Table of Contents
Introduction
Microsoft has released its August 2026 security updates, and it's a massive one. The company patched a staggering 398 vulnerabilities, including a Windows driver zero-day that is already being actively exploited by attackers.
This update is critical for businesses of all sizes. Hackers are already using one of these flaws to gain full control of Windows systems. If you haven't installed the latest updates yet, you need to act now.
A Windows driver zero-day (CVE-2026-68820) is already being used in active attacks. Install the August security updates immediately.
The Zero-Day Under Active Attack (CVE-2026-68820)
The most urgent vulnerability in this month's release is CVE-2026-68820, a privilege escalation flaw in a core Windows kernel driver that handles network socket operations.
Key details:
- CVSS Score: 7.0 (High)
- Affected Component: afd.sys (Ancillary Function Driver for WinSock)
- Attack Type: Use-after-free vulnerability
- Impact: Privilege escalation to SYSTEM level
- Status: Actively exploited in the wild
This vulnerability requires an attacker to already have code running on a compromised machine. Once they do, they can use this flaw to gain full SYSTEM-level privileges — complete control over the Windows system.
Security researchers at Check Point Research have linked the exploitation of this zero-day to the Lazarus Group, a North Korean state-sponsored hacking team. The group is using this vulnerability in their "Operation Dream Job" campaign, which targets job seekers with fake employment offers.
The Lazarus Group is a notorious North Korean hacking group known for targeting cryptocurrency exchanges, financial institutions, and defense contractors.
4 Critical Unauthenticated RCE Flaws
Beyond the actively exploited zero-day, Microsoft also patched four critical remote code execution (RCE) flaws that require no authentication or user interaction. Each carries a CVSS score of 9.8 (Critical).
The four critical flaws:
- CVE-2026-62878 - Windows DNS Server
A stack-based buffer overflow vulnerability that can be triggered remotely without authentication. Security researchers describe this as "wormable" — meaning it could potentially spread between vulnerable systems automatically. - CVE-2026-62893 - Windows Deployment Services
A remote flaw accessible through the service's TFTP handling. No authentication or user interaction is required. - CVE-2026-62815 - Microsoft QUIC
A remote, unauthenticated code execution flaw affecting Microsoft's implementation of the QUIC transport protocol. - CVE-2026-59124 - HPC Pack
Another critical RCE flaw, though Microsoft rates it as "Important" rather than "Critical" because HPC Pack is not installed by default.
These four vulnerabilities require no user interaction and can be exploited remotely. If exposed to the internet, they could allow attackers to take full control of your systems.
The SharePoint Chain Fix
August also completes a two-part SharePoint fix that began in July. Rapid7 Labs reported an exploit chain to Microsoft on May 18 that combined:
- Authentication Bypass (Fixed in July) - CVE-2026-55040 (CVSS 9.1)
- Remote Code Execution (Fixed in August) - CVE-2026-63520
When chained together, these vulnerabilities could allow an unauthenticated attacker to take full control of an on-premises SharePoint server. Microsoft split the fixes across the July and August patch cycles.
If you installed the July SharePoint update, the authentication bypass route was already closed. The August update now closes the RCE component as well.
Patch Priority: What to Fix First
With 398 vulnerabilities to address, you need to prioritize. Here is the recommended order:
- Priority 1: CVE-2026-68820 (Windows Driver Zero-Day)
This vulnerability is already being exploited in the wild. Patch it immediately on all Windows systems. - Priority 2: The Four 9.8 RCE Flaws (CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, CVE-2026-59124)
These are wormable, remote, and require no user interaction. Prioritize systems exposed to the internet. - Priority 3: SharePoint CVE-2026-63520
Even if you installed the July update, apply the August fix to close the RCE component. - Priority 4: All Other CVEs
Apply the remaining updates in your regular patch cycle.
How to Protect Your Business
Follow these steps to stay protected:
- Install the August security updates immediately. This is the most critical action. The zero-day is already being exploited.
- Prioritize internet-facing systems. DNS servers, SharePoint servers, and other exposed systems should be patched first.
- Review your service inventory. Verify whether you are running Windows DNS Server, Windows Deployment Services, QUIC, or HPC Pack in your environment.
- Use vulnerability management tools. Automate patch deployment and monitoring to ensure no systems are missed.
- Implement network segmentation. Limit exposure of vulnerable services to the internet where possible.
- Monitor for suspicious activity. Look for unusual privilege escalation attempts or network traffic patterns.
Final Thoughts
The August 2026 Patch Tuesday is one of the largest security updates Microsoft has ever released. 398 vulnerabilities patched, 62 critical, and one actively exploited zero-day.
Key takeaways:
- A Windows driver zero-day (CVE-2026-68820) is already being used by North Korean hackers in Operation Dream Job.
- Four critical 9.8 vulnerabilities require no authentication or user interaction — prioritize these.
- On-premises SharePoint farms need both July and August updates to be fully protected.
- Don't wait — these updates are urgent.
If you need help managing your security updates or want to learn more about protecting your business from these vulnerabilities, contact SystemLogicIT for a free security assessment.