Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).

Do: Apply Microsoft's security update for CVE-2026-55040 immediately, prioritizing internet-facing SharePoint servers, and comply with CISA BOD 26-04 and the agency's Forensics Triage Requirements, including checking for signs of prior compromise on SharePoint servers. Use the public GitHub proof-of-concept to validate patching and detection coverage, and restrict network exposure of SharePoint until all servers are updated.

CVE-2026-62737 is an untrusted pointer dereference (CWE-822) in the Windows Kernel, meaning the kernel dereferences a pointer influenced by untrusted input without adequate validation. A local, authenticated attacker with low privileges can trigger the flaw by running crafted code on the target machine, with no user interaction required. Successful exploitation results in elevation of privilege, allowing the attacker to move from their low-privileged context to kernel/SYSTEM-level control with high impact on confidentiality, integrity, and availability. Affected platforms are Windows 11 24H2, 25H2, and 26H1, and Windows Server 2025. There is no known public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 2.8% chance of exploitation within 30 days; it is not the zero-day reported under active attack in Microsoft's 400+ vulnerability release (CVE-2026-68820).

Do: Install Microsoft's cumulative security update that fixes CVE-2026-62737 on Windows 11 24H2, 25H2, 26H1, and Windows Server 2025 (the specific KB/build is not provided in the source data; confirm remediation via update history or winver). Because exploitation requires local low-privileged code execution, prioritize hosts with interactive logons, RDP exposure, multi-user sessions, and VDI when sequencing the patch. When triaging Microsoft's large current release, patch the actively exploited zero-day (CVE-2026-68820) first, but apply this kernel privilege-escalation fix in the same update cycle.

A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.

Do: Update MsQuic to a build containing the 'Guard path promotion' fix (commit e0f55b5) and apply Microsoft's patched Windows builds as they are published. Inventory hosts running QUIC-enabled services (e.g., HTTP/3 and SMB over QUIC listening on UDP/443) and restrict their internet exposure at the perimeter as an interim mitigation. Monitor the Microsoft advisory for the definitive list of affected versions.

CVE-2026-62832 is a local privilege escalation flaw (CWE-59, improper link resolution, or 'link following') in the Windows User Profile Service. An attacker who already holds a limited local account on an affected machine can cause the service to follow a symbolic link or junction before it validates file access, so the service performs file operations with elevated rights. Successful exploitation grants elevated privileges on the local system — typically up to administrator/SYSTEM level — with no user interaction required. Affected platforms include Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, and Windows Server 2022 and 2025, which together span essentially the entire supported Windows estate. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation of this specific flaw; EPSS estimates a 3.3% (88th percentile) chance of exploitation within 30 days, although Microsoft's August 2026 Patch Tuesday fixed 400+ vulnerabilities and a separate zero-day (CVE-2026-68820) is under active attack.

Do: Apply the Microsoft cumulative security update addressing CVE-2026-62832 as soon as it reaches your environment through Windows Update/WSUS, and verify the patched build number against Microsoft's advisory (Microsoft's August 2026 Patch Tuesday wave, which fixed 400+ vulnerabilities, is the likely delivery vehicle). As an interim mitigation for link-following LPEs, restrict the 'Create symbolic links' user right (SeCreateSymbolicLinkPrivilege) to trusted administrators. Prioritize patching multi-user servers, VDI hosts, and endpoints where untrusted users hold local sign-in rights, since this flaw requires an existing low-privileged local account.

Windows DNS contains a stack-based buffer overflow (CWE-121) that an unauthenticated, network-adjacent or internet-reachable attacker can trigger by sending crafted input to the DNS service. Successful exploitation yields remote code execution on the target host, with high impact on confidentiality, integrity and availability (CVSS 3.1: 9.8). The flaw affects the DNS component shipped with Windows 10 1607 and 1809 and with Windows Server 2012, 2016, 2019, 2022 and 2025; systems running the DNS Server role, especially internet-facing DNS servers and domain controllers, are the primary targets. Microsoft, which assigned the CVE, has issued a fix, and the flaw appeared amid a record-sized run of Patch Tuesday releases. No in-the-wild exploitation is currently known: it is not in CISA's KEV, no public proof-of-concept is available, and EPSS estimates only a 1.3% probability of exploitation within 30 days.

Do: Apply Microsoft's security update addressing CVE-2026-62878 on all affected Windows 10 (1607, 1809) and Windows Server (2012-2025) hosts, prioritizing internet-facing DNS servers and domain controllers. Until patched, restrict exposure of TCP/UDP 53 to trusted clients and forwarders and avoid publishing Windows DNS directly to the internet. Verify which hosts expose port 53 at the perimeter and monitor for anomalous DNS request patterns as a stopgap detection.

CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).

Do: Apply Microsoft's Patch Tuesday security updates for SharePoint Server as soon as possible, prioritizing internet-facing farms, since the flaw requires no authentication and grants code execution. As interim mitigation, restrict network exposure of SharePoint front-ends (VPN/WAF/reverse proxy rules) and verify all farm servers receive the update. Monitor vendor advisories and the Rapid7 analysis for details on the vulnerable code paths, since no public PoC or in-the-wild exploitation has been confirmed yet.

CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.

Do: Apply Microsoft's August 2026 security updates for all listed Windows 10, Windows 11, and Windows Server versions as a priority; CISA KEV (added 2026-08-11) requires federal agencies to patch within two weeks in accordance with BOD 26-04. Because observed attacks used fake job-offer social engineering to reach local code execution, prioritize user workstations and review endpoints for unexplained SYSTEM-level process activity, newly installed services, or backdoor persistence artifacts. Where patching is deferred, restrict execution of untrusted local code on affected hosts and monitor for privilege-escalation events.

CVE-2026-72971 is a link-following flaw (CWE-59) in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 26H1: the driver performs file access without fully verifying that the path is not redirected through a symbolic link or junction. A local attacker who already holds low-privilege access (CVSS AV:L/PR:L, no user interaction required) can plant a malicious link at a location the driver processes, causing it to follow the link and act on an attacker-chosen target. The attacker gains tampering capability, which the CVSS scores as High integrity impact with no confidentiality or availability impact, meaning they can modify or overwrite files their account could not normally change. Any Windows 11 26H1 system is in scope per the CVE data, with the highest practical risk on shared or multi-user hosts and machines using container isolation features where unionfs.sys is active. No active exploitation is known: the CVE is not in CISA KEV, no public proof-of-concept exists, and EPSS puts 30-day exploitation probability at about 0.5%; the related news shows Microsoft's August 2026 Patch Tuesday shipped 400+ fixes, and defenders should confirm their devices received the unionfs.sys patch.

Do: Apply Microsoft's August 2026 Patch Tuesday updates (or later) on all Windows 11 26H1 devices and verify the unionfs.sys fix is installed; prioritize shared/multi-user hosts, VDI, and systems running Windows containers or sandbox features where unprivileged users can log on locally. Until patched, restrict local logon rights on sensitive systems and monitor for unexpected file modifications by SYSTEM or container-related processes; no workaround or public PoC is known.