Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
- CVE-2026-68820 is an actively exploited local privilege escalation zero-day in Windows AFD.sys
- Three flaws were publicly disclosed pre-patch: CVE-2026-62832, CVE-2026-72971, CVE-2026-62737
- Critical unauthenticated RCE flaws patched in Microsoft QUIC and Windows DNS
- ShieldBreak PoC bypasses the July RoguePlanet Microsoft Defender patch on Windows 11
- Researchers urge risk-based triage rather than rushing all 400+ patches
- CVEs
- CVE-2026-68820CVE-2026-62832CVE-2026-72971CVE-2026-62737CVE-2026-62815CVE-2026-62878CVE-2026-63520CVE-2026-55040CVE-2026-50656
- ATT&CK
- T1068 Exploitation for Privilege EscalationT1014 Kernel Modules and System ExtensionsT1190 Exploit Public-Facing Application
- Threat actors
- Operation Dream Job
- Organizations
- MicrosoftCheck PointCrowdStrikeRapid7
- Countries
- North KoreaChina
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50656 | Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet " | 7.0 | 11% | PoC | |
| CVE-2026-55040 | Authentication Bypass in Microsoft SharePoint Server | 9.1 | 70% | KEVPoC ×2 | KEV |
| CVE-2026-62737 | Untrusted Pointer Dereference LPE in Windows 11 and Windows Server 2025 Kernel | 7.8 | 3% | ||
| CVE-2026-62815 | Use-after-free RCE in Microsoft MsQuic via crafted network packets | 9.8 | 1% | ||
| CVE-2026-62832 | Local Privilege Escalation via Link Following in Windows User Profile Service | 7.8 | 3% | ||
| CVE-2026-62878 | Unauthenticated Stack Buffer Overflow RCE in Windows DNS (CVE-2026-62878) | 9.8 | 1% | ||
| CVE-2026-63520 | Unauthenticated RCE in Microsoft SharePoint Server | 8.1 | 3% | ||
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
| CVE-2026-72971 | Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver | 5.5 | <1% |
From the original article
4 min read at helpnetsecurity.com
Microsoft’s August 2026 Patch Tuesday delivered security fixes for 400+ vulnerabilities, including one that has been exploited in zero-day attacks (CVE-2026-68820) and three that were publicly disclosed prior to the release of the patches. CVE-2026-68820 is a use-after-free flaw that affects the Windows Ancillary Function Driver for WinSock (AFD.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.