Microsoft’s August 2026 Patch Tuesday fixed 421 CVEs. Here are the two that actually matter this week — an actively exploited afd.sys privilege-escalation zero-day (CVE-2026-68820) and a wormable, unauthenticated Windows DNS RCE (CVE-2026-62878) — plus the exact order to patch in.