Microsoft Patch Tuesday for August 2026 Fixed a Zero

CVE-2026-59124 is a deserialization of untrusted data flaw (CWE-502) in Microsoft High Performance Computing (HPC) Pack that allows an unauthorized attacker to execute code over a network. Because the vulnerable component processes untrusted serialized input, an attacker who can reach the network-facing service can send malicious serialized data and trigger arbitrary code execution without credentials or user interaction. Successful exploitation grants the attacker the ability to run code in the context of the affected service, with full confidentiality, integrity, and availability impact per the 9.8 CVSS score. Any organization running Microsoft HPC Pack on Windows — typically head nodes and management endpoints of Windows HPC clusters — is affected. As of the August 2026 Patch Tuesday release that addressed it, there is no known public proof-of-concept, no CISA KEV listing, and no confirmed exploitation in the wild, though the EPSS score of 1.7% (76th percentile) suggests a moderate near-term exploitation probability.

Do: Apply Microsoft's August 2026 security updates for HPC Pack immediately via Windows Update or the Microsoft Update Catalog, since the flaw is remotely exploitable without authentication. Inventory your environment for HPC Pack head nodes and management services, and restrict network access to them (firewall rules, VPN, or jump hosts) until patched. Because the vector is unauthenticated network code execution, prioritize internet-facing or broadly reachable cluster endpoints when patching.

A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.

Do: Update MsQuic to a build containing the 'Guard path promotion' fix (commit e0f55b5) and apply Microsoft's patched Windows builds as they are published. Inventory hosts running QUIC-enabled services (e.g., HTTP/3 and SMB over QUIC listening on UDP/443) and restrict their internet exposure at the perimeter as an interim mitigation. Monitor the Microsoft advisory for the definitive list of affected versions.

CVE-2026-62832 is a local privilege escalation flaw (CWE-59, improper link resolution, or 'link following') in the Windows User Profile Service. An attacker who already holds a limited local account on an affected machine can cause the service to follow a symbolic link or junction before it validates file access, so the service performs file operations with elevated rights. Successful exploitation grants elevated privileges on the local system — typically up to administrator/SYSTEM level — with no user interaction required. Affected platforms include Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, and Windows Server 2022 and 2025, which together span essentially the entire supported Windows estate. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation of this specific flaw; EPSS estimates a 3.3% (88th percentile) chance of exploitation within 30 days, although Microsoft's August 2026 Patch Tuesday fixed 400+ vulnerabilities and a separate zero-day (CVE-2026-68820) is under active attack.

Do: Apply the Microsoft cumulative security update addressing CVE-2026-62832 as soon as it reaches your environment through Windows Update/WSUS, and verify the patched build number against Microsoft's advisory (Microsoft's August 2026 Patch Tuesday wave, which fixed 400+ vulnerabilities, is the likely delivery vehicle). As an interim mitigation for link-following LPEs, restrict the 'Create symbolic links' user right (SeCreateSymbolicLinkPrivilege) to trusted administrators. Prioritize patching multi-user servers, VDI hosts, and endpoints where untrusted users hold local sign-in rights, since this flaw requires an existing low-privileged local account.

Microsoft Windows Deployment Services (WDS) contains a use-after-free memory-safety flaw (CWE-416) that an unauthenticated attacker can trigger by sending crafted network traffic to the WDS service, leading to remote code execution on the target system. The vulnerability affects Windows 10 1607 and 1809 and Windows Server 2012, 2016, 2019, 2022, and 2025 on systems where WDS is deployed, a role typically used for network-based (PXE) operating system imaging. A successful exploit grants the attacker code execution with high confidentiality, integrity, and availability impact, reflected in the critical CVSS 3.1 score of 9.8 with network vector, low complexity, and no privileges or user interaction required. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, although EPSS estimates a 2.7% probability of exploitation within 30 days (85th percentile). The flaw was disclosed alongside Microsoft's record September 2026 Patch Tuesday, which shipped nearly 1,000 fixes including two Windows zero-days.

Do: Apply Microsoft's September 2026 (or later) security updates for all affected Windows versions listed in the advisory. Because the vulnerable component is an optional role, audit Windows systems for the presence of Windows Deployment Services; disable the role where it is not needed and restrict network access to WDS/PXE endpoints on systems that require it but are not yet patched. Given the moderate EPSS score and lack of public PoC, prioritize patching internet-facing or shared-network WDS servers first and monitor for exploitation activity.

Microsoft Exchange Server contains an authentication bypass flaw (CWE-294) in which captured authentication material can be replayed, allowing an authorized attacker to elevate privileges over a network. Per the CVSS vector, the attack is network-based with low complexity but requires the attacker to already hold low privileges and some user interaction, and success yields high impact on confidentiality, integrity, and availability. Affected products include on-premises Exchange Server and Exchange Server Subscription Edition, though specific vulnerable version ranges are not specified in the available data. Public scans indicate nearly 22,000 Exchange servers remain exposed to the flaw following the August 2026 Patch Tuesday fixes. No in-the-wild exploitation, public proof-of-concept, or KEV listing is known; the bug was demonstrated at Pwn2Own (ZDI-26-534) and carries an EPSS estimate of 1.3% probability of exploitation within 30 days.

Do: Apply the Exchange Server security updates released in Microsoft's August 2026 Patch Tuesday (refer to Microsoft's advisory for the exact fixed builds) on all on-premises servers, prioritizing internet-facing systems running OWA, EWS, or ActiveSync. Until patched, limit network exposure of Exchange endpoints to trusted networks and monitor authentication logs for replay-style anomalies; per the scan data, roughly 22,000 servers still need the update.

CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.

Do: Apply Microsoft's August 2026 security updates for all listed Windows 10, Windows 11, and Windows Server versions as a priority; CISA KEV (added 2026-08-11) requires federal agencies to patch within two weeks in accordance with BOD 26-04. Because observed attacks used fake job-offer social engineering to reach local code execution, prioritize user workstations and review endpoints for unexplained SYSTEM-level process activity, newly installed services, or backdoor persistence artifacts. Where patching is deferred, restrict execution of untrusted local code on affected hosts and monitor for privilege-escalation events.

CVE-2026-72971 is a link-following flaw (CWE-59) in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 26H1: the driver performs file access without fully verifying that the path is not redirected through a symbolic link or junction. A local attacker who already holds low-privilege access (CVSS AV:L/PR:L, no user interaction required) can plant a malicious link at a location the driver processes, causing it to follow the link and act on an attacker-chosen target. The attacker gains tampering capability, which the CVSS scores as High integrity impact with no confidentiality or availability impact, meaning they can modify or overwrite files their account could not normally change. Any Windows 11 26H1 system is in scope per the CVE data, with the highest practical risk on shared or multi-user hosts and machines using container isolation features where unionfs.sys is active. No active exploitation is known: the CVE is not in CISA KEV, no public proof-of-concept exists, and EPSS puts 30-day exploitation probability at about 0.5%; the related news shows Microsoft's August 2026 Patch Tuesday shipped 400+ fixes, and defenders should confirm their devices received the unionfs.sys patch.

Do: Apply Microsoft's August 2026 Patch Tuesday updates (or later) on all Windows 11 26H1 devices and verify the unionfs.sys fix is installed; prioritize shared/multi-user hosts, VDI, and systems running Windows containers or sandbox features where unprivileged users can log on locally. Until patched, restrict local logon rights on sensitive systems and monitor for unexpected file modifications by SYSTEM or container-related processes; no workaround or public PoC is known.