Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Swati KhandelwalAug 11, 2026Vulnerability / Windows Security

Microsoft rolled out its latest security patches this week, with one vulnerability already being exploited in attacks.

The vulnerability resides in a Windows kernel driver responsible for network socket operations. An attacker with existing code on a system can leverage this flaw to escalate privileges to SYSTEM. As a result, this patch takes precedence.

Identified as CVE-2026-68820 with a CVSS score of 7.0, this is the only actively exploited vulnerability in this month’s release. Exploiting this flaw entails triggering a race condition in the driver. Although Microsoft has not publicly attributed the exploitation, Check Point Research claims that Lazarus utilized this zero-day in its Operation Dream Job campaign.

Furthermore, four other vulnerabilities in the release require no interaction from the victim—no account, no password, no clicks. These vulnerabilities affect Windows DNS Server, Windows Deployment Services, Microsoft’s QUIC transport protocol implementation, and High Performance Computing (HPC) Pack, each scoring 9.8 on the CVSS scale. At the time of the release, none of these vulnerabilities were being actively exploited.

According to the Zero Day Initiative, the release includes a total of 398 new CVEs, with 62 rated as Critical. While the size of the release is significant, the priority of patches is determined by exploit status and impact.

Check Point Research describes CVE-2026-68820 as a use-after-free vulnerability in afd.sys, the Ancillary Function Driver for WinSock, which is a kernel-side component of Windows networking.

This privilege escalation bug requires pre-existing code on the machine for exploitation, allowing attackers to elevate privileges to SYSTEM. Despite the lower score, Microsoft has confirmed active exploitation, prioritizing this vulnerability over the four 9.8-rated server RCEs in the release.

No User Interaction Required

The four unauthenticated RCE vulnerabilities do not necessitate any action from the victim, making them critical targets for attackers. These vulnerabilities include:

• CVE-2026-62878, Windows DNS Server: A stack-based buffer overflow that can be exploited remotely without authentication or user interaction. While Microsoft considers exploitation less likely, the Zero Day Initiative classifies it as “wormable.”
• CVE-2026-62893, Windows Deployment Services: A remote flaw in TFTP handling that can be exploited without authentication or user interaction.
• CVE-2026-62815, Microsoft QUIC: A remote unauthenticated code execution flaw that requires no user interaction.
• CVE-2026-59124, HPC Pack: Although rated Important instead of Critical due to its non-default installation, this vulnerability is more likely to be exploited according to Microsoft.

Considering the presence and accessibility of vulnerable services in a particular environment, the priority of patching these vulnerabilities should be assessed along with their exploit status.

Closure of a SharePoint Chain

August marks the completion of a two-part fix for a SharePoint vulnerability chain that began in July.

Rapid7 Labs reported an exploit chain to Microsoft on May 18, combining an authentication bypass with a separate code execution vulnerability to achieve unauthenticated RCE on on-premises SharePoint. While July addressed the authentication bypass (CVE-2026-55040), rated at 9.1, August now fixes the RCE component identified as CVE-2026-63520.

It is crucial to note that CVE-2026-63520 addresses the RCE part of the chain, which, when combined with CVE-2026-55040, leads to unauthenticated RCE as demonstrated by Rapid7. By patching CVE-2026-55040 in July, the vulnerability chain was disrupted, and the August update completes the closure by addressing the RCE component.

In summary, prioritize patching CVE-2026-68820 for Windows systems with existing malicious code, followed by the exposed DNS, WDS, QUIC, and HPC services vulnerabilities. Ensure that on-premises SharePoint farms have both the authentication bypass fix from July and the RCE fix from August.