Microsoft shipped its August 2026 Patch Tuesday bundle on Tuesday, addressing 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, and .NET, with 62 rated Critical. The release closes one actively exploited zero-day — CVE-2026-68820, a use-after-free in the Windows WinSock driver afd.sys — and a wormable, unauthenticated remote code execution flaw in Windows DNS Server, CVE-2026-62878. The WinSock bug lets an authorized attacker win a race condition and reach SYSTEM privileges, while the DNS bug is a stack-based buffer overflow reachable with a single crafted network packet.

The August release in numbers

Microsoft's August 2026 Patch Tuesday covers 398 new CVEs spanning Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, .NET, and a range of other components. Sixty-two of the fixes are rated Critical, and exactly one of the addressed vulnerabilities is already being exploited in the wild. Notably, the ratio of bugs reported to bugs actively exploited has not shifted — despite the unusually large release, there is no corresponding surge in zero-day exploitation.

Actively exploited WinSock zero-day: CVE-2026-68820

The flaw under active attack is CVE-2026-68820, a use-after-free in afd.sys, the kernel-mode driver that underpins the Windows Sockets API. Per Microsoft, a use-after-free in the Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally, and successful exploitation delivers SYSTEM-level privileges — provided the attacker wins a race condition.

Microsoft marks the bug as actively exploited, yet its CVSS assessment still lists exploit maturity as "Unproven." Independent tracking disagrees with the low profile: the CVE carries a CVSS base score of 7.0 and already appears in the CISA Known Exploited Vulnerabilities catalog, per the VulnRadar alert tracker. NVD published its record for the vulnerability on August 11, 2026.

Wormable RCE in Windows DNS Server: CVE-2026-62878

The item that deserves immediate attention is CVE-2026-62878, a critical stack-based buffer overflow in the Windows DNS Server. An unauthenticated attacker can trigger it remotely by sending a specially crafted packet to an affected service over the network; no authentication and no user interaction are required. Successful exploitation lets the attacker execute code on the target system.

Because DNS servers are almost universally exposed on the internet and the overflow could be wormable, rapid patching is essential — a self-propagating remote code execution bug with no authentication requirement is exactly the kind of flaw that turns into a widespread incident when patching lags.

Three more RCEs that deserve priority

Three further remote code execution bugs round out the urgent list:

  • CVE-2026-62893 affects the Windows Deployment Services TFTP server. TFTP has no authentication and runs on UDP port 69, so any WDS server performing PXE boot is exposed.
  • CVE-2026-62815 is in Microsoft's QUIC implementation, the transport protocol underlying HTTP/3, and affects roughly 13.5 million websites.
  • CVE-2026-59124 is a CVSS 9.8 flaw in Microsoft HPC Pack that Microsoft itself rates as "exploitation more likely." The Important severity rating reflects the fact that HPC is not enabled by default — not that the bug is less dangerous.

Exchange bypass proven at Pwn2Own: CVE-2026-62911

CVE-2026-62911 is an elevation of privilege flaw in Exchange Server that works via an authentication bypass and was demonstrated with working code at Pwn2Own Berlin. If exploited successfully, an attacker can take over all mailboxes on the server — reading, sending, and downloading attachments across every user account. Microsoft's exploitability ratings should be read in the light of that Pwn2Own context: functional exploit code exists and was handed directly to Microsoft.

Other notable fixes

Two publicly disclosed bugs are also in this release: CVE-2026-62832 in the Windows User Profile Service, which is considered likely to see exploitation, and CVE-2026-72971 in the Container Isolation FS Filter Driver. The August updates additionally patch two CVEs in the TPM 2.0 reference implementation — one spoofing issue and one information disclosure. Microsoft published the full list of addressed CVEs alongside the release.

Detection and mitigation

Microsoft has shipped updates for all of the flaws described above through its standard Patch Tuesday channels; deployment should be prioritized by exposure:

  • Patch internet-facing Windows DNS servers first. CVE-2026-62878 requires no authentication and no user interaction, and the overflow may be wormable.
  • Restrict or disable WDS TFTP on UDP port 69 where PXE boot services are not in active use, shrinking the attack surface for CVE-2026-62893.
  • Treat Exchange servers as high risk until CVE-2026-62911 is patched, given that working exploit code already exists from Pwn2Own Berlin.
  • For CVE-2026-68820, monitor endpoints for local privilege escalation activity; successful exploitation depends on winning a race condition in afd.sys.

Technical background

Use-after-free bugs arise when a program keeps using memory after it has been freed. An attacker who can reallocate that memory with controlled data can steer the subsequent access into arbitrary code execution. Because the outcome hinges on precise memory timing, such bugs are often hard to trigger reliably and frequently require a race condition — which is why Microsoft's description of CVE-2026-68820 stresses the race even though the bug is already being exploited.

Stack-based buffer overflows, the class behind CVE-2026-62878, occur when a function writes more data into a fixed-size stack buffer than it can hold, overwriting adjacent control data such as the saved return address. In a network service, a single oversized or malformed packet can overflow the buffer and redirect execution into attacker-controlled code. When the vulnerable code path requires no authentication and the service listens on the open internet, the bug can propagate from host to host on its own — the definition of wormable.