Microsoft Fixes 398 Security Flaws in Massive August 2026 Patch Tuesday Update

Microsoft released its August 2026 security updates addressing hundreds of vulnerabilities, with one already being exploited in active attacks. The exploited flaw, tracked as CVE-2026-68820, exists in a Windows kernel driver called afd.sys that handles network socket operations. This vulnerability allows attackers who have already gained initial access to a system to escalate their privileges to SYSTEM level by triggering a race condition in the driver. According to Check Point Research, the Lazarus threat group has been using this zero-day exploit in their Operation Dream Job campaign, making it the top priority for patching despite its moderate severity score of 7.0.

The August release also includes four critical unauthenticated remote code execution vulnerabilities, each scoring 9.8 on the severity scale. These flaws affect Windows DNS Server, Windows Deployment Services, Microsoft's QUIC protocol implementation, and High Performance Computing Pack. While these vulnerabilities are more severe in theory because they require no user interaction or credentials to exploit, none have been observed in active attacks yet. Organizations should prioritize these patches based on whether they actually run the affected services and whether those services are exposed to potential attackers.

This month's updates also complete a two-part fix for a SharePoint vulnerability chain that Rapid7 Labs reported in May. The July update addressed CVE-2026-55040, an authentication bypass flaw that allowed attackers to impersonate SharePoint users. The August release now fixes CVE-2026-63520, the remote code execution component that could be combined with the bypass to achieve unauthenticated RCE. Organizations running on-premises SharePoint should ensure both patches are installed to fully protect against this attack chain.

For patch prioritization, security teams should first address CVE-2026-68820 on Windows systems where privilege escalation poses the greatest risk. Next, they should patch any exposed services vulnerable to the four unauthenticated RCE flaws, prioritizing based on actual service deployment and accessibility. Finally, administrators should verify that SharePoint farms have both the July and August updates installed to close the complete attack chain.

Stay secure — stay Wavasec. 🔐