Microsoft’s August 2026 Security Update: One Exploited Zero-Day, Four Server RCEs, and a SharePoint Chain

Patch prioritization is not a CVSS ranking exercise. This month’s release shows why exploitation in the wild, service exposure, and the file that establishes initial access matter more than raw severity, and where a Content Security Layer fits alongside patching.

Microsoft’s August 2026 security release is another unusually large update cycle, but patch volume alone does not determine operational risk. The exact count depends on the methodology used. The Zero Day Initiative tallied 398 newly addressed CVEs, while SecurityWeek counted 421 using a broader accounting method, and the number of Critical-rated flaws lands somewhere between 42 and 62 depending on whether Microsoft’s or ZDI’s severity assessment is applied. Anyone reconciling exact figures for a compliance report should treat that range as directional rather than exact.

What is not ambiguous is the exploitation picture. Three vulnerabilities were disclosed as zero-days, but only one, CVE-2026-68820, was identified as actively exploited when the updates shipped. The other two were publicly disclosed before a fix was available but had not been observed in attacks. Four additional vulnerabilities carry higher CVSS scores and allow unauthenticated remote code execution, while a separate SharePoint update completes the remediation of a two-part exploit chain disclosed earlier this year.

The release illustrates why patch prioritization cannot be reduced to a CVSS ranking. Exploitation in the wild, service exposure, attack prerequisites, system role, and the potential for lateral movement all matter. It also demonstrates an important relationship between vulnerability management and content security. A patch may close the privilege-escalation mechanism, but preventing the malicious file that establishes the attacker’s initial foothold can stop the chain before the vulnerable component is ever reached.

The Vulnerability Already Being Used in Attacks

CVE-2026-68820, with a CVSS score of 7.0, affects afd.sys, the Windows Ancillary Function Driver for WinSock. This kernel-mode driver is the backbone of the Windows Sockets API and manages socket-related operations. Microsoft rated it Important rather than Critical, a reminder that the severity label and the operational urgency are not the same thing.

Check Point Research, whose researchers Moshe Marelus and David Driker were credited with the discovery, describes the vulnerability as a race-condition-driven use-after-free. Under carefully controlled concurrent conditions, one code path can attempt to use socket state information after another has released it. Successful exploitation gives the attacker a kernel read/write capability that can be converted into local privilege escalation to SYSTEM.

This is not a vulnerability that gives an external attacker immediate access to a Windows machine. The attacker must already have code executing on the endpoint. The vulnerability then transforms that initial user-level compromise into complete system-level control. That prerequisite does not make the issue less urgent. Local privilege-escalation vulnerabilities are frequently paired with phishing, malicious downloads, browser exploits, exposed applications, or compromised credentials. Initial access gets the attacker onto the machine, and the privilege-escalation exploit removes many of the remaining restrictions.

This is the fourth afd.sys zero-day exploited in the wild since 2022, following CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. The last of those was also attributed to North Korean actors linked to the Lazarus group, which makes the driver a recurring target for the same class of adversary. In the campaign documented by Check Point, Lazarus used CVE-2026-68820 to deploy a new version of FudModule, its kernel-mode rootkit. The elevated malware could interfere with security telemetry, inject code into a SYSTEM process, and reduce the visibility available to endpoint security products.

This is why the 7.0 vulnerability may deserve priority over vulnerabilities with higher theoretical severity. It is not merely exploitable. It has already been incorporated into a working intrusion chain.

Operation Dream Job Shows the Complete Attack Path

The observed exploitation did not begin inside afd.sys. It began with content presented as an employment opportunity. Operation Dream Job uses highly targeted recruiting lures aimed particularly at defense, aerospace, and aviation personnel. Attackers pose as recruiters or representatives of recognizable companies and direct selected victims toward files associated with attractive job opportunities.

Check Point identified two related delivery chains. In the first, the victim downloads an encrypted ZIP archive containing a legitimate, digitally signed PDF viewer, a malicious DLL used for sideloading, and an encrypted payload disguised with a PDF extension. When the user starts the legitimate application, it loads the malicious DLL from the same directory. The DLL displays a decoy job description while decrypting and executing an embedded payload in memory. That payload deploys MISTPEN, performs reconnaissance, establishes persistence, retrieves additional modules, and ultimately invokes CVE-2026-68820 to reach SYSTEM.

The second chain uses a trojanized PDF viewer named SecurityPDF and a specially crafted file presented as an ordinary PDF. The modified viewer checks the document for an attacker-defined marker. If found, it extracts and decrypts an embedded executable, writes it to the temporary directory, and launches it. The resulting payload installs a newly documented backdoor called Troy.

The campaign also used impersonation websites and search-engine optimization to make the malicious viewer appear legitimate. This matters because the file may not arrive directly as a traditional email attachment. A victim could receive a supposed job document through a messaging platform and then be instructed to download the required secure viewer from a convincing website. The full chain can therefore be summarized as a progression from recruiting lure to encrypted archive or crafted PDF, then to a trojanized application or DLL sideloading, then to an in-memory downloader, then to CVE-2026-68820, then to SYSTEM privileges, and finally to a rootkit and backdoor.

Consider an aerospace company that legitimately receives resumes, job descriptions, and recruiting documents from external sources. Blocking every PDF or ZIP would be operationally unrealistic. A content-security policy can instead allow normal documents while isolating archives containing executables, blocking extension mismatches, and reconstructing safe document content. FileDNA CADR does not prevent CVE-2026-68820 directly. It can help prevent the malicious file chain that gives the attacker the code execution needed to exploit it.

That makes Content Security Layer complementary to patch management and endpoint security. Content controls reduce the chance of the initial foothold, the Microsoft patch removes the privilege-escalation path, and EDR or XDR monitors anything that still reaches execution.

Four Critical Flaws Require No Victim Action

The release also addresses four vulnerabilities with CVSS scores of 9.8 that require no credentials and no user interaction. None was identified as actively exploited when the patches shipped, but their technical characteristics make them high-priority issues wherever the affected services are installed and reachable.

CVE-2026-62878: Windows DNS Server

CVE-2026-62878 is a remotely reachable stack-based buffer overflow in Windows DNS Server. An unauthenticated attacker can potentially execute code with elevated privileges without convincing a user to open anything. It was the most severe of four Critical DNS Server RCEs in this cycle, and ZDI’s Dustin Childs characterized the flaw as wormable. That means it has technical characteristics that could support automated propagation, not that a working worm has been observed. In many Active Directory deployments the DNS role runs on domain controllers, which turns a DNS server compromise into an identity-infrastructure incident. Internet-facing Windows DNS servers require immediate attention, and internal DNS servers should not be ignored, because an attacker who compromises a workstation through phishing could use a remotely exploitable DNS flaw to move toward more privileged infrastructure.

FileDNA may help prevent the file-borne intrusion that places an attacker inside the network, but it does not inspect or sanitize DNS protocol traffic and is not a substitute for this patch.

CVE-2026-62893: Windows Deployment Services

CVE-2026-62893 is a use-after-free flaw in the TFTP handling used by Windows Deployment Services. TFTP provides no authentication mechanism and is commonly exposed over UDP port 69 in PXE-based deployment environments. Any vulnerable WDS server distributing Windows Imaging Format files through TFTP may be exposed. Even when the service is unavailable from the internet, it can become a lateral-movement target after an attacker gains internal network access. A corporate imaging network reachable from ordinary user VLANs is a practical example. A compromised laptop may be able to reach a WDS server even though the server is not externally exposed, so segmentation and service reachability matter as much as perimeter filtering.

FileDNA Content Security Layer can reduce file-originated initial access, but the WDS vulnerability must be addressed through patching, network segmentation, and restriction of TFTP access.

CVE-2026-62815: Microsoft QUIC

CVE-2026-62815 is a use-after-free flaw in Microsoft’s implementation of QUIC, the UDP-based transport protocol underlying HTTP/3, which is relied on by a large share of modern web services. The vulnerability allows unauthenticated remote code execution without user interaction. Organizations should identify systems actually using the affected Microsoft QUIC implementation rather than assuming that every endpoint or every HTTP/3-enabled service has equal exposure. Internet-facing services, reverse proxies, gateways, and internally exposed applications should be assessed first.

CVE-2026-59124: Microsoft HPC Pack

CVE-2026-59124 is another unauthenticated, network-reachable RCE with a 9.8 score. Microsoft rates it Important rather than Critical because HPC Pack is not installed by default, but also rates exploitation as more likely. The lower product rating should not translate into a lower operational priority for organizations that actually run HPC Pack. Research institutions, engineering environments, financial-modeling operations, and AI teams may operate valuable compute clusters with access to sensitive datasets, credentials, and high-performance infrastructure.

If an attacker’s first access comes through a document, archive, or other file, FileDNA CADR can reduce the likelihood of reaching the internal HPC environment. It cannot prevent exploitation of the HPC network service itself.

The SharePoint Exploit Chain Is Now Fully Patched

The August release also completes a two-part SharePoint remediation that began in July. Rapid7 Labs, through a zero-day research project led by Senior Principal Security Researcher Stephen Fewer and demonstrated at Pwn2Own Berlin, developed an exploit chain combining CVE-2026-55040, a critical authentication bypass scored at CVSS 9.1, with CVE-2026-63520, a SharePoint remote code execution vulnerability.

CVE-2026-55040 allows a remote unauthenticated attacker to assume the identity of a known SharePoint user or administrator through weaknesses in the JSON Web Token validation pipeline. Microsoft addressed that portion of the chain in July. CVE-2026-63520 is the code-execution component. It involves unsafe .NET type instantiation in Business Connectivity Services and can allow arbitrary code to run with the permissions of the Windows service account operating the affected SharePoint site. By itself it is not the unauthenticated portion of the attack. The unauthenticated RCE condition emerges when the two vulnerabilities are chained.

Rapid7 confirmed that installing the July fix for CVE-2026-55040 breaks the demonstrated unauthenticated chain, and the August update closes the RCE component as well. On-premises SharePoint Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition environments should therefore be checked for both updates.

Where SharePoint is concerned, FileDNA CSL can analyze files uploaded to, downloaded from, or shared through the platform when integrated into those content pathways. It can help prevent malicious Office documents, PDFs, archives, and other dangerous content from turning SharePoint into a trusted distribution point. It does not remediate SharePoint authentication bypasses, unsafe .NET object instantiation, or crafted web requests that directly exploit the application. The SharePoint patches remain mandatory.

Division of Responsibility

A Risk-Based Patch Order

Organizations should begin with CVE-2026-68820 across relevant Windows endpoints, particularly in defense, aerospace, aviation, and other sectors likely to receive targeted recruiting approaches. Security teams should also search for evidence of suspicious encrypted archives, modified PDF viewers, DLL sideloading, and job-themed files already delivered before patch deployment.

The four unauthenticated RCEs should be prioritized according to actual exposure. An internet-facing vulnerable DNS or QUIC service may require remediation at the same time as, or even ahead of, some endpoints affected by the local privilege-escalation bug. WDS and HPC Pack should be located through service inventory rather than assumed absent, and internal reachability should be reviewed. On-premises SharePoint administrators should confirm that both CVE-2026-55040 and CVE-2026-63520 are patched, because installing only the August update without verifying the July remediation leaves unnecessary uncertainty around the farm’s security state.

Finally, organizations should examine the gap between external content delivery and endpoint execution. The Lazarus campaign succeeded by making dangerous content look like a normal business interaction. Patching closes the known kernel flaw, but attackers can replace one escalation technique with another. The durable defensive lesson is to combine rapid patching with a Content Security Layer that examines what a file actually contains before allowing it to become executable activity.

References

CVE counts vary by source and methodology; figures are cited as reported by each publication as of publication date. Verify affected build lists and KB identifiers against Microsoft’s Security Update Guide before deployment.