Microsoft's August security release landed on Tuesday with fixes for roughly 400 vulnerabilities. One of them, a flaw in a Windows networking driver, was already being used by attackers before the patch existed, and two more had been described in public before a fix was ready.
The exact total depends on who is counting. Microsoft's advisories for the day add up to about 400, while the Zero Day Initiative, which tallies new CVE entries, arrived at 398. That is well short of July's record of 570, but it is still an enormous amount of patching for one month. Microsoft has said the numbers will stay high because it now runs AI based scanning across its own code and keeps finding old bugs.
The driver bug already under attack
The flaw that should go to the top of every list is CVE-2026-68820. It lives in afd.sys, the kernel driver behind Windows socket networking, and it is a use after free that can be triggered through a race condition. It does not let anyone in from outside. What it does is let somebody who is already running code on a machine as an ordinary user climb to SYSTEM, the highest privilege level on Windows.
That is why its severity score of 7.0 undersells it. Privilege escalation bugs are the second step in most real intrusions, and this one was found because it was being used. Researchers at Check Point reported it, and the company says the North Korean group Lazarus exploited it during its long running Operation Dream Job campaign to install a new version of FudModule, a rootkit that runs in the kernel. Microsoft confirms the exploitation but has not said who was responsible.
The two flaws that were public before the fix are also local privilege problems. CVE-2026-62832 affects the Windows User Profile Service and can hand an attacker administrator rights. CVE-2026-72971 is a tampering issue in unionfs.sys, a filter driver used for container isolation. Neither was known to be exploited when the updates shipped.
Four server flaws that need no login
Behind the driver bug come four remote code execution vulnerabilities, each rated 9.8 out of 10. None requires an account, a password or a click from a victim.
- Windows DNS Server (CVE-2026-62878): a stack buffer overflow reachable over the network. The Zero Day Initiative considers it wormable in principle, although Microsoft rates exploitation as less likely.
- Windows Deployment Services (CVE-2026-62893): reachable through the way the service handles TFTP.
- Microsoft QUIC (CVE-2026-62815): a flaw in the QUIC networking stack that Microsoft ships with Windows.
- HPC Pack (CVE-2026-59124): rated Important instead of Critical only because the product is not installed by default. Microsoft thinks this one is more likely to be exploited.
How urgent these are for a given network depends on whether the service is actually running and reachable. A domain controller that also serves DNS is a very different matter from a workstation.
SharePoint needs both halves
The release also finishes a repair that Microsoft deliberately split in two. Back in May, Rapid7 showed Microsoft how two SharePoint bugs could be strung together: one that skips the login check and another that runs code on the server. Used as a pair, they let an attacker with no credentials at all execute code. July's updates fixed the bypass, CVE-2026-55040. August fixes the code execution part, CVE-2026-63520.
Anyone who skipped July and installs only this month's update is still exposed to the first half. Organizations that run SharePoint on their own servers should check that both are in place.
For teams that cannot patch everything at once, the order is fairly clear: the exploited driver bug on all Windows systems, then any exposed DNS, deployment, QUIC or HPC servers, then SharePoint.
