Microsoft’s recent monthly security updates have addressed a significant vulnerability that is already being exploited in the wild. This flaw, identified as CVE-2026-68820, resides within a core Windows kernel driver responsible for network socket operations. An attacker with pre-existing code on a machine can leverage this vulnerability to escalate privileges to SYSTEM level. Given the active exploitation status, this patch has been prioritized in the release.
The flaw carries a CVSS score of 7.0 and is the sole entry in this month’s update that Microsoft has flagged as under active exploitation. The exploitation hinges on triggering a race condition within the driver. While Microsoft has not publicly attributed this exploitation, Check Point Research has linked it to the Lazarus group, which utilized the zero-day in its Operation Dream Job campaign.
Nothing required from the victim
In addition to CVE-2026-68820, four other vulnerabilities included in the update do not require any action from the victim—no account, password, or user interaction is necessary. These vulnerabilities affect:
- CVE-2026-62878, Windows DNS Server: A stack-based buffer overflow that can be exploited remotely without authentication or user interaction. The Zero Day Initiative has labeled this condition as wormable, although Microsoft assesses the likelihood of exploitation as lower.
- CVE-2026-62893, Windows Deployment Services: A remote flaw that can be exploited through the service’s TFTP handling, again without the need for authentication or user action.
- CVE-2026-62815, Microsoft QUIC: This vulnerability allows for remote, unauthenticated code execution without requiring user interaction.
- CVE-2026-59124, HPC Pack: Although it carries the same CVSS score of 9.8, it is rated Important rather than Critical since HPC Pack is not installed by default. Microsoft considers the likelihood of exploitation to be higher.
The practical priority of these vulnerabilities depends on the presence and reachability of the affected services in a given environment. Thus, service inventory and reachability are crucial factors in determining patch priorities.
A SharePoint chain closes
August’s updates also finalize a two-part fix for a SharePoint vulnerability that began in July. Rapid7 Labs reported an exploit chain to Microsoft on May 18, which combined an authentication bypass with a separate code execution vulnerability, allowing for unauthenticated remote code execution against on-premises SharePoint installations. Microsoft confirmed shortly thereafter that the remediation would be split across the July and August update cycles.
The July update addressed the first half of the chain, CVE-2026-55040, a Critical authentication bypass with a CVSS score of 9.1. This flaw enables a remote unauthenticated attacker to impersonate a SharePoint site user or administrator if they know the identity to impersonate. The August update provides the fix for the code execution component, identified as CVE-2026-63520.
Understanding the distinction between these vulnerabilities is essential; CVE-2026-63520 represents the code execution aspect of the chain, which alone does not create the unauthenticated condition. The combination of the RCE with CVE-2026-55040 is what led to Rapid7’s discovery of the unauthenticated RCE. Rapid7 asserts that applying the fix for CVE-2026-55040 effectively breaks the demonstrated exploit chain, and the August update now addresses the RCE component as well.
In summary, organizations should prioritize patching CVE-2026-68820 for Windows systems where an attacker may already have code running. Following this, attention should be directed to exposed DNS, WDS, QUIC, and HPC services, ensuring that on-premises SharePoint farms have both the July authentication-bypass fix and the August RCE fix implemented.
