Microsoft’s August update cycle closed 398 distinct CVEs — and one of them, tracked as CVE-2026-68820, was already being used in the wild when the patches shipped.
CVE-2026-68820: afd.sys zero-day under active attack
Microsoft flagged CVE-2026-68820 as the only vulnerability in this monthly release under active exploitation. The bug is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock — a kernel-side component that handles network socket operations. Check Point Research says Lazarus used the zero-day in its Operation Dream Job campaign, while Microsoft has not publicly attributed the exploitation. Microsoft gives the flaw a CVSS score of 7.0 and describes exploitation as dependent on triggering a race condition. Crucially, the defect is a privilege-escalation vulnerability: an attacker must already have code running on the machine before they can use the bug to escalate to SYSTEM. Microsoft prioritized that patch first in the update roll-out.
Four unauthenticated 9.8 RCEs: DNS, WDS, QUIC, and HPC Pack
Behind the actively exploited driver bug sit four unauthenticated remote code execution (RCE) flaws that need nothing from a victim: no account, no password, no click. Each carries a 9.8 CVSS score and can, in the right conditions, give an attacker code execution on vulnerable servers.
- CVE-2026-62878 — Windows DNS Server: a stack-based buffer overflow reachable remotely with no authentication and no user interaction. The Zero Day Initiative (ZDI) describes the condition as "wormable," although Microsoft rates exploitation as less likely.
- CVE-2026-62893 — Windows Deployment Services: a remote flaw reachable through the service's TFTP handling without authentication or user interaction.
- CVE-2026-62815 — Microsoft QUIC: a remote, unauthenticated code execution flaw requiring no user interaction.
- CVE-2026-59124 — HPC Pack: a 9.8-scored RCE that Microsoft rates as Important rather than Critical because HPC Pack is not installed by default; Microsoft also rates exploitation as more likely for this component.
The practical priority of these four depends on whether the vulnerable service is present and reachable in a given environment — service inventory and network reachability therefore matter when setting patch order.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSharePoint chain closed across July and August updates
August's release completes a two-part fix for an exploit chain Rapid7 Labs reported on May 18. Rapid7 described a chain that combined an authentication bypass with a separate code execution vulnerability to reach unauthenticated RCE against on-premises SharePoint.
Microsoft split remediation across July and August: July closed the authentication-bypass half, CVE-2026-55040 (Critical, 9.1), which Rapid7 found allows a remote unauthenticated attacker to assume the identity of a SharePoint site user or administrator if the attacker knows the identity to impersonate. August supplies the RCE fix, CVE-2026-63520 — the code-execution half of the chain. Rapid7 says that once CVE-2026-55040 was patched in July the demonstrated unauthenticated RCE chain was already broken; the August update now closes the remaining execution component. The relevant guidance is clear: on-premises SharePoint farms should have both the July and August updates installed.
Patch priorities and real-world reach
Counting independently, the Zero Day Initiative puts the release at 398 new CVEs, 62 of them rated Critical. That tally illustrates the size of the release; Microsoft and external researchers emphasize that exploit status and network reach — not raw CVSS counts alone — decide the operational patch order. Microsoft’s own guidance in this cycle places the actively exploited afd.sys privilege-escalation bug at the head of the queue for Windows systems where an attacker might already run code and escalate to SYSTEM. Immediately behind it should come exposed DNS, WDS, QUIC, and HPC services, with priority driven by whether the vulnerable services are installed and reachable. Finally, organizations that host on-premises SharePoint farms must verify both the July authentication-bypass fix and the August RCE fix are applied.
What this means for Windows administrators, server operators, and SharePoint teams
- Windows administrators and security teams: treat CVE-2026-68820 as highest priority on systems where untrusted code could be present — the patch eliminates a route to SYSTEM escalation. Next, map and assess exposure for DNS, WDS, QUIC, and HPC services to decide which 9.8 fixes to deploy immediately.
- Server operators running DNS, WDS, or QUIC: inventory whether these services are installed and reachable from untrusted networks; the four unauthenticated RCEs require no interaction and can be exploited remotely if the service is exposed.
- On‑premises SharePoint administrators: ensure both the July CVE-2026-55040 authentication-bypass fix and the August CVE-2026-63520 RCE fix are applied — Rapid7’s reported chain combined those two flaws to reach unauthenticated RCE.
This month’s cycle is a reminder that the highest operational risk is not always the highest CVSS score: an actively exploited, lower‑scored kernel privilege escalation was prioritized ahead of multiple 9.8-rated server RCEs because it was already in use. For defenders, the practical work is unchanged but urgent — patch the exploited driver, inventory exposed services, and confirm SharePoint farms have both parts of the fix.
https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
