With the August patch day, Microsoft closes 421 security vulnerabilities, more than 60 of them critical. This time the focus shifts clearly toward the kernel and the cloud. Only one vulnerability is already being actively exploited, and two others were publicly known before the patch.
Actively exploited: flaw in the WinSock driver
The only actively exploited vulnerability is CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock. The afd.sys driver forms the foundation of the Windows sockets interface and runs in the kernel. A use-after-free via a race condition lets a locally logged-in attacker with low privileges jump to SYSTEM, without any user interaction. The CVSS rating is 7.0, and the US agency CISA added the flaw to its KEV catalog on August 11. The North Korean group Lazarus has been actively exploiting the vulnerability since June or July 2026 to load a new version of its FudModule kernel rootkit. It was reported by the Check Point team.
Two other flaws were publicly known before patch day. CVE-2026-62832 in the Windows User Profile Service elevates local privileges to administrator level through a link-following weakness, and Microsoft considers an attack likely. CVE-2026-72971 in the Container Isolation FS Filter Driver unionfs.sys allows modifying access to other users' files through the same weakness, but at CVSS 5.5 it's rated unlikely to be exploited.
Critical remote code execution
The most dangerous flaws of the month allow remote code execution without authentication. CVE-2026-62878 in the Windows DNS Server reaches CVSS 9.8 and is based on a stack-based buffer overflow that an attacker can trigger unauthenticated over the network. The attack can in principle spread worm-like from system to system. CVE-2026-62893 in the TFTP server of Windows Deployment Services reaches the same score, since the Trivial File Transfer Protocol has no authentication and listens openly on UDP port 69. Microsoft QUIC is also vulnerable through CVE-2026-62815 at CVSS 9.8, where code execution succeeds through the network protocol itself. CVE-2026-59124 in HPC Pack and CVE-2026-65791 in the iSCSI Target Service also sit at 9.8, both exploitable remotely and without authentication.
Top scores in Azure and Microsoft 365
Three vulnerabilities outside classic Windows reach the maximum CVSS 10.0. CVE-2026-56162 in Azure SQL Database is based on faulty authentication that lets an attacker elevate privileges unauthenticated over the network. CVE-2026-63508 in Microsoft Planetary Computer Pro and CVE-2026-65667 in Microsoft Teams reach the same score, both fixed server-side. Just below are several cloud privilege escalations rated CVSS 9.9, including CVE-2026-50481 in Azure Active Directory, CVE-2026-59115 in the Entra Provisioning Service, and CVE-2026-62830 in the Azure SRE Agent. CVE-2026-50515 in Azure Service Bus allows remote code execution at the same score.
Exchange, SharePoint, and Office
Exchange Server contains CVE-2026-62911, a privilege escalation via authentication bypass rated CVSS 8.0. If the attack succeeds, an attacker can take over all mailboxes, read and send messages, and download attachments. That exact attack succeeded with a working exploit at Pwn2Own 2026 in Berlin. SharePoint Server includes CVE-2026-65665, a critical code execution (CVSS 8.8), and CVE-2026-70332 lets SharePoint be abused for a spoofing attack at CVSS 9.6. The Office family has a long list of code executions rated CVSS 7.8 each, affecting Word, Excel, and the Office Graphics Component. CVE-2026-70130 in Microsoft Office raises the score to 8.4.
Patch day takeaway
August 2026 shifts the risk into the kernel and the cloud. With the actively exploited WinSock flaw, a North Korean group installs a kernel rootkit, while the worm-capable DNS flaw, the TFTP vulnerability, and the QUIC bug at CVSS 9.8 each form the most dangerous remote attacks. Unlike in July, Microsoft reports no known update problems for the August packages. Prioritize the actively exploited kernel flaw and the unauthenticated network and cloud bugs when securing your systems.