Microsoft Patch Tuesday for August 2026 fixes 398 CVEs, including an actively exploited zero-day and a wormable DNS flaw enabling remote code execution.
Microsoft released its Patch Tuesday security updates for August 2026 on Tuesday, covering 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, .NET, and a range of other components. Sixty-two are rated Critical. One is already being exploited in the wild. The good news, such as it is, is that the ratio of bugs being reported to bugs being actively exploited hasn’t moved — there’s no equivalent surge in zero-day exploitation to match the volume of fixes.
The actively exploited bug is CVE-2026-68820, a use-after-free flaw in afd.sys, the kernel-mode driver that underpins the Windows Sockets API. CVE-2026-68820 is a Windows WinSock driver flaw that can let attackers execute code with SYSTEM-level privileges. Microsoft says it is actively exploited, although its CVSS assessment lists exploit maturity as “Unproven.”
“Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.” reads the advisory. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.”
The DNS bug, tracked as CVE-2026-62878, deserves immediate attention. CVE-2026-62878 is a critical Windows DNS Server flaw that allows remote, unauthenticated attackers to execute code with elevated privileges without user interaction. The stack-based buffer overflow could be wormable, making rapid patching especially important for internet-facing DNS servers.
“An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.” reads the advisory. “Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.”
A wormable remote code execution flaw with no authentication requirement on a service that’s almost universally exposed is exactly the kind of thing that turns into a widespread incident if patching lags.
Three other remote code execution bugs round out the urgent list. CVE-2026-62893 hits Windows Deployment Services TFTP server, TFTP has no authentication, runs on UDP port 69, and any WDS server doing PXE boot is exposed. CVE-2026-62815 is in Microsoft’s QUIC implementation, the transport protocol underlying HTTP/3, and affects roughly 13.5 million websites. CVE-2026-59124 is a CVSS 9.8 flaw in Microsoft HPC Pack that Microsoft itself rates as “exploitation more likely”, the Important severity rating reflects that HPC isn’t on by default, not that the bug is less dangerous.
The Exchange bug, CVE-2026-62911, is an elevation of privilege flaw via authentication bypass that was demonstrated with working code at Pwn2Own Berlin. If exploited successfully, an attacker can take over all mailboxes on the Exchange server — reading, sending, and downloading attachments across every user account. Microsoft’s exploitability ratings here are worth ignoring in favor of the Pwn2Own context: functional exploit code exists and was handed to Microsoft directly. Two publicly disclosed bugs — CVE-2026-62832 in Windows User Profile Service and CVE-2026-72971 in the Container Isolation FS Filter Driver — are also in this release, with the User Profile Service flaw considered likely to see exploitation. The August updates also fix two CVEs in the TPM 2.0 reference implementation, one spoofing and one information disclosure.
The full list of CVEs addressed by Microsoft Patch Tuesday security updates for August 2026 is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Microsoft Patch Tuesday)
