network zones.
3. Tertiary Priority – Ensure SharePoint farms have both the July authentication‑bypass fix (CVE‑2026-55040) and the August RCE fix (CVE‑2026-63520) applied; verify that the July update is in place before relying on the August patch alone.
4. Ongoing Hygiene – Maintain asset inventories and network‑segmentation checks to confirm which services are active and reachable. Regularly revisit patch priorities as new exploit evidence emerges or as internal configurations change.

By following this hierarchy—starting with the actively exploited kernel bug, then addressing exposed high‑impact server flaws, and finally completing the SharePoint remediation—organizations can effectively reduce the attack surface raised by this month’s Patch Tuesday release.