cyber.hendryadrian.com
Security News · thehackernews.com

Microsoft Patches 398 Flaws, Including Actively Exploited Windows Driver Zero-Day

· Original article ↗

Summary

Microsoft’s August updates address 398 CVEs, including actively exploited Windows driver flaw CVE-2026-68820 and four unauthenticated RCE flaws. Check Point Research attributes the zero-day’s use to Lazarus; Microsoft has not publicly attributed it.

Key points

  • CVE-2026-68820 is an actively exploited use-after-free in the Windows afd.sys driver that can let an attacker with existing code execution escalate to SYSTEM.
  • Microsoft has not publicly attributed exploitation of CVE-2026-68820; Check Point Research says Lazarus used it in Operation Dream Job.
  • Four unauthenticated RCE flaws, each rated CVSS 9.8, affect Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack; none was flagged as exploited when the updates shipped.
  • The Zero Day Initiative counted 398 new CVEs in the release, including 62 rated Critical.
  • The August update fixes the RCE component of a SharePoint chain; the July fix for CVE-2026-55040 breaks the demonstrated unauthenticated chain, and CVE-2026-63520 addresses its RCE component.
  • Prioritize patches based on active exploitation, service exposure, and whether affected components are installed; HPC Pack is not installed by default.

Article Details

Event Type
Microsoft Patch Tuesday security update addressing 398 vulnerabilities, including an actively exploited Windows kernel driver flaw, four unauthenticated remote code execution vulnerabilities, and the completion of a SharePoint exploit-chain fix.
Impact
CVE-2026-68820 affects the Windows kernel driver afd.sys and can allow an attacker with code already running on a system to escalate privileges to SYSTEM. Check Point Research attributed its use in attacks to Lazarus; Microsoft has not publicly attributed the exploitation. Four unauthenticated RCE flaws affect Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack. The updates also fix the RCE component of a SharePoint chain; the article says the chain required CVE-2026-55040 together with CVE-2026-63520.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationCVE-2026-68820 is described as a privilege-escalation flaw that can let an attacker with code already running reach SYSTEM.

CVE

CVE-2026-55040#CVE-2026-68820 #afd.sysCVE-2026-59124CVE-2026-59124, HPC Pack. It carries the same 9.8 score but is rated Important rather than Critical because HPC Pack is not installed by default.CVE-2026-62815CVE-2026-62815, Microsoft QUIC. A remote, unauthenticated code execution flaw requiring no user interaction.CVE-2026-62878CVE-2026-62878, Windows DNS Server. A stack-based buffer overflow reachable remotely with no authentication and no user interaction.CVE-2026-62893CVE-2026-62893, Windows Deployment Services.CVE-2026-63520#CVE-2026-68820 #afd.sysCVE-2026-68820Microsoft’s latest Patch Tuesday fixes an actively exploited Windows kernel driver flaw, CVE-2026-68820, which can let an attacker escalate to SYSTEM.

Threat Actors

LazarusCheck Point Research said Lazarus used CVE-2026-68820 in its Operation Dream Job campaign; Microsoft has not publicly attributed the exploitation.

Vendors

MicrosoftMicrosoft’s latest Patch Tuesday fixes an actively exploited Windows kernel driver flaw, CVE-2026-68820, which can let an attacker escalate to SYSTEM.

Products

HPC PackIt also closes four unauthenticated 9.8-rated remote code execution bugs in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack, plus the remaining half of a SharePoint attack chain.Microsoft QUICIt also closes four unauthenticated 9.8-rated remote code execution bugs in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack, plus the remaining half of a SharePoint attack chain.Microsoft SharePointIt also closes four unauthenticated 9.8-rated remote code execution bugs in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack, plus the remaining half of a SharePoint attack chain.Microsoft WindowsMicrosoft’s latest Patch Tuesday fixes an actively exploited Windows kernel driver flaw, CVE-2026-68820, which can let an attacker escalate to SYSTEM.Windows Deployment ServicesIt also closes four unauthenticated 9.8-rated remote code execution bugs in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack, plus the remaining half of a SharePoint attack chain.Windows DNS ServerIt also closes four unauthenticated 9.8-rated remote code execution bugs in Windows DNS Server, Windows Deployment Services, Microsoft QUIC, and HPC Pack, plus the remaining half of a SharePoint attack chain.

Related Articles