Microsoft Patch Tuesday: 398 Flaws and Zero-Day CVE-2026-68820 Under Attack

Microsoft's August 2026 Patch Tuesday fixes 398 vulnerabilities, and one of them is already being exploited: CVE-2026-68820, a use-after-free in the afd.sys Windows networking driver that an attacker with code on the machine can use to escalate to SYSTEM. Rated only CVSS 7.0, it is the sole flaw in this release Microsoft flags as under active attack, and Check Point Research ties it to the Lazarus group's Operation Dream Job. Patch that one first, then the four unauthenticated CVSS 9.8 bugs close behind it. The Zero Day Initiative counts 398 new CVEs in the release, 62 of them Critical.

The lead item is a lesson in why raw severity is a poor patch-ordering tool. CVE-2026-68820 (NVD, CVSS 7.0, CWE-416) is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock and a kernel-side piece of Windows networking. It is a privilege-escalation bug that needs code already running on the host and a race condition to win, which is exactly why its score sits at 7.0 and its EPSS near the 28th percentile. Neither number would move it to the top of a queue sorted by CVSS. Its actual priority comes from a fact those metrics do not encode: a nation-state actor is using it right now. That is the recurring gap between "how bad could this be" and "is this being used," and the second question is the one that sets patch order.

Right behind it sit four flaws that ask nothing of the victim: no account, no password, no click. They affect Windows DNS Server, Windows Deployment Services, Microsoft's QUIC transport implementation, and the High Performance Computing (HPC) Pack, and each carries a CVSS 9.8. None was flagged as exploited when the updates shipped, but the window of safety shrinks quickly once binary diffing begins. Once a patch is public, researchers and attackers alike begin diffing the fixed binaries, and unauthenticated network-reachable bugs like a DNS Server or QUIC flaw are the fastest to weaponize. The release also closes the remote-code-execution half of a SharePoint chain whose authentication bypass Microsoft fixed in July, so on-premises SharePoint farms need both updates installed to be whole.

Which patches should go first this month?

Order by exploitation and reach, not by the headline count. The afd.sys zero-day (CVE-2026-68820) goes out first because it is confirmed in Lazarus operations, prioritizing the user groups those campaigns target. Next come the four unauthenticated 9.8s, starting with Tier 0 infrastructure: patch Windows DNS Server on domain controllers immediately, and if you cannot, isolate recursive resolvers from untrusted networks. Then the QUIC and Windows Deployment Services fixes, with a temporary option to disable QUIC or block UDP/443 at the perimeter where it is not needed. A 398-CVE release is not 398 emergencies; it is a handful of must-patch-today items inside a large routine batch.

Why does an actively exploited bug rate only CVSS 7.0?

Because CVSS measures the shape of a flaw, not whether anyone is using it. A local privilege escalation that requires an existing foothold and a race-condition win scores lower than a remote unauthenticated RCE by design. But Lazarus does not need CVE-2026-68820 to be a 9.8; it needs it to turn a low-privilege foothold from a phishing lure into SYSTEM, quietly, below the reach of userland EDR. That is why "exploited" outranks "critical" in a sane patch queue, and why a 7.0 is leading this month's deployment.

Our read

The compliance-as-evidence pillar is what turns a 398-CVE dump into a manageable month. "We patched" is a claim; the useful version is a timestamped, per-device record of which builds are actually deployed against which flaws, so you can prove the exploited zero-day is closed everywhere before you worry about the long tail. Our review of 2025's actively exploited vulnerabilities found that 20% were exploited on or before disclosure day, which is precisely why Microsoft's own "under active attack" tag, not the CVSS column, should drive your first ring. Continuous verification means confirming asset patch status as it propagates rather than trusting a monthly scan, and supervised adversary simulation means checking that your EDR actually detects an afd.sys privilege-escalation attempt while the fix rolls out. Patch the afd.sys zero-day everywhere first, then the unauthenticated 9.8s, and keep the evidence that you did.

Reporting by The Hacker News; CVE count per the Zero Day Initiative, exploitation attribution per Check Point Research, and severity per NVD. Sources linked above.

Related: SharePoint CVE-2026-50522 RCE under active exploitation · Passkey attacks that bypass phishing-resistant MFA