Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
Microsoft's August 2026 Patch Tuesday release addresses 398 new vulnerabilities, 62 rated Critical by the Zero Day Initiative, with CVE-2026-68820 (CVSS 7.0), a use-after-free in the afd.sys Windows kernel driver, the only flaw flagged as actively exploited. Check Point Research attributed exploitation of the privilege escalation bug to Lazarus' Operation Dream Job campaign. Four unauthenticated remote code execution flaws rated 9.8 affect Windows DNS Server (CVE-2026-62878, called wormable by ZDI), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815) and HPC Pack (CVE-2026-59124). The release also completes a two-part SharePoint fix with RCE component CVE-2026-63520, following July's authentication bypass fix CVE-2026-55040.
- CVE-2026-68820: afd.sys use-after-free, actively exploited, escalates to SYSTEM.
- Check Point attributes exploitation to Lazarus' Operation Dream Job campaign.
- Four CVSS 9.8 unauthenticated RCEs: DNS Server, WDS, Microsoft QUIC, HPC Pack.
- ZDI labels the DNS Server stack overflow CVE-2026-62878 wormable.
- SharePoint RCE CVE-2026-63520 completes the chain with CVE-2026-55040.
- CVEs
- CVE-2026-68820CVE-2026-62878CVE-2026-62893CVE-2026-62815CVE-2026-59124CVE-2026-63520CVE-2026-55040
- Threat actors
- Lazarus
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-59124 | Unauthenticated Deserialization RCE in Microsoft HPC Pack | 9.8 | 2% | ||
| CVE-2026-62815 | Use-after-free RCE in Microsoft MsQuic via crafted network packets | 9.8 | 1% | ||
CVE-2026-62893+1 related CVE | Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS) | 9.8 | 3% | ||
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server | 8.1 | 3% | ||
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
3 min read at thehackernews.com
Swati Khandelwal Aug 11, 2026 Vulnerability / Windows Security Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.