# Microsoft August 2026 Patch Tuesday: 398 Flaws and Zero-Day

> Microsoft patches 398 flaws in August 2026, including an actively exploited Windows kernel driver zero-day and four critical RCE vulnerabilities.

- Published: 2026-08-12T01:05:21.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Windows, SharePoint, Zero-Day, Lazarus Group, CVE-2026-68820
- CVEs: CVE-2026-68820 (CVSS 7), CVE-2026-55040 (CVSS 9.1), CVE-2026-63520 (CVSS 9.8)
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
- Canonical: https://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-day

## Key points

- Immediate impact: A Windows kernel driver zero-day is under active exploitation in the wild, while four unauthenticated remote code execution flaws threaten enterprise servers.
- Affected systems: Windows operating systems, Windows DNS Server, Windows Deployment Services, QUIC transport protocol, HPC Pack, and on-premises SharePoint farms.
- Remediation: Prioritize patching the actively exploited driver bug and unauthenticated RCE vectors, and verify that SharePoint farms have both July and August updates applied.

Microsoft has released its monthly security updates, addressing a massive total of 398 new vulnerabilities according to [The Hacker News](https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html). Among the batch is a high-priority [zero-day](/glossary#zero-day) flaw affecting the core Windows kernel networking stack, alongside multiple unauthenticated remote code execution bugs and the completion of a two-part SharePoint remediation cycle.

## Technical Details and Analysis of the August 2026 [Patch](/glossary#patch) Set

The standout [vulnerability](/glossary#vulnerability) in this month's release is [CVE-2026-68820](https://nvd.nist.gov/vuln/detail/CVE-2026-68820), a [use-after-free](/glossary#use-after-free) flaw residing in `afd.sys`, the Ancillary Function Driver for WinSock. Tracked with a [CVSS](/glossary#cvss) score of 7.0, the bug stems from a [race condition](/glossary#race-condition) during network socket operations. While an attacker must already possess execution capability on a target machine to trigger the race condition, successful exploitation grants immediate escalation to SYSTEM privileges.

According to Check Point Research, the [Lazarus Group](https://en.wikipedia.org/wiki/Lazarus_Group) has leveraged this zero-day in targeted operations such as Operation Dream Job. Despite its lower numerical score compared to network-based RCEs, the active exploitation in the wild makes patching this driver flaw the top priority for workstation environments.

### Unauthenticated Remote Code Execution Flaws

Beyond the kernel driver bug, the update addresses four unauthenticated remote code execution vulnerabilities carrying maximum CVSS scores of 9.8. These flaws require no user interaction, passwords, or prior access, affecting:

* Windows DNS Server
* Windows Deployment Services (WDS)
* Microsoft's implementation of the QUIC transport protocol
* High Performance Computing (HPC) Pack

Although the Zero Day Initiative notes that 62 vulnerabilities in this release are rated critical, these four server-side flaws demand immediate queueing behind the actively exploited driver bug due to their potential for unauthenticated network compromise.

### SharePoint Exploitation Chain Remediation

August also concludes a two-part remediation effort for on-premises SharePoint farms, following discovery by Rapid7 Labs of an [exploit](/glossary#exploit) chain combining an authentication bypass with remote code execution. 

The first component was patched in July as [CVE-2026-55040](https://nvd.nist.gov/vuln/detail/CVE-2026-55040), a critical authentication bypass scored at 9.1 that permitted unauthorized user or administrator impersonation. The August update delivers the corresponding fix for the execution half of the chain, tracked as [CVE-2026-63520](https://nvd.nist.gov/vuln/detail/CVE-2026-63520). Because patching the July authentication bug already breaks the demonstrated attack chain, administrators must ensure that both monthly updates are fully applied to secure legacy deployments.

## Actionable Recommendations and Mitigations

Defenders should structure their deployment schedules based on exploit status, service reachability, and potential impact rather than raw [CVE](/glossary#cve) counts:

* **Address Active Exploitation First:** Immediately deploy updates for [CVE-2026-68820](https://nvd.nist.gov/vuln/detail/CVE-2026-68820) on all Windows hosts where local code execution vectors represent a residual risk.
* **Inventory and Patch Network Services:** Prioritize patching exposed instances of Windows DNS Server, WDS, and QUIC services against the unauthenticated 9.8-rated [RCE](/glossary#rce) flaws.
* **Audit SharePoint Deployments:** Verify that on-premises SharePoint environments have successfully received both the July authentication-bypass patch ([CVE-2026-55040](https://nvd.nist.gov/vuln/detail/CVE-2026-55040)) and the August code execution update ([CVE-2026-63520](https://nvd.nist.gov/vuln/detail/CVE-2026-63520)).
* **Evaluate Optional Components:** Confirm whether non-default services such as HPC Pack are active in the environment before assigning high patch urgency to them.

**Related:** [MiniPlasma 0-Day: Windows SYSTEM Privilege Escalation via cldflt.sys](/blog/miniplasma-0-day-windows-system-privilege-escalation-via-cldflt-sys), [Windows LegacyHive Zero-Day Exploit Grants Admin Access — Patch Status](/blog/windows-legacyhive-zero-day-exploit-grants-admin-access-patch-status)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-day