Microsoft’s August 2026 Patch Tuesday landed with 421 CVEs — one of the heaviest months on record. But volume is noise. Only a handful of these actually change your risk this week: one zero-day already being exploited in the wild, and one wormable, unauthenticated remote code execution bug that is arguably more dangerous than the zero-day itself. Here is what matters, why it matters, and the order you should patch in.
TL;DR — patch these first
- CVE-2026-62878 — Windows DNS Server RCE, CVSS 9.8, remote + unauthenticated + wormable. Patch exposed DNS servers today.
- CVE-2026-68820 — afd.sys elevation of privilege to SYSTEM, actively exploited in the wild.
- CVE-2026-62818 (AD CS RCE, 8.8) and CVE-2026-62823 (DHCP RCE, 8.8) — unauthenticated RCE on infrastructure roles.
- CVE-2026-62832 — User Profile Service EoP (7.8), the one bug that is already publicly disclosed.
The one being exploited: CVE-2026-68820 (afd.sys)
The zero-day this month is a use-after-free race condition in the Ancillary Function Driver for WinSock — afd.sys. A locally authenticated attacker runs a crafted application, wins a race, and elevates from a normal user to SYSTEM. On its own an elevation-of-privilege bug sounds unglamorous, but this is the exact primitive attackers need to finish the job: phishing or a browser exploit gets them code execution as a low-privileged user, and a bug like this turns that foothold into full control of the machine.
What should raise eyebrows is which driver it is. afd.sys is a repeat offender. It sits directly beneath the Windows Sockets API, which means it is reachable from almost any process — including sandboxed and low-integrity ones — giving it an enormous, constantly-exercised attack surface. Tenable’s Satnam Narang pointed out that this is at least the fourth afd.sys zero-day in recent memory, following CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193 — the last of which was tied to North Korea’s Lazarus group. When the same driver keeps producing exploited-in-the-wild elevation bugs, that is a signal about where sophisticated actors are investing, not a coincidence.
One oddity worth flagging for your risk register: Microsoft’s advisory marks the exploit maturity as “Unproven” while simultaneously stating the flaw is under active attack. Don’t let the “Unproven” label lower this in your queue — treat it as exploited, because Microsoft says it is.
The one you should actually patch first: CVE-2026-62878
Here is the counterintuitive part. The afd.sys zero-day needs a local foothold first. CVE-2026-62878, a stack-based buffer overflow in the Windows DNS Server, needs nothing. It is remotely reachable by an unauthenticated attacker, carries a CVSS of 9.8, and analysts describe it as wormable — meaning a working exploit could self-propagate from one DNS server to the next with no human in the loop.
DNS servers are, by design, exposed and trusted. A wormable pre-auth RCE on that role is the kind of bug that turns into an incident across an entire estate in hours, not weeks. If you run Windows DNS anywhere that can receive queries from untrusted networks, this is your number-one action item this month — ahead of the zero-day. Patch it, and if you cannot patch immediately, restrict which networks can reach the DNS service and watch for anomalous DNS server crashes or restarts, a common early sign of overflow exploitation attempts.
The rest of the critical tier
Two more unauthenticated RCEs deserve fast-tracking because of where they live:
- CVE-2026-62818 — Active Directory Certificate Services RCE (CVSS 8.8). AD CS is identity infrastructure. Code execution here is a direct path to certificate abuse, forged authentication, and domain-wide compromise. If you run AD CS, treat this as critical regardless of the 8.8 score.
- CVE-2026-62823 — DHCP Server RCE (CVSS 8.8). Another core network service that low-privileged or unauthenticated attackers on the local network can reach.
Also on the radar: CVE-2026-62815 (Microsoft QUIC RCE), CVE-2026-62893 (Windows Deployment Services TFTP RCE), and CVE-2026-59124 (HPC Pack RCE). And the single publicly disclosed bug this cycle — CVE-2026-62832, a User Profile Service elevation of privilege (CVSS 7.8) — is worth prioritising simply because public disclosure shortens the time until a working exploit appears.
How to prioritise 421 CVEs without losing the week
You will never patch 421 CVEs in a day, and you don’t need to. A defensible triage order:
- Exploited or wormable, pre-auth, on exposed services. CVE-2026-62878 (DNS) leads. These can spread on their own.
- Exploited in the wild. CVE-2026-68820 (afd.sys). Even local bugs jump the queue once attackers are using them.
- Unauthenticated RCE on infrastructure roles. AD CS, DHCP, DNS, Exchange. Identity and network services are force multipliers for an attacker.
- Publicly disclosed. CVE-2026-62832. The clock is already running.
- Everything else, by CVSS and exposure, through your normal cycle.
The product breakdown this month — 236 Windows, 98 Office, 30 SharePoint, 7 Exchange — tells you where to point your test-and-deploy effort. If you run SharePoint or Exchange on-prem, pay disproportionate attention: those roles have a long history of turning “important” bugs into breach headlines.
Detection and mitigation while you roll out patches
- afd.sys (CVE-2026-68820): There is no meaningful configuration mitigation — the driver is core to networking. Lean on EDR behavioural detections for token theft and privilege-escalation patterns (a low-privileged process suddenly acting as SYSTEM), and prioritise patching endpoints where users open mail and browse the web, since that is where the initial foothold comes from.
- DNS (CVE-2026-62878): Patch first. Interim: restrict inbound access to the DNS service to trusted networks, and alert on unexpected DNS server process crashes/restarts.
- AD CS / DHCP: Segment these roles off flat networks so an unauthenticated attacker cannot reach them from an ordinary workstation VLAN. Enable and review certificate-issuance logging on AD CS.
For researchers: afd.sys is a pattern, not a one-off
If you hunt Windows LPE bugs, the recurrence of afd.sys zero-days is the story. Four exploited elevation bugs in the same driver in roughly two years is a strong signal that the surrounding code — the WinSock ancillary paths, the IOCTL handlers, the reference-counting around socket objects — is worth a focused variant-hunting pass. Patch diffs for CVE-2026-68820 will show exactly which object lifetime the fix tightened; the productive question is always “where else does this same pattern appear?” Race-condition use-after-frees rarely live alone.
The bottom line
Ignore the 421 headline number. This month comes down to two bugs: a wormable, unauthenticated DNS RCE (CVE-2026-62878) that can spread on its own, and an actively exploited afd.sys privilege-escalation zero-day (CVE-2026-68820) that nation-state actors have a track record of using. Patch DNS today, patch endpoints for the zero-day this week, segment your identity and network infrastructure roles, and let the other 400-plus fixes flow through your normal cycle.
Sources: SecurityWeek — August 2026 Patch Tuesday · Zero Day Initiative — August 2026 Security Update Review · The Hacker News · Rapid7. Always confirm CVE details against Microsoft’s official Security Update Guide before acting.