~/f4n6 $ grep -r "August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs" ./investigations/ --include="*.md"

August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs

Jeff Davies 12 Aug 2026 7 min read

1. Executive summary

Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (415 including two MITRE-assigned CVEs), comprising 42 critical, 355 important, and one moderate vulnerability. One zero-day — CVE-2026-68820, an elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock (CVSS 7.0) — is confirmed exploited in the wild. Two additional zero-days are publicly disclosed but not yet exploited: CVE-2026-62832 (Windows User Profile Service, CVSS 7.8) and CVE-2026-72971 (Windows Container Isolation FS Filter Driver, CVSS 5.5). The release also includes critical RCE vulnerabilities in Microsoft QUIC (CVSS 9.8) and Windows Deployment Services TFTP Server (CVSS 9.8) that permit unauthenticated remote code execution. EMEA financial services running affected Windows Server and client OS builds should prioritise the exploited zero-day and network-reachable RCE patches immediately.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements A confirmed exploited zero-day (CVE-2026-68820) and two publicly disclosed zero-days require immediate vulnerability remediation testing across the ICT estate. Clients must exercise patch deployment and validation as part of their operational resilience testing programme; prioritise the exploited and disclosed zero-days for accelerated testing.
DORA Art. 18: classification of ICT-related incidents and cyber threats Active exploitation of CVE-2026-68820 constitutes a cyber threat requiring classification per the client's incident taxonomy. Classify the presence of the exploited vulnerability in the environment as a cyber threat event; escalate to incident management if exploitation is confirmed on any asset.

No specific NIS2 or UK NIS article is directly engaged beyond general vulnerability management obligations.

3. Technical analysis & attack chain

Prioritised triage table

CVE Component CVSS KEV/Exploitation Why it matters
CVE-2026-68820 Windows Ancillary Function Driver for WinSock (afd.sys) 7.0 Exploited in the wild Local EoP to SYSTEM; confirmed zero-day exploitation; use-after-free race condition
CVE-2026-62832 Windows User Profile Service 7.8 Publicly disclosed; not exploited Local EoP to administrator; link following flaw; possibly related to LegacyHive exploit (unconfirmed)
CVE-2026-62737 Windows Kernel 7.8 PoC published (Chinese-language blog, 2026-08-09) Local EoP to SYSTEM; untrusted pointer dereference; PoC causes system crash
CVE-2026-62815 Microsoft QUIC (MsQuic) 9.8 Not exploited; "Exploitation More Likely" Unauthenticated remote RCE; use-after-free; network-reachable via crafted QUIC packet
CVE-2026-62893 Windows Deployment Services TFTP Server 9.8 Not exploited; "Exploitation More Likely" Unauthenticated remote RCE; use-after-free; network-reachable via crafted TFTP packets
CVE-2026-62823 Windows DHCP Server 8.8 Not exploited; "Exploitation More Likely" Unauthenticated remote RCE; heap-based buffer overflow; adjacent network attack vector
CVE-2026-72971 Windows Container Isolation FS Filter Driver (unionfs.sys) 5.5 Publicly disclosed; exploitation assessed unlikely Local tampering; integrity-only impact; link following flaw
CVE-2026-61348 Windows Ancillary Function Driver for WinSock 7.0 Not exploited; "Exploitation More Likely" Local EoP to SYSTEM; same driver family as exploited CVE-2026-68820
CVE-2026-70307 Windows Ancillary Function Driver for WinSock 7.0 Not exploited; "Exploitation More Likely" Local EoP to SYSTEM; same driver family as exploited CVE-2026-68820
13 additional DHCP CVEs Windows DHCP Server 6.5–7.8 Not exploited 8 information disclosure (CVSS 6.5) + 5 EoP (CVSS 7.8); important severity
29 SharePoint CVEs Microsoft Office SharePoint Various 3 critical, 3 "Exploitation More Likely" RCE and EoP across SharePoint Server; review for internet-facing deployments

Attack chain — CVE-2026-68820 (exploited zero-day)

  1. Initial access: Attacker obtains low-privileged local code execution on a target Windows system (via prior compromise, phishing payload, or legitimate low-privilege account).
  2. Trigger: Attacker runs a specially crafted application that interacts with the Windows Ancillary Function Driver for WinSock (afd.sys), triggering a use-after-free condition (CWE-416).
  3. Race condition: Exploitation requires winning a race condition in the driver's handling of WinSock ancillary function calls. No user interaction is required beyond initial execution of the crafted application.
  4. Privilege escalation: Successful exploitation of the race condition allows the attacker to elevate from low-privileged local account to SYSTEM privileges.
  5. Post-exploitation: With SYSTEM access, the attacker can install persistence, dump credentials (LSASS), disable security tooling, and pivot laterally within the domain.

Historical context: The AFD/WinSock driver has been a recurring target. Prior zero-days include CVE-2025-32709 (May 2025), CVE-2025-21418 (February 2025), and CVE-2024-38193 (August 2024). Two additional EoP vulnerabilities in the same driver are patched this month (CVE-2026-61348, CVE-2026-70307), both assessed "Exploitation More Likely."

CVE-2026-62832 — Windows User Profile Service (publicly disclosed)

A link following flaw (CWE-59) allows an authenticated attacker with credentials for one local account to run a specially crafted application that loads another user's registry hive. This could grant access to or modification of that user's data and elevation to administrator privileges. No user interaction required; low attack complexity.

Unconfirmed attribution: CrowdStrike assesses this is likely the patch for the "LegacyHive" exploit publicly released by the "Nightmare-Eclipse" persona in July 2026. This attribution is single-sourced and unconfirmed — Microsoft has not corroborated the link. No MITRE profile is available for "Nightmare-Eclipse"; treat the attribution as unconfirmed.

CVE-2026-62737 — Windows Kernel (PoC published)

An untrusted pointer dereference flaw (CWE-822) allows a low-privileged local attacker to elevate to SYSTEM. A Chinese-language blog published on 2026-08-09 describes a proof-of-concept exploit that can cause a system crash. Microsoft has not officially recognised this as publicly disclosed. Single-sourced; verify before enforcement.

CVE-2026-62815 — Microsoft QUIC (MsQuic) (critical RCE)

A use-after-free flaw (CWE-416) in Microsoft's QUIC implementation allows an unauthenticated remote attacker to execute code with no user interaction and low attack complexity. MsQuic underpins HTTP/3 and is used across multiple Microsoft products and services. Exploitation occurs via a specially crafted QUIC packet sent to an affected service over the network. Any internet-facing service exposing MsQuic/HTTP/3 is at risk.

CVE-2026-62893 — Windows Deployment Services TFTP Server (critical RCE)

A use-after-free flaw (CWE-416) allows an unauthenticated remote attacker to execute code over the network with low attack complexity. Exploitation occurs when crafted packets are sent to a vulnerable TFTP service. Windows Deployment Services is typically deployed in imaging/MDT environments; any exposed WDS TFTP server is at risk. Reported to Microsoft by Nikolai Skliarenko of TrendAI Research.

CVE-2026-62823 — Windows DHCP Server (critical RCE)

A heap-based buffer overflow allows an unauthenticated remote attacker to execute code over an adjacent network via a crafted DHCP packet. CVSS 8.8; assessed "Exploitation More Likely." Thirteen additional DHCP Server vulnerabilities (8 information disclosure at CVSS 6.5, 5 EoP at CVSS 7.8) are also patched this month.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver (publicly disclosed)

A link following flaw (CWE-59) in unionfs.sys allows a low-privileged local attacker to tamper with system integrity. Impact is integrity-only (no confidentiality or availability impact). Publicly disclosed but no evidence of exploitation; Microsoft assesses exploitation as unlikely.

4. Mitigation & containment

P1 — Within 24 hours

  1. Patch CVE-2026-68820 (exploited zero-day): Deploy the August 2026 cumulative update to all Windows endpoints and servers immediately. Priority: workstations and terminal servers where local code execution is most accessible. Query for systems running vulnerable afd.sys versions.
  2. Patch CVE-2026-62832 (publicly disclosed EoP): Deploy to all multi-user systems (terminal servers, jump hosts, shared workstations) where multiple local accounts exist and the link-following attack chain is feasible.
  3. Identify and isolate exposed WDS TFTP servers: Inventory for Windows Deployment Services with TFTP enabled. If not required, disable the TFTP service. If required, restrict network access to provisioning VLANs only. Patch with August 2026 update.
  4. Identify internet-facing MsQuic/HTTP/3 endpoints: Inventory services exposing QUIC/HTTP/3. If not required, disable HTTP/3 at the application or OS level until patched. Patch with August 2026 update.

P2 — Within 72 hours

  1. Patch CVE-2026-62815 (MsQuic RCE, CVSS 9.8): Deploy to all Windows Server and client systems exposing QUIC-based services. Verify HTTP/3 configuration after patching.
  2. Patch CVE-2026-62893 (WDS TFTP RCE, CVSS 9.8): Deploy to all Windows Deployment Services servers.
  3. Patch CVE-2026-62823 (DHCP Server RCE, CVSS 8.8) and 13 additional DHCP CVEs: Deploy to all Windows DHCP Server infrastructure. Validate DHCP scope and failover configuration post-patch.
  4. Patch CVE-2026-62737 (Windows Kernel EoP): Deploy to all endpoints and servers, prioritising multi-user systems.
  5. Patch CVE-2026-61348 and CVE-2026-70307 (AFD/WinSock EoP): Deploy alongside CVE-2026-68820 patches; same driver family, same attack pattern.

P3 — Within 7 days

  1. Patch remaining 29 SharePoint CVEs: Prioritise internet-facing SharePoint Server deployments; apply the 3 critical and 3 "Exploitation More Likely" patches first.
  2. Patch CVE-2026-72971 (unionfs.sys tampering): Deploy to container host infrastructure; lower severity but publicly disclosed.
  3. Deploy full August 2026 cumulative update across the remaining estate following standard change management.
  4. Hunt for CVE-2026-68820 exploitation: Review EDR telemetry for suspicious afd.sys access patterns, unexpected SYSTEM-privilege process creation from low-privilege parent processes, and race-condition exploitation indicators on systems that were unpatched between 2026-08-11 and remediation.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Low-privilege process triggering SYSTEM-privilege child process via afd.sys interaction EDR process tree, Windows Event Log (Sysmon Event ID 1, Event ID 4688) Medium — consistent with CVE-2026-68820 mechanism but not confirmed with specific IOCs
Loading of another user's registry hive by a non-admin account EDR registry monitoring, Sysmon Event ID 12/13/14 Medium — consistent with CVE-2026-62832 mechanism
Unauthenticated QUIC packet causing process crash or code execution in MsQuic Network IDS, WAF, EDR crash telemetry Low — no specific payload signatures available

6. Detection

Insufficient indicators to author detection rules.

7. Sources

  • CrowdStrike — August 2026 Patch Tuesday: Updates and Analysis — https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-august-2026/ — 2026-08-11
  • Tenable Research — Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820) — https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820 — 2026-08-11
  • CrowdStrike — July 2026 Patch Tuesday: Microsoft Patches 622 Vulnerabilities Including Two Exploited Zero-Days — https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-july-2026/ — (context only)
  • Dark Reading — Records Are Made to Be Broken: Patch Tuesday Raises Triage Stakes — https://www.darkreading.com/vulnerabilities-threats/records-broken-patch-tuesday-raises-triage-stakes — (context only)

8. Adverse Trace position

This is a high-severity patch cycle. The confirmed in-the-wild exploitation of CVE-2026-68820 (AFD/WinSock EoP to SYSTEM) demands immediate remediation across all Windows endpoints and servers — the recurring exploitation history of this driver family (four zero-days since August 2024) indicates a persistent attacker interest in this attack surface. The two critical unauthenticated RCE vulnerabilities in MsQuic (CVSS 9.8) and WDS TFTP (CVSS 9.8) are the highest-impact items for EMEA financial services with internet-facing or internal-network-exposed services, as they require no credentials and low complexity. The publicly disclosed CVE-2026-62832 (User Profile Service EoP) carries elevated risk on multi-user systems. The "LegacyHive" / "Nightmare-Eclipse" attribution is single-sourced and unconfirmed — do not anchor threat-hunting on that persona name. We will monitor for emerging IOCs, exploit code publication, and any CISA KEV additions, and will issue a follow-up advisory if exploitation of the critical RCE vulnerabilities is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies