According to Microsoft’s monthly security updates released on Tuesday, August 11, 2026, a core Windows kernel driver vulnerability tracked as CVE-2026-68820 is under active exploitation in real-world attacks. Check Point Research attributes the zero-day exploit to the Lazarus group during their Operation Dream Job campaign, utilizing the bug to escalate privileges to SYSTEM once code is already running on a machine.
Understanding Windows Kernel Driver CVE-2026-68820 Exploitation
The actively exploited vulnerability carries a CVSS score of 7.0 and resides in afd.sys,
which is the Ancillary Function Driver for WinSock and a kernel-side component of Windows networking. According to Check Point Research, the flaw functions as a use-after-free bug. An attacker requires initial code execution on a target machine before triggering a race condition within the driver to reach SYSTEM level privileges.
Pro Tip: Prioritize patching CVE-2026-68820 immediately on Windows endpoints where attackers might have established initial code execution, as privilege escalation follows close behind.
Critical Unauthenticated Remote Code Execution Flaws
Four separate vulnerabilities carrying maximum CVSS scores of 9.8 require no user interaction, account, or password to compromise systems, according to Microsoft’s advisory. The Zero Day Initiative (ZDI) tallies the total August update release at 398 new Common Vulnerabilities and Exposures (CVEs), with 62 rated Critical. Organizations must queue these unauthenticated remote code execution flaws directly behind the actively exploited driver bug.
- CVE-2026-62878: A stack-based buffer overflow in Windows DNS Server reachable remotely without authentication. The Zero Day Initiative describes the technical condition as
wormable,
though Microsoft rates exploitation as less likely and ZDI notes this label does not confirm an existing worm. - CVE-2026-62893: A remote vulnerability affecting Windows Deployment Services through the service’s TFTP handling without requiring user interaction or authentication.
- CVE-2026-62815: A remote code execution flaw in Microsoft QUIC transport protocol implementation requiring zero user interaction.
- CVE-2026-59124: A High Performance Computing (HPC) Pack vulnerability scored at 9.8 but rated Important because HPC Pack is not installed by default.
Practical deployment priority depends heavily on service inventory and network reachability. Security teams must verify whether exposed DNS, WDS, QUIC, or HPC services run in their environments before scheduling mitigation windows.
Completing the Two-Part SharePoint Authentication Bypass Chain
The August security release delivers the second half of a critical SharePoint remediation chain originally reported to Microsoft by Rapid7 Labs on May 18, 2026. Rapid7 demonstrated an exploit combining an authentication bypass with a remote code execution vulnerability to achieve unauthenticated RCE against on-premises SharePoint farms.
July’s updates initiated the fix by addressing CVE-2026-55040, a 9.1-scored authentication bypass that allowed remote unauthenticated attackers to assume the identity of known site users or administrators. Rapid7 confirmed that installing the July patch breaks the demonstrated exploit chain by closing the initial impersonation vector. The August deployment introduces CVE-2026-63520, which patches the separate code execution component. On-premises SharePoint administrators must confirm that both the July authentication bypass and the August RCE update are fully installed.
Did You Know? Independent tallying by the Zero Day Initiative places the August 2026 Microsoft patch bundle at nearly 400 new CVEs, showcasing the massive scale modern security teams manage monthly.
Frequently Asked Questions
What is CVE-2026-68820?
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver (afd.sys) with a CVSS score of 7.0. Microsoft confirmed it is actively exploited in the wild to achieve SYSTEM-level privilege escalation.
Are the 9.8-scored RCE vulnerabilities being actively exploited?
According to Microsoft’s advisory data, none of the four 9.8-scored unauthenticated remote code execution flaws affecting Windows DNS Server, Windows Deployment Services, Microsoft QUIC, or HPC Pack were flagged as actively exploited when the updates shipped.
Does patching SharePoint require multiple updates?
Yes. On-premises SharePoint farms require a two-part fix split across July and August 2026. July addressed the authentication bypass (CVE-2026-55040), while August resolves the code execution component (CVE-2026-63520).
Take Action Now: Ensure your security operations center reviews asset inventories against these newly patched vectors. Leave a comment below with your patch management questions, or subscribe to our newsletter for real-time vulnerability alerts.
Keep reading