1. Executive summary
Microsoft's August 2026 Patch Tuesday addresses 418 vulnerabilities across its product portfolio, with 62 rated critical. One vulnerability is confirmed exploited in the wild (CVE-2026-68820) and two were publicly disclosed as zero-days prior to patch release (CVE-2026-62832, CVE-2026-72971). The exploited flaw is a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys), attributed by Check Point to Lazarus Group's Operation Dream Job campaign targeting the European defense sector. Two CVSS 9.8 critical RCE vulnerabilities in Microsoft QUIC (CVE-2026-62815) and Windows DNS Server (CVE-2026-62878) present unauthenticated remote attack surfaces relevant to EMEA financial services infrastructure. Attribution to Lazarus Group is single-sourced (Check Point via The Register); no MITRE ATT&CK profile for a named actor was provided in the verified reference data, so the attribution is treated as unconfirmed.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | CVE-2026-68820 is confirmed exploited in the wild by a state-aligned threat actor targeting European defence-sector organisations via Operation Dream Job; financial services firms with overlapping supply-chain or staffing exposure must classify this as a cyber threat for incident management purposes. | Clients must assess whether the WinSock EoP exploit is relevant to their threat landscape and classify accordingly under their ICT incident taxonomy. |
| DORA Art. 24: digital operational resilience testing — general requirements | Two unauthenticated network-reachable RCE vulnerabilities (CVE-2026-62815 QUIC, CVE-2026-62878 DNS Server) with CVSS 9.8 affect core Windows server infrastructure commonly deployed in financial services data centres. | Clients should prioritise vulnerability scanning and patch verification against these specific CVEs as part of operational resilience testing programmes. |
3. Technical analysis & attack chain
Prioritised triage table
| CVE | Component | CVSS | KEV/EPSS | Why it matters |
|---|---|---|---|---|
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock (afd.sys) | 7.0 HIGH | NOT in CISA KEV; exploited in the wild per Microsoft | Confirmed zero-day exploited by Lazarus Group (unconfirmed attribution) for SYSTEM-level privilege escalation via use-after-free race condition |
| CVE-2026-62832 | Windows User Profile Service | 7.8 HIGH | NOT in CISA KEV; publicly disclosed | Zero-day disclosure; link-following EoP granting administrator privileges; exploitation assessed "more likely" by Microsoft |
| CVE-2026-62815 | Microsoft QUIC | 9.8 CRITICAL | NOT in CISA KEV | Unauthenticated remote RCE via crafted QUIC packet; no user interaction; affects Windows 11 and Windows Server 2022/2025 including Server Core |
| CVE-2026-62878 | Windows DNS Server | 9.8 CRITICAL | NOT in CISA KEV | Unauthenticated remote RCE via stack-based buffer overflow; affects Windows Server 2012 through 2025; directly relevant to DNS infrastructure |
| CVE-2026-72971 | Windows Container Isolation FS Filter Driver (unionfs.sys) | 5.5 MEDIUM | NOT in CISA KEV; publicly disclosed | Zero-day disclosure; link-following tampering on Windows 11 26H1 x64/ARM64; exploitation assessed "unlikely" by Microsoft |
| CVE-2026-70354 | .NET Core | 7.8 HIGH | NOT in CISA KEV | Out-of-bounds write RCE in .NET Core |
| CVE-2026-62901 | .NET | 7.5 HIGH | NOT in CISA KEV | DoS vulnerability in .NET |
| CVE-2026-62893 | Windows Deployment Services TFTP Server | 9.8 CRITICAL | NOT in CISA KEV | Unauthenticated remote RCE via crafted packets; exploitation assessed "more likely" |
Attack chain — CVE-2026-68820 (exploited in the wild)
- Initial access / delivery: Lazarus Group (Operation Dream Job) used fake job-listing websites impersonating Lockheed Martin and Enveil, boosted via SEO to rank highly in search results. Victims were lured into downloading a trojanised PDF viewer called SecurityPDF. (Single-sourced: Check Point via The Register — verify before enforcement.)
- Payload execution: Opening attacker-crafted PDF files in SecurityPDF executed a previously undocumented backdoor named Troy.
- Privilege escalation (the patched CVE): During the intrusion, attackers exploited CVE-2026-68820 — a use-after-free in afd.sys (Windows Ancillary Function Driver for WinSock). The exploit triggers a race condition when a socket is created and accessed concurrently by multiple threads. A locally authenticated attacker with low privileges runs a specially crafted application; successful exploitation grants SYSTEM privileges. No user interaction is required. Attack complexity is rated high due to the race condition requirement.
- Post-exploitation: Following privilege escalation, attackers deployed a new version of FudModule, Lazarus's kernel-mode rootkit, to evade detection.
- Observed impact: Campaign targeted defence-sector organisations in Europe and India. Check Point reports at least one confirmed successful exploitation but assesses wider use is likely. Attribution to Lazarus Group is unconfirmed — no MITRE ATT&CK profile was provided in the verified reference data, and the claim rests on a single source (Check Point, reported by The Register).
CVE-2026-62815 — Microsoft QUIC RCE (CVSS 9.8, not exploited)
Use-after-free vulnerability in the Microsoft QUIC protocol implementation. An unauthenticated remote attacker sends a specially crafted packet to an affected service over the network. No user interaction required. Successful exploitation results in remote code execution on the target system. Affected platforms: Windows 11, Windows Server 2022, Windows Server 2025, including Server Core installations. The attack surface is any system exposing QUIC-enabled services to untrusted networks.
CVE-2026-62878 — Windows DNS Server RCE (CVSS 9.8, not exploited)
Stack-based buffer overflow (CWE-121) in Windows DNS. An unauthenticated remote attacker sends a specially crafted packet to an affected DNS service over the network. No user interaction required. Successful exploitation allows code execution on the target DNS server. Affected systems: Windows Server 2012 through 2025, and listed Windows 10 versions where the vulnerable component is present. This is a direct threat to DNS infrastructure exposed to untrusted networks.
CVE-2026-62832 — Windows User Profile Service EoP (CVSS 7.8, publicly disclosed, not exploited)
Improper link resolution (CWE-59) in the Windows User Profile Service. A local authenticated attacker with credentials for another local account runs a specially crafted application to load another user's registry hive. Successful exploitation grants access to or modification of another user's data and ultimately administrator privileges. No user interaction required. Affected systems: Windows 10, Windows 11, Windows Server 2022, Windows Server 2025. Microsoft assesses exploitation as "more likely."
CVE-2026-72971 — Windows Container Isolation FS Filter Driver tampering (CVSS 5.5, publicly disclosed, not exploited)
Improper link resolution (CWE-59) in unionfs.sys, the Windows Container Isolation file system filter driver. A local authenticated attacker exploits with low complexity and no user interaction to tamper with files. Integrity impact is rated high; confidentiality and availability impact rated none. Affected platform: Windows 11 Version 26H1 on x64 and ARM64. Microsoft assesses exploitation as "unlikely."
Additional verified CVEs from the release
| CVE | Component | CVSS | Severity | Notes |
|---|---|---|---|---|
| CVE-2026-70354 | .NET Core | 7.8 | HIGH | Out-of-bounds write (CWE-787); RCE |
| CVE-2026-62901 | .NET | 7.5 | HIGH | CWE-606; DoS |
| CVE-2026-62893 | Windows Deployment Services TFTP Server | 9.8 | CRITICAL | Unauthenticated remote RCE; "exploitation more likely" |
| CVE-2026-62823 | Windows DHCP Server | 8.8 | CRITICAL | Heap-based buffer overflow; adjacent network RCE; "exploitation more likely" |
4. Mitigation & containment
P1 — within 24 hours
- CVE-2026-68820 (exploited in the wild): Apply the August 2026 Windows security update to all supported Windows client and server versions immediately. Prioritise systems where untrusted users have local code execution (terminal servers, jump hosts, developer workstations, shared workstations). Monitor for suspicious privilege-escalation activity targeting afd.sys. EDR rules should alert on unexpected SYSTEM-privilege process creation originating from low-privilege user sessions. If patching cannot be completed immediately, restrict local interactive logon for non-administrative accounts on critical systems.
- CVE-2026-62815 (QUIC RCE, CVSS 9.8): Apply the Microsoft update to all Windows 11 and Windows Server 2022/2025 systems, including Server Core. For systems that cannot be patched within 24 hours, restrict inbound QUIC (UDP port 443) traffic at firewalls to trusted networks only. Disable QUIC where not required via Group Policy: Computer Configuration > Administrative Templates > Network > RPC > Disable RPC over QUIC.
- CVE-2026-62878 (DNS Server RCE, CVSS 9.8): Apply the Microsoft update to all Windows DNS servers (Windows Server 2012 through 2025). For unpatched systems, restrict inbound DNS traffic (TCP/UDP 53) to trusted networks only at firewalls. Monitor DNS servers for crashes or anomalous traffic patterns. Block unnecessary inbound traffic to DNS services from the internet where feasible.
P2 — within 72 hours
- CVE-2026-62832 (User Profile Service EoP, publicly disclosed): Apply the Microsoft security update across all affected Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. Limit local account reuse across systems. Monitor for unusual registry hive loading activity or unexpected User Profile Service operations. EDR rules should alert on processes loading external registry hives (reg load / reg restore) from non-administrator contexts.
- CVE-2026-72971 (unionfs.sys tampering, publicly disclosed): Apply the Windows update to Windows 11 Version 26H1 systems (x64 and ARM64). Prioritise systems using Windows containers or container isolation features.
- CVE-2026-62893 (WDS TFTP Server RCE, CVSS 9.8): Apply the update to all systems running Windows Deployment Services. Disable or restrict TFTP services where not required. Limit network exposure of WDS to trusted provisioning networks.
- CVE-2026-62823 (DHCP Server RCE, CVSS 8.8): Apply the update to all Windows DHCP servers. Restrict DHCP service access to trusted network segments.
P3 — within 7 days
- Apply the remaining August 2026 Patch Tuesday updates across the full estate. The release covers 418 vulnerabilities total; prioritise remaining critical RCE vulnerabilities in Microsoft Office, SharePoint Server, Exchange Server, and Remote Desktop Client based on exposure assessment.
- Patch .NET Core and .NET Framework components (CVE-2026-70354, CVE-2026-62901) on all systems running affected versions.
- Validate patch deployment via vulnerability scanning and confirm no rollback has occurred.
5. Indicators of compromise
The following indicators are derived from Check Point's reporting on the Operation Dream Job campaign exploiting CVE-2026-68820. These are single-sourced (Check Point via The Register); verify before enforcement.
| Type | Value | Confidence | Source |
|---|---|---|---|
| filename | SecurityPDF | Medium | Check Point / The Register |
| malware-name | Troy | Medium | Check Point / The Register |
| malware-name | FudModule | Medium | Check Point / The Register |
| campaign | Operation Dream Job | Medium | Check Point / The Register |
No atomic network indicators (IPs, domains, hashes) were provided in the source material. The fake Enveil impersonation websites were described but no URLs or domains were disclosed.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Trojanised PDF viewer (SecurityPDF) executing embedded payloads from crafted PDF files | Endpoint process monitoring, EDR | Medium (single-sourced) |
| Low-privilege process triggering SYSTEM-privilege process creation via afd.sys race condition | EDR, Windows Event Log (Event ID 4688), Sysmon Event ID 1 | Medium |
| Kernel-mode rootkit (FudModule) loading after privilege escalation | EDR kernel callback monitoring, driver load events (Sysmon Event ID 6) | Medium (single-sourced) |
| Registry hive loading from non-administrator context (reg load / reg restore) | EDR, Sysmon Event ID 12/13/14, Windows Event Log | Low (CVE-2026-62832 defensive monitoring, not observed in campaign) |
6. Detection
Insufficient indicators to author detection rules. The source material describes malware names (Troy, FudModule, SecurityPDF) and campaign techniques but does not provide file hashes, mutex names, hard-coded strings, registry keys, command-line flags, or network signatures that would enable reliable YARA or Sigma rule authorship. The malware names alone are not sufficient artefacts for a detection rule that would distinguish the threat from reporting about the threat.
CVE assessment
7 referenced CVEs — 2 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-62815 | 9.8 Critical | — | — | Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. |
| CVE-2026-62878 | 9.8 Critical | — | — | Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network. |
| CVE-2026-62832 | 7.8 High | — | — | Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to… |
| CVE-2026-70354 | 7.8 High | — | — | Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally. |
| CVE-2026-62901 | 7.5 High | — | — | Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network. |
| CVE-2026-68820 | 7.0 High | — | — | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-72971 | 5.5 Medium | — | — | Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) al… |
7. Sources
- SANS Internet Storm Center — "Microsoft Patch Tuesday August 2026" — https://isc.sans.edu/diary/rss/33236 — 2026-08-11
- Tenable Research — "Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)" — https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820 — 2026-08-11
- The Register — "421 bugs in Microsoft's Patch Tuesday release, and the Norks have already attacked one" — https://www.theregister.com/security/2026/08/11/421-bugs-in-microsofts-patch-tuesday-release-and-the-norks-have-already-attacked-one/5286483 — 2026-08-11
8. Adverse Trace position
The August 2026 Patch Tuesday is a high-priority release for EMEA financial services clients. The confirmed in-the-wild exploitation of CVE-2026-68820 (CVSS 7.0 HIGH, use-after-free in afd.sys) by a state-aligned actor — even with unconfirmed, single-sourced attribution to Lazarus Group — elevates this patch cycle above routine monthly updates. The two CVSS 9.8 critical unauthenticated RCE vulnerabilities in Microsoft QUIC and Windows DNS Server represent direct threats to network-exposed Windows infrastructure and should be treated as P1 remediation targets. The publicly disclosed zero-days (CVE-2026-62832, CVE-2026-72971) carry lower CVSS but the disclosure status means exploit development is plausible. We assess the overall client impact as high for organisations running exposed Windows DNS or QUIC services, and medium-to-high for those with multi-user Windows endpoints. Adverse Trace will monitor for emergence of public proof-of-concept code for the disclosed vulnerabilities, track CISA KEV additions, and issue an update if the Lazarus attribution is corroborated by additional sources or if IOCs become available.
Published via PulseTrace — Adverse Trace threat intelligence.