Patch Tuesday turned into Patch Tsunami: Microsoft rolled out fixes for 398 vulnerabilities, and among them is a kernel driver bug already being abused in the wild. If you like surprises, this update delivers them in bulk.

What Microsoft patched this month

The headline here is a kernel networking driver vulnerability tracked as CVE-2026-68820. It lives in the Windows ancillary function driver for WinSock (afd.sys) and is a race/use-after-free style bug that lets code already running on a machine climb to SYSTEM. Microsoft flagged it as an actively exploited zero-day, so treat systems where an attacker could already run code as high-risk.

Beyond that, there are four nasty remote code execution flaws that require nothing from a victim — no account, no click, no helpless hamster pedal. Each carries a high score (9.8) and can let an attacker drop code on a reachable service. Here’s the short roster:

  • CVE-2026-62878 — Windows DNS Server: a remote stack-based buffer overflow reachable without authentication. The Zero Day Initiative labeled it technically wormable, so don’t ignore network-exposed DNS servers.
  • CVE-2026-62893 — Windows Deployment Services (WDS): an unauthenticated remote flaw via the service’s TFTP handling.
  • CVE-2026-62815 — Microsoft QUIC implementation: remote, unauthenticated code execution without user interaction.
  • CVE-2026-59124 — HPC Pack: also scored 9.8, but rated Important rather than Critical because HPC Pack isn’t installed by default; exploitation is considered more likely if present and reachable.

There’s also a two-part SharePoint fix: July’s update dealt with an authentication bypass (CVE-2026-55040) and August completes the chain by patching the code-execution component (CVE-2026-63520). If you run on-premises SharePoint, both updates are required to stop the chain that researchers showed could lead to unauthenticated RCE.

How to prioritize these updates

Quick, practical plan (no drama, just do it):

  • Top priority: patch systems where an attacker could already run code — that’s where CVE-2026-68820 matters most because it can be used to reach SYSTEM from existing footholds.
  • Next up: harden and update any machines exposing DNS Server, WDS, QUIC, or HPC services to the internet or untrusted networks. Those unauthenticated RCEs are the fastest route for attackers to get code execution on servers.
  • SharePoint admins: confirm you installed July’s authentication-bypass fix (CVE-2026-55040) and now the August RCE fix (CVE-2026-63520). Both are needed to fully close the demonstrated exploit chain.
  • Inventory and reachability: if a vulnerable service isn’t present or is firewalled off, its practical priority drops. If it is present and reachable, raise the priority.
  • Other good habits: test updates in staging where feasible, schedule reboots, apply patches during maintenance windows, watch logs for unusual activity, and block or restrict services you don’t need.

In short: fix the kernel bug on machines with suspicious activity first, patch exposed server services next, and make sure your on-prem SharePoint farms have both halves of the fix. Then pour yourself a beverage — you earned it (briefly) before the next Patch Tuesday arrives.