Microsoft — August 2026 Patch Tuesday: 398 Vulnerabilities Mitigated Including a Windows Kernel Zero-Day (CVE-2026-68820)

Publication date: August 11, 2026
Category: Vulnerability / Windows Security

Introduction

Microsoft has rolled out its monthly security updates, addressing a massive volume of 398 vulnerabilities across its software ecosystem. Most critically, the company confirmed that one of these flaws—identified as a zero-day in a core Windows kernel driver—is actively being exploited in the wild. According to research by Check Point Research, this vector has been tied to the Lazarus APT threat group in their “Operation Dream Job” campaign. In addition, the advisory includes four unauthenticated remote code execution flaws carrying a CVSS score of 9.8 that require zero user interaction, alongside the resolution of the second half of a critical SharePoint chain originally reported by Rapid7 Labs.

What is CVE-2026-68820 and the Threat Landscape? (General Analysis)

The primary component concentrating current exploitation risk is afd.sys (Ancillary Function Driver for WinSock), a kernel-side component responsible for handling network socket operations within the Windows operating system. The vulnerability CVE-2026-68820 is a use-after-free flaw within the driver, allowing an authorized attacker who already has code running locally to elevate their privileges to SYSTEM.

Below are the official NVD metric parameters for the key CVEs addressed in this cycle:

• CVE-2026-68820 (Confirmed Fact):

  • Official Description: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
  • Official CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — 7.0 (HIGH, CVSS v3.1)
  • Official CWE: CWE-416 (Use After Free)
  • CISA KEV Catalog: Yes (Listed due to active exploitation)

• CVE-2026-62878 (Confirmed Fact):

  • Official Description: Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL, CVSS v3.1)
  • Official CWE: CWE-121 (Stack-based Buffer Overflow)

• CVE-2026-62893 (Confirmed Fact):

  • Official Description: Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL, CVSS v3.1)
  • Official CWE: CWE-416 (Use After Free)

• CVE-2026-62815 (Confirmed Fact):

  • Official Description: Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL, CVSS v3.1)
  • Official CWE: CWE-416 (Use After Free)

• CVE-2026-59124 (Confirmed Fact):

  • Official Description: Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL, CVSS v3.1)
  • Official CWE: CWE-502 (Deserialization of Untrusted Data)

• CVE-2026-55040 (Confirmed Fact):

  • Official Description: Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N — 9.1 (CRITICAL, CVSS v3.1)
  • Official CWE: CWE-1390 (Weak Authentication)
  • CISA KEV Catalog: Yes

• CVE-2026-63520 (Confirmed Fact):

  • Official Description: Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
  • Official CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — 8.1 (HIGH, CVSS v3.1)
  • Official CWE: CWE-20 (Improper Input Validation)

How Does It Work? (Technical Analysis)

An analysis of the behavioral mechanics behind these vulnerabilities demonstrates distinct attack methodologies depending on the surface targeted:

• Race Condition Exploitation in CVE-2026-68820:

  • Initial Flow: The attacker successfully compromises a low-privileged user session or leverages an initial access vector (such as malicious job offers documented by Check Point).
  • Privilege Escalation: The exploit concurrently interacts with the afd.sys driver via malformed I/O control requests, triggering a race condition. This manipulates pointers pointing to already freed memory objects, allowing arbitrary code injection into the kernel address space and escalation to SYSTEM privileges.

• Unauthenticated Remote Code Execution (CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, CVE-2026-59124):

  • Network Entry: Exposed network services (such as the DNS server, Windows Deployment Services via TFTP, the QUIC transport stack, or HPC Pack) process crafted packets directly from the network without requiring credentials or user interaction.
  • Flaw Mechanism: Stack-based buffer overflows (CWE-121) or unsafe deserialization (CWE-502) corrupt memory or execute commands under the privileges of the affected service, potentially enabling wormable propagation across corporate environments if services are exposed to the public internet or unsegmented internal networks.

• Microsoft SharePoint Exploitation Chain (CVE-2026-55040 and CVE-2026-63520):

  • Authentication Bypass (July): CVE-2026-55040 allows a remote attacker to assume the identity of a SharePoint site user or administrator by bypassing JWT token validation if the target identity is known.
  • Code Execution (August): CVE-2026-63520 provides the improper input validation vulnerability enabling remote code execution on on-premises farms. Chaining both vulnerabilities sequentially achieves full unauthenticated RCE.

Affected Systems / Environments

The scope of impacted systems spans client endpoints and corporate servers:

Mitigation and Detection

Remediation

• Patch Prioritization: Immediately prioritize deploying the kernel patch for CVE-2026-68820 across workstations and servers where prior code execution is suspected.
• Critical Network Services: Apply cumulative updates immediately for exposed servers running Windows DNS, Windows Deployment Services, Microsoft QUIC, and Microsoft HPC Pack.
• On-Premises SharePoint Farms: Rigorously verify that local farms have installed both the July fix (CVE-2026-55040) and the August fix (CVE-2026-63520) to completely sever the exploitation chain.
• Inventory and Segmentation: Isolate deployment and name-resolution services from public networks using perimeter firewalls and micro-segmentation.

Detection

• Monitor Windows Security and System event logs for anomalous child process creation spawned by network services or suspicious privilege escalation activities targeting SYSTEM accounts.
• Implement traffic analytics rules to detect anomalous behavioral patterns in QUIC protocol handling and unusual TFTP requests targeting Windows deployment services.

Blue Team Note: The simultaneous presence of an actively exploited zero-day (CVE-2026-68820) and multiple wormable critical flaws (such as the DNS overflow) mandates prioritizing vulnerability management driven by ground-level threat intelligence and exposed asset visibility rather than CVSS scoring alone.

Wrapping Up

The August 2026 update cycle underscores the persistent drive of advanced threat actors to weaponize low-level operating system components alongside high-risk network vectors. Rapid adoption of Microsoft’s patches and strict validation of vulnerability chains like the one observed in SharePoint are critical to preventing systemic compromise of corporate infrastructure.

References

• Khandelwal, S. (2026). Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack. The Hacker News. https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
• Check Point Research. (2026). Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack. https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
• Microsoft. (2026). CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability. Microsoft Security Response Center (MSRC). https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820
• Microsoft. (2026). CVE-2026-62878: Windows DNS Server Stack-based Buffer Overflow Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62878
• Microsoft. (2026). CVE-2026-62893: Windows Deployment Services Use After Free Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893
• Microsoft. (2026). CVE-2026-62815: Microsoft QUIC Use After Free Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62815
• Microsoft. (2026). CVE-2026-59124: Microsoft High Performance Computing (HPC) Pack Deserialization Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124
• Microsoft. (2026). CVE-2026-55040: Microsoft Office SharePoint Weak Authentication Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040
• Microsoft. (2026). CVE-2026-63520: Microsoft Office SharePoint Improper Input Validation Vulnerability. MSRC. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520
• Cybersecurity and Infrastructure Security Agency (CISA). (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-68820, CVE-2026-55040). https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Rapid7 Labs. (2026). Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040). https://www.rapid7.com/blog/post/ra-microsoft-sharepoint-jwt-token-authentication-bypass-cve-2026-55040/