Microsoft’s August security update addresses CVE-2026-68820 — a privilege escalation vulnerability in the Windows kernel driver afd.sys that, according to Microsoft, is already being exploited in real-world attacks. Despite its CVSS score of 7.0, this is the vulnerability that should go to the front of the patching queue, ahead of four RCE vulnerabilities rated 9.8. By Zero Day Initiative’s count, the release contains 398 new CVEs, 62 of which are rated Critical. In addition to the zero-day, the update completes a two-stage fix for a SharePoint attack chain that began in July.
CVE-2026-68820: use-after-free in the Windows kernel
The CVE-2026-68820 vulnerability affects the afd.sys component (Ancillary Function Driver for WinSock) — a kernel-mode driver that handles network socket operations. According to Check Point Research, the vulnerability is a use-after-free issue that is exploited via a race condition in the driver.
To exploit it, an attacker first needs to achieve code execution on the target machine, after which the vulnerability allows privilege escalation to SYSTEM level. It is the only vulnerability in the August release that Microsoft has flagged as being actively exploited. Microsoft has not disclosed any attribution for the observed exploitation.
Threat context: links to Lazarus
Check Point Research associates exploitation of CVE-2026-68820 with the Lazarus group and its Operation Dream Job campaign. It should be emphasized that this attribution comes from a single research source and has not been independently confirmed. Operation Dream Job is a long-running campaign in which Lazarus uses fake job offers for initial compromise of targets, primarily in the technology and defense sectors.
The attack flow is logical: a phishing email with a “job offer” provides initial code execution, and CVE-2026-68820 is then used to escalate privileges to SYSTEM — a critical step for gaining persistence on the system and moving laterally across the network.
Four unauthenticated CVSS 9.8 vulnerabilities
Four remote code execution vulnerabilities require no action from the victim — no account, no password, no click. All are assigned a CVSS score of 9.8:
- CVE-2026-62878, Windows DNS Server — a remotely reachable, unauthenticated stack-based buffer overflow. Zero Day Initiative describes the conditions as potentially wormable, although Microsoft rates the likelihood of exploitation as low. Important: the term “wormable” describes a technical possibility, not the existence of an actual worm.
- CVE-2026-62893, Windows Deployment Services — a remote vulnerability exploited via unauthenticated TFTP processing, with no user interaction required.
- CVE-2026-62815, Microsoft QUIC — remote code execution without authentication and without user interaction.
- CVE-2026-59124, HPC Pack — despite its CVSS score of 9.8, it is classified as Important rather than Critical because HPC Pack is not installed by default. However, Microsoft rates the likelihood of exploitation as high.
None of the four vulnerabilities had been flagged as exploited at the time of the update’s release. The practical priority for each of them depends on whether the corresponding service is deployed in a given environment and whether it is exposed externally.
Completing the SharePoint attack chain
The August update closes the second part of a SharePoint exploit chain discovered by Rapid7 Labs. Available data indicates that the chain combines authentication bypass with remote code execution, enabling unauthenticated RCE on on-premises SharePoint farms.
The July update fixed CVE-2026-55040 — a Critical authentication bypass with a CVSS score of 9.1. According to Rapid7, this vulnerability allows a remote, unauthenticated attacker to assume the identity of a SharePoint site user or administrator, provided the attacker knows the target account.
The August patch addresses CVE-2026-63520 — the remote code execution component. A key point: CVE-2026-63520 by itself does not provide unauthenticated access. It was the combination of the two vulnerabilities in a chain that created a full attack vector. According to Rapid7, installing the July patch for CVE-2026-55040 already breaks the demonstrated chain; however, both updates are required to fully eliminate the risks.
Prioritization and recommendations
Recommended patch installation order:
- CVE-2026-68820 — deploy immediately on all Windows systems. Active exploitation is confirmed, despite the relatively modest CVSS score. Pay particular attention to systems where initial code execution is plausible via phishing or other vectors.
- CVE-2026-62878, CVE-2026-62893, CVE-2026-62815 — prioritize for servers running DNS, WDS and QUIC that are accessible from external networks. Perform an inventory: if the service is not deployed, the risk is absent.
- CVE-2026-59124 — only where HPC Pack is installed.
- CVE-2026-55040 and CVE-2026-63520 — check on-premises SharePoint farms to ensure both patches (July and August) are installed.
CVE-2026-62878 in DNS Server deserves particular attention: ZDI’s “wormable” designation means that once a working exploit appears, an attack could propagate automatically between DNS servers without human intervention. Organizations with externally accessible Windows DNS servers should treat this patch as a top priority on par with the zero-day.
With 398 CVEs in a single release, the key principle is not to try to fix everything at once, but to build a queue based on three criteria: confirmed exploitation (CVE-2026-68820), external exposure of the service (DNS, WDS, QUIC), and the presence of the vulnerable component in your infrastructure. For organizations with on-premises SharePoint farms, it is critical to verify that both patches are in place — the July patch for CVE-2026-55040 and the August patch for CVE-2026-63520 — because neither of them alone addresses all components of the demonstrated attack chain.
