Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Microsoft has released its August security update, addressing 398 vulnerabilities including CVE-2026-68820, a privilege escalation flaw in the Ancillary Function Driver for WinSock (afd.sys) that is under active exploitation by the Lazarus Group. This zero-day allows attackers with existing code execution to elevate privileges to SYSTEM and requires immediate patching.

Additionally, the release fixes four critical remote code execution bugs (CVSS 9.8) that require no user interaction or authentication, affecting Windows DNS Server (CVE-2026-62878), Windows Deployment Services (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815), and HPC Pack (CVE-2026-59124). Administrators should also apply the patch for CVE-2026-63520 to fully mitigate a SharePoint attack chain that combines this RCE with the previously fixed authentication bypass CVE-2026-55040.