tldrdailynews.com logo

Active Windows zero-day drives urgent August patch Tuesday across core services

1 min read
Source: The Hacker News
Active Windows zero-day drives urgent August patch Tuesday across core services
Photo: The Hacker News
TL;DR

Microsoft’s August Patch Tuesday closes 398 CVEs, including CVE-2026-68820—a use‑after‑free in afd.sys that can escalate from code execution to SYSTEM and is under active exploitation—making it the top priority; four other high‑severity flaws (CVE-2026-62878 in Windows DNS Server, CVE-2026-62893 in Windows Deployment Services, CVE-2026-62815 in Microsoft QUIC, and CVE-2026-59124 in HPC Pack) are unauthenticated RCEs whose exploitation depends on service exposure. The update also finishes a two‑part SharePoint chain (CVE-2026-55040 and CVE-2026-63520) first disclosed by Rapid7. Prioritize systems with exposed DNS/WDS/QUIC/HPC services and ensure on‑prem SharePoint farms apply both July and August fixes to close the chain.

Topics:technologysecurity#afdsys#note-extra#patch-management#privilege-escalation#security#windows#zero-day
Share this article
  1. Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack  The Hacker News
  2. Microsoft Plugs Nearly 400 Security Holes  Krebs on Security
  3. August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day  SecurityWeek
  4. 421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one  The Register
  5. Microsoft Releases August 2026 Patch Tuesday Updates  Thurrott.com

Want the full story? Read the original reporting

Read on The Hacker News