Microsoft Patch Tuesday for August 2026 Fixed a Zero
Microsoft's August 2026 Patch Tuesday fixes 398 CVEs, including an actively exploited WinSock zero-day CVE-2026-68820 and wormable DNS RCE CVE-2026-62878.
Microsoft's August 2026 Patch Tuesday addresses 398 CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, .NET and other products, with 62 rated Critical. The actively exploited CVE-2026-68820 is a use-after-free in the Windows WinSock afd.sys driver that can yield SYSTEM privileges via a race condition. CVE-2026-62878 is a critical, wormable stack buffer overflow in Windows DNS Server allowing unauthenticated, remote code execution without user interaction. Other notable fixes include WDS TFTP RCE CVE-2026-62893, a QUIC flaw affecting roughly 13.5 million sites (CVE-2026-62815), an Exchange authentication bypass EoP demonstrated at Pwn2Own Berlin (CVE-2026-62911), and two TPM 2.0 reference implementation fixes.
- 398 CVEs fixed; 62 rated Critical
- CVE-2026-68820: actively exploited WinSock afd.sys use-after-free granting SYSTEM privileges
- CVE-2026-62878: wormable, unauthenticated Windows DNS Server RCE
- CVE-2026-62911 Exchange EoP demonstrated with working code at Pwn2Own Berlin
- CVE-2026-62815 QUIC flaw affects roughly 13.5 million websites
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-59124 | Unauthenticated Deserialization RCE in Microsoft HPC Pack | 9.8 | 2% | ||
| CVE-2026-62815 | Use-after-free RCE in Microsoft MsQuic via crafted network packets | 9.8 | 1% | ||
| CVE-2026-62832 | Local Privilege Escalation via Link Following in Windows User Profile Service | 7.8 | 3% | ||
CVE-2026-62893+1 related CVE | Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS) | 9.8 | 3% | ||
| CVE-2026-62911 | Capture-Replay Authentication Bypass in Microsoft Exchange Server | 8.0 | <1% | PoC | |
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
| CVE-2026-72971 | Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver | 5.5 | <1% |
From the original article
3 min read at securityaffairs.com
Microsoft Patch Tuesday for August 2026 fixes 398 CVEs, including an actively exploited zero-day and a wormable DNS flaw enabling remote code execution. Microsoft released its Patch Tuesday security updates for August 2026 on Tuesday, covering 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, . NET, and a range of other components.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.