August 2026 Patch Tuesday: Microsoft Fixes 398 Vulnerabilities, Including a Zero-Day and a Wormable RCE

August Release Includes 398 Fixes

Microsoft released its August 2026 Patch Tuesday security updates on August 12, 2026. The release addresses 398 vulnerabilities across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, .NET, and other components.

Sixty-two flaws are rated Critical. One is being actively exploited, while two have been publicly disclosed.

Exact version numbers of affected products have not been disclosed. Affected components also include the TPM 2.0 reference implementation, with a spoofing vulnerability and an information disclosure flaw.

CVE-2026-68820: Zero-Day in the WinSock Driver

The most urgent vulnerability is CVE-2026-68820, found in the kernel-mode driver afd.sys, which supports the Windows Sockets API.

It is a use-after-free issue leading to local privilege escalation. An authorized attacker who already has code execution on the system must win a race condition to gain SYSTEM privileges.

Microsoft confirms active exploitation. However, the CVSS assessment lists exploit maturity as “Unproven”, meaning it does not yet consider a reliable exploit to be publicly available.

This is the zero-day of this release.

DNS Flaw Could Enable Automatic Propagation

CVE-2026-62878 affects Windows DNS Server and is rated Critical. The vulnerability is a stack-based buffer overflow that can allow remote code execution with elevated privileges.

No authentication or user interaction is required: a specially crafted network packet sent to a vulnerable service is enough. The flaw can therefore be wormable, especially when the DNS server is exposed to the Internet, risking rapid spread among reachable systems.

Other RCE vulnerabilities that require urgent attention include:

• CVE-2026-62893, in the TFTP server of Windows Deployment Services. TFTP does not require authentication and uses UDP port 69; the risk concerns WDS servers offering PXE boot.
• CVE-2026-62815, in the Microsoft QUIC implementation used by HTTP/3 transport. The potential impact is estimated at around 13.5 million websites.
• CVE-2026-59124, in Microsoft HPC Pack, with CVSS 9.8. Microsoft considers exploitation more likely. The Important rating is because HPC Pack is not enabled by default.

Exchange, Public Vulnerabilities, and Operational Priorities

CVE-2026-62911 affects Exchange Server with an authentication bypass that can lead to privilege escalation. A working exploit was demonstrated at Pwn2Own Berlin and delivered to Microsoft.

Compromise could allow access to all mailboxes on the server, including reading messages, sending, and downloading attachments for every account. The functional code demonstrated during the competition is a risk factor, regardless of Microsoft's exploitability assessment.

Additionally, the following have been publicly disclosed:

• CVE-2026-62832, in the Windows User Profile Service, likely to be exploited;
• CVE-2026-72971, in the Container Isolation FS Filter Driver.

Administrators should apply the August 2026 updates quickly, prioritizing:

1. Internet-facing DNS servers;
2. WDS servers and TFTP services reachable on UDP port 69;
3. systems using Microsoft QUIC;
4. HPC Pack installations;
5. Exchange servers.

It is also necessary to verify the exposure of DNS and TFTP services, and to monitor systems for anomalous activity related to privilege escalation, unusual mailbox access, or unexpected traffic to vulnerable services.