Microsoft August 2026 Patch Tuesday fixes 421 CVEs, including exploited flaw

Microsoft August 2026 Patch Tuesday fixed 421 unique CVEs, including a Windows privilege-escalation vulnerability that Check Point says was used by the Lazarus group before the update. The release on August 11 included 44 vulnerabilities Microsoft rated Critical, according to Dark Reading, making exposure-based triage more useful than treating the CVE total as a single queue.

The first Windows fix to deploy is CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock. Microsoft said a locally authenticated attacker could trigger a race condition with a specially made application and execute code with SYSTEM-level privileges, without any user action.

That local-authentication requirement makes the bug primarily a privilege-escalation concern after an attacker has obtained a foothold, rather than a standalone remote entry point. But SYSTEM access can give an intruder broad control of the affected device.

Which Microsoft August 2026 Patch Tuesday vulnerabilities should teams prioritize?

• CVE-2026-68820: Patch first. Dark Reading reported active exploitation, while The Register reported that Check Point observed activity from attackers it identified as Lazarus beginning in June.
• CVE-2026-62832: Assess promptly. It was publicly known before the August update, and Microsoft rated exploitation as more likely. The company said a locally authenticated attacker could access or change another user’s data and obtain administrator privileges.
• CVE-2026-62878: Prioritize Windows DNS Server deployments, particularly internet-facing instances. The CVSS 9.8 remote-code-execution bug needs no user interaction; Zero Day Initiative’s Dustin Childs described it as wormable.
• CVE-2026-62815: Review systems using Microsoft’s QUIC implementation. Dark Reading reported a CVSS 9.8 remote-code-execution issue that requires neither authentication nor user interaction.
• CVE-2026-62893: Test and deploy the fix quickly where Windows Deployment Services and its TFTP Server are in use. The Register reported it as an unauthenticated remote-code-execution vulnerability.

Check Point linked the reported exploitation of CVE-2026-68820 to a DreamJob campaign aimed at defense organizations in Europe and India. The firm said attackers used fraudulent job sites impersonating Lockheed Martin and Enveil, alongside a modified PDF viewer called SecurityPDF and a backdoor it named Troy. The Lazarus attribution is based on Check Point’s reported observations and should remain attributed to the firm.

Microsoft’s August volume followed 622 CVEs in July, according to Dark Reading. Of the August total, 236 affected Windows, 98 affected Office and Office 2016 respectively, and 180 were elevation-of-privilege issues. Those figures do not mean every team faces the same patching burden: cumulative updates cover substantial portions of the Windows and Office fixes, while server roles and exposed services require separate attention.

For operators, the practical response is to identify exposed DNS, WDS and QUIC services, deploy the actively exploited Windows fix, then sequence remaining updates around the products actually in use. That work belongs within an enterprise security program that combines technical controls with policies, people, monitoring and recovery planning.

This story draws on original reporting from The Register.