Microsoft August 2026 Patch Tuesday: 398 Flaws Fixed, Windows Driver Zero-Day Under Active Attack

Microsoft released its August 2026 Patch Tuesday updates, addressing a total of 398 vulnerabilities, with 62 rated Critical. The most urgent fix is for CVE-2026-68820, a Windows kernel driver zero-day already under active exploitation.

CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the Ancillary Function Driver for WinSock. It allows an attacker with code execution on a machine to escalate privileges to SYSTEM. Microsoft flags it as actively exploited, and Check Point Research attributes the exploitation to the Lazarus Group as part of Operation Dream Job. The flaw carries a CVSS score of 7.0.

Four other vulnerabilities are unauthenticated remote code execution flaws with CVSS scores of 9.8, requiring no user interaction. These affect Windows DNS Server (CVE-2026-62878), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815), and HPC Pack (CVE-2026-59124). The Zero Day Initiative describes the DNS Server flaw as wormable, though Microsoft rates exploitation as less likely.

The release also completes a two-part SharePoint fix. Rapid7 Labs reported an exploit chain combining an authentication bypass (CVE-2026-55040, fixed in July) with a code execution vulnerability (CVE-2026-63520, fixed in August) to achieve unauthenticated RCE against on-premises SharePoint. Patching both updates is essential for SharePoint farms.

Patch priority should place CVE-2026-68820 first for systems where attackers may already have code execution, followed by exposed DNS, WDS, QUIC, and HPC services. Organizations should verify that SharePoint farms have both the July and August updates installed.