Microsoft pushed its monthly security updates this week, closing a large set of vulnerabilities across Windows and server products. What makes this release stand out is that one of the fixes targets an `exploited zero-day` already used in the wild—something defenders will want to address immediately rather than waiting for routine patch cycles.
In total, the release covers 398 new CVEs, including 62 labeled Critical when counted independently. The real-world priority, however, depends on both exploit status and how reachable the affected components are in your environment.
Exploited zero-day in Windows networking driver
The headline issue is tracked as CVE-2026-68820 with a CVSS score of 7.0. Microsoft is flagging this vulnerability as actively exploited, and security research indicates it has been used in campaigns such as Operation Dream Job.
According to the reporting, the bug resides in a core Windows kernel driver responsible for network socket operations. Check Point Research describes the underlying problem as a use-after-free condition in afd.sys, a kernel-side component associated with WinSock (Windows networking).
From an attacker’s perspective, the key detail is access. An adversary needs code execution already running on the machine first; then the flaw can be leveraged for privilege escalation to reach SYSTEM. That combination—local code execution plus escalation—explains why the patch is treated as urgent even though the CVSS score is not the highest in the bundle.
Why this patch should come first
Microsoft notes that exploitation hinges on triggering a race condition in the driver. While Microsoft has not publicly attributed the activity to a named actor, the “actively exploited” flag elevates it above other issues in the same release.
Even when another vulnerability scores higher, exploitation status often determines patch order. In this update set, the exploited driver issue is placed ahead of several unauthenticated server RCE flaws with a CVSS score of 9.8.
Practical takeaway: if an attacker could already execute code on a host in your environment, removing CVE-2026-68820 reduces the chance of a fast move from that foothold to full system control.
Four unauthenticated server RCE flaws: queue them after
Beyond the exploited driver bug, Microsoft’s release includes four additional vulnerabilities that do not require authentication and do not require a user to click or interact. Each of these affects a server-facing component and carries a CVSS score of 9.8.
None of these were flagged as exploited at the time the updates shipped. That said, their reachability still makes them important, especially for internet-exposed services and internal services accessible from other networks.
- CVE-2026-62878 — Windows DNS Server: a remotely reachable stack-based buffer overflow with no authentication and no user interaction. The Zero Day Initiative describes it as technically “wormable” in conditions, meaning the vulnerability’s characteristics could allow fast propagation; that term does not prove a worm is actively running.
- CVE-2026-62893 — Windows Deployment Services (WDS): a remote weakness reachable through the service’s TFTP handling without authentication or user interaction.
- CVE-2026-62815 — Microsoft QUIC implementation: remote code execution that does not require authentication or user interaction.
- CVE-2026-59124 — High Performance Computing (HPC) Pack: also rated 9.8, but Microsoft labels it Important rather than Critical. The reporting notes Microsoft rates exploitation as more likely than the other remote items, while the overall impact depends on whether HPC Pack is deployed in your environment.
Service reachability determines real priority
Not every organization will be exposed to all four 9.8 issues. Some affected components are not installed by default, and even when they are present, they may not be reachable from untrusted networks.
For patch prioritization, defenders should combine:
- Whether the vulnerable service is installed
- Whether it is reachable from the networks where attackers could reach it
- Whether exploit activity is observed for the specific CVE
In other words, the “best” order is not purely by CVSS score. The exploited zero-day in the kernel driver is still first priority where applicable, while the unauthenticated server issues follow based on exposure.
SharePoint: two-part fix completed
Microsoft also closed the second half of a SharePoint remediation that began earlier. This chain involves an authentication bypass followed by a separate code execution vulnerability that can lead to unauthenticated remote code execution against on-premises SharePoint.
Rapid7 Labs reported an exploit chain to Microsoft on May 18, combining:
- CVE-2026-55040 — the July component: a Critical authentication bypass (CVSS 9.1). The flaw allows a remote, unauthenticated attacker to impersonate a SharePoint site user or administrator when the attacker knows which identity to impersonate.
- CVE-2026-63520 — the August component: the code execution part added in this update.
The key operational point is that installing only the July fix is not enough to fully address the chain, because the RCE part is addressed in the August cycle.
Rapid7 notes that applying the July patch breaks the demonstrated chain for that route. The August update then closes the remaining execution component, ensuring the full chain is mitigated for on-premises SharePoint farms.
What to do next: a defender’s checklist
To translate this into actionable patch management, you can follow a straightforward prioritization approach.
1) Put CVE-2026-68820 at the top
For Windows systems where an attacker could already run code—whether through a prior compromise or another local vector—treat CVE-2026-68820 as urgent. The fact that exploitation has been observed means delays can translate into real privilege escalation risk.
2) Inventory DNS, WDS, QUIC, and HPC exposure
Next, identify whether your environment includes and exposes:
- Windows DNS Server services tied to CVE-2026-62878
- Windows Deployment Services with TFTP handling for CVE-2026-62893
- Systems running QUIC-related services for CVE-2026-62815
- HPC Pack deployments for CVE-2026-59124
Patch the ones that are present and reachable first, especially where network exposure increases the chance of remote exploitation.
3) Confirm SharePoint farm updates across both cycles
If you run on-premises SharePoint, ensure both parts are installed: the July authentication-bypass fix (CVE-2026-55040) and the August code execution update (CVE-2026-63520).
Conclusion
This month’s Microsoft release is large—398 CVEs—but defenders should focus on what is actively exploited and what is reachable. The exploited zero-day in the Windows networking driver (CVE-2026-68820) is the most time-sensitive item because it can help attackers escalate to SYSTEM once they have code execution. After that, prioritize the high-scoring unauthenticated server RCE issues based on whether DNS, WDS, QUIC, and HPC services are installed and exposed. Finally, complete the two-part SharePoint remediation for on-premises deployments.
Source: https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
