Microsoft Patches 398 Flaws Including a Windows Driver Zero

Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).

Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.

CVE-2026-59124 is a deserialization of untrusted data flaw (CWE-502) in Microsoft High Performance Computing (HPC) Pack that allows an unauthorized attacker to execute code over a network. Because the vulnerable component processes untrusted serialized input, an attacker who can reach the network-facing service can send malicious serialized data and trigger arbitrary code execution without credentials or user interaction. Successful exploitation grants the attacker the ability to run code in the context of the affected service, with full confidentiality, integrity, and availability impact per the 9.8 CVSS score. Any organization running Microsoft HPC Pack on Windows — typically head nodes and management endpoints of Windows HPC clusters — is affected. As of the August 2026 Patch Tuesday release that addressed it, there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild, though the EPSS score of 1.7% (76th percentile) suggests a moderate near-term exploitation probability.

Do: Apply Microsoft's August 2026 security updates for HPC Pack immediately via Windows Update or the Microsoft Update Catalog, since the flaw is remotely exploitable without authentication. Inventory your environment for HPC Pack head nodes and management services, and restrict network access to them (firewall rules, VPN, or jump hosts) until patched. Because the vector is unauthenticated network code execution, prioritize internet-facing or broadly reachable cluster endpoints when patching.

A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.

Do: Update MsQuic to a build containing the 'Guard path promotion' fix (commit e0f55b5) and apply Microsoft's patched Windows builds as they are published. Inventory hosts running QUIC-enabled services (e.g., HTTP/3 and SMB over QUIC listening on UDP/443) and restrict their internet exposure at the perimeter as an interim mitigation. Monitor the Microsoft advisory for the definitive list of affected versions.

Microsoft Windows Deployment Services (WDS) contains a use-after-free memory-safety flaw (CWE-416) that an unauthenticated attacker can trigger by sending crafted network traffic to the WDS service, leading to remote code execution on the target system. The vulnerability affects Windows 10 1607 and 1809 and Windows Server 2012, 2016, 2019, 2022, and 2025 on systems where WDS is deployed, a role typically used for network-based (PXE) operating system imaging. A successful exploit grants the attacker code execution with high confidentiality, integrity, and availability impact, reflected in the critical CVSS 3.1 score of 9.8 with network vector, low complexity, and no privileges or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, although EPSS estimates a 2.7% probability of exploitation within 30 days (85th percentile). The flaw was disclosed alongside Microsoft's record September 2026 Patch Tuesday, which shipped nearly 1,000 fixes including two Windows zero-days.

Do: Apply Microsoft's September 2026 (or later) security updates for all affected Windows versions listed in the advisory. Because the vulnerable component is an optional role, audit Windows systems for the presence of Windows Deployment Services; disable the role where it is not needed and restrict network access to WDS/PXE endpoints on systems that require it but are not yet patched. Given the moderate EPSS score and lack of public PoC, prioritize patching internet-facing or shared-network WDS servers first and monitor for exploitation activity.

CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).

Do: Apply Microsoft's Patch Tuesday security updates for SharePoint Server as soon as possible, prioritizing internet-facing farms, since the flaw requires no authentication and grants code execution. As interim mitigation, restrict network exposure of SharePoint front-ends (VPN/WAF/reverse proxy rules) and verify all farm servers receive the update. Monitor vendor advisories and the Rapid7 analysis for details on the vulnerable code paths, since no public PoC or in-the-wild exploitation has been confirmed yet.

CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.

Do: Apply Microsoft's August 2026 security updates for all listed Windows 10, Windows 11, and Windows Server versions as a priority; CISA KEV (added 2026-08-11) requires federal agencies to patch within two weeks in accordance with BOD 26-04. Because observed attacks used fake job-offer social engineering to reach local code execution, prioritize user workstations and review endpoints for unexplained SYSTEM-level process activity, newly installed services, or backdoor persistence artifacts. Where patching is deferred, restrict execution of untrusted local code on affected hosts and monitor for privilege-escalation events.