Microsoft Patches 398 Vulnerabilities, Including Exploited WinSock Driver Zero-Day

Microsoft’s latest monthly update fixes a high-risk Windows driver zero-day vulnerability alongside nearly 400 total flaws across its ecosystem. Tracked as CVE-2026-68820, the zero-day flaw represents an actively exploited local privilege escalation bug in afd.sys, the Ancillary Function Driver for WinSock. The Zero Day Initiative (ZDI) independent count puts the entire release at 398 new CVEs, including 62 rated Critical, making it one of the largest security update rollouts in recent memory.

While the majority of the monthly patches address unexploited vulnerabilities, active adversary activity around CVE-2026-68820 pushes it to the absolute front of the patching queue, followed closely by four unauthenticated remote code execution flaws carrying 9.8 CVSS scores.

Active Kernel Zero-Day (CVE-2026-68820)

The zero-day flaw, carrying a CVSS score of 7.0, resides in afd.sys, a core kernel-mode driver responsible for handling network socket operations and WinSock execution in Windows. The vulnerability is a use-after-free condition that can be triggered by exploiting a race condition in how the driver manages socket object state transitions in memory.

An attacker who has already obtained standard code execution on a vulnerable host—whether through phishing, initial access malware, or compromised low-privilege credentials—can exploit this flaw to execute arbitrary code in kernel space and immediately elevate privileges to NT AUTHORITY\SYSTEM.

Check Point Research attributed the in-the-wild exploitation of CVE-2026-68820 to the North Korean state-sponsored threat group Lazarus as part of their long-running “Operation Dream Job” campaign. Lazarus historically relies on kernel-level zero-days to blind endpoint security agents, dump memory credentials, and establish persistent administrative control following an initial spear-phishing compromise. Local privilege escalation in fundamental networking drivers like afd.sys provides an ideal vehicle for bypassing security boundaries because socket creation and handling are routine actions required by standard applications, making kernel race conditions difficult to detect prior to exploitation.

High-Impact Unauthenticated Remote Code Execution Flaws

In addition to the exploited kernel zero-day, the release includes four unauthenticated remote code execution (RCE) flaws that each carry a 9.8 CVSS severity rating. These flaws require no user interaction, no password, and no account access:

• CVE-2026-62878 (Windows DNS Server): A stack-based buffer overflow vulnerability triggered when handling malformed DNS network requests. The Zero Day Initiative characterizes the flaw as technically wormable due to its unauthenticated remote reachability without user interaction, although Microsoft currently assesses exploitation as less likely.
• CVE-2026-62893 (Windows Deployment Services): A remote code execution flaw in the service’s Trivial File Transfer Protocol (TFTP) processing mechanism, reachable by sending specifically crafted TFTP packets to an exposed WDS server.
• CVE-2026-62815 (Microsoft QUIC): A severe flaw in Microsoft’s implementation of the QUIC transport protocol, allowing unauthenticated remote code execution against endpoints hosting QUIC-enabled network stack interfaces.
• CVE-2026-59124 (HPC Pack): A remote code execution flaw in the High Performance Computing Pack. Despite its 9.8 CVSS score, Microsoft rates this vulnerability as Important rather than Critical because HPC Pack is not installed by default in standard Windows environments, though vendor guidance rates prospective exploitation as “more likely.”

The blast radius of these four bugs depends heavily on network positioning and attack surface exposure. Unauthenticated network vulnerabilities in core infrastructure components like DNS servers present high operational risk because compromising a primary domain controller or corporate DNS server grants immediate network-wide visibility and lateral movement opportunities.

Completing the SharePoint Exploit Chain

August’s update cycle also delivers the second half of a two-stage remediation for on-premises Microsoft SharePoint Server installations. Rapid7 Labs initially reported a chained vulnerability finding to Microsoft on May 18, demonstrating full unauthenticated remote code execution against on-premises SharePoint farms.

Microsoft opted to split the remediation across two monthly release cycles:

1. July 2026 Update: Issued a fix for CVE-2026-55040 (CVSS 9.1), a Critical authentication bypass vulnerability that allowed an attacker to spoof the identity of an arbitrary SharePoint site user or site administrator given a known target identity.
2. August 2026 Update: Issues the fix for CVE-2026-63520, the post-authentication remote code execution flaw that completes the original exploit chain.

Applying the July fix for CVE-2026-55040 effectively broke the demonstration chain by closing the initial authentication bypass mechanism. However, administrators managing on-premises SharePoint deployment farms must ensure the August update for CVE-2026-63520 is applied to neutralize the underlying code execution component completely.

Prioritization and Remediation Guidance

Security teams should establish a phased patching strategy based on threat activity and exposure rather than relying solely on raw CVSS scores:

1. Top Priority — Local Workstations and Servers: Deploy updates addressing CVE-2026-68820 across all endpoints immediately. Because Lazarus is actively exploiting this WinSock driver vulnerability to elevate privileges, any compromised host in the environment can be converted to full SYSTEM access without delay.
2. Second Priority — Perimeter & Network Infrastructure: Audit external and internal exposures for Windows DNS Server, WDS, QUIC, and HPC Pack components. Apply patches for CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124 to all hosts running these services. Block unneeded TFTP (UDP port 69) and DNS traffic at network perimeters where applicable.
3. Third Priority — On-Premises Collaboration: Verify that on-premises SharePoint Server instances have applied both the July patch for CVE-2026-55040 and the August patch for CVE-2026-63520.