~/f4n6 $ grep -r "Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities" ./investigations/ --include="*.md"

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Jeff Davies 12 Aug 2026 10 min read

1. Executive summary

Microsoft's August 2026 Patch Tuesday addresses 421 vulnerabilities across its product ecosystem, with 62 rated critical. One vulnerability, CVE-2026-68820 (CVSS 7.0 HIGH), is confirmed in CISA KEV (added 2026-08-11) and actively exploited in the wild as a zero-day. The update also patches two additional publicly disclosed zero-days (CVE-2026-62832 and CVE-2026-72971) and several critical remote code execution (RCE) flaws in core infrastructure components, including Windows Deployment Services TFTP Server (CVE-2026-62893, CVSS 9.8 CRITICAL) and Microsoft QUIC (CVE-2026-62815, CVSS 9.8 CRITICAL). EMEA financial services running exposed Windows Server infrastructure or multi-tenant Azure environments face immediate operational risk from unpatched network-facing services.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements In-the-wild exploitation of CVE-2026-68820 and critical network-accessible RCE flaws (CVE-2026-62893, CVE-2026-62815) require immediate validation of patch deployment efficacy. Entities must execute vulnerability scanning and patch verification against August 2026 updates as part of their operational resilience testing programme.
DORA Art. 18: classification of ICT-related incidents and cyber threats Active exploitation of CVE-2026-68820 constitutes a confirmed cyber threat requiring classification under the entity's ICT incident framework. Clients must classify any detection of CVE-2026-68820 exploitation against internal severity criteria and prepare for potential major-incident reporting under Art. 19.

3. Technical analysis & attack chain

Prioritised triage table

CVE Component CVSS KEV/EPSS Why it matters
CVE-2026-68820 Windows Ancillary Function Driver for WinSock 7.0 HIGH IN CISA KEV (added 2026-08-11) Actively exploited in the wild; local EoP to SYSTEM via use-after-free race condition.
CVE-2026-62893 Windows Deployment Services TFTP Server 9.8 CRITICAL NOT in KEV Unauthenticated network RCE via use-after-free; "more likely" to be exploited.
CVE-2026-62815 Microsoft QUIC 9.8 CRITICAL NOT in KEV Unauthenticated network RCE via use-after-free; affects Windows 11, Server 2022/2025 including Server Core.
CVE-2026-62878 Windows DNS Server 9.8 CRITICAL NOT in KEV Unauthenticated network RCE via stack-based buffer overflow.
CVE-2026-65791 Windows iSCSI Target Service 9.8 CRITICAL NOT in KEV Unauthenticated network RCE via heap-based buffer overflow.
CVE-2026-56162 Azure SQL Database 10.0 CRITICAL NOT in KEV Unauthenticated network EoP via improper authentication.
CVE-2026-63508 Microsoft Planetary Computer Pro 10.0 CRITICAL NOT in KEV Unauthenticated network EoP via missing authentication for critical function.
CVE-2026-65667 Microsoft Teams 10.0 CRITICAL NOT in KEV Unauthenticated network EoP via missing authorization.
CVE-2026-62830 Azure SRE Agent 9.9 CRITICAL NOT in KEV — EPSS 0% Authorised network EoP via missing authorization.
CVE-2026-50515 Azure Service Bus 9.9 CRITICAL NOT in KEV Authorised network RCE via deserialization of untrusted data.
CVE-2026-50481 Azure Active Directory 9.9 CRITICAL NOT in KEV Authorised network EoP via modification of assumed-immutable data (MAID).
CVE-2026-59115 Microsoft Entra Provisioning Service 9.9 CRITICAL NOT in KEV Authorised network EoP via path traversal.
CVE-2026-50516 Microsoft Azure Kubernetes Service 9.4 CRITICAL NOT in KEV Unauthorised network EoP via missing authentication for critical function.
CVE-2026-68823 Azure Confidential Ledger 9.1 CRITICAL NOT in KEV Authorised network RCE via exposed dangerous method or function.
CVE-2026-59118 Copilot Cowork 9.3 CRITICAL NOT in KEV Unauthorised network EoP via improper authorization.
CVE-2026-56161 Azure Logic Apps 9.6 CRITICAL NOT in KEV Authorised network information disclosure via improper access control.
CVE-2026-70332 Microsoft Office SharePoint 9.6 CRITICAL NOT in KEV Unauthorised network spoofing via XSS.
CVE-2026-62896 Microsoft Teams 9.6 CRITICAL NOT in KEV Authorised network EoP via improper authentication.
CVE-2026-62873 Microsoft 365 Admin Center 9.8 CRITICAL NOT in KEV Unauthorised network EoP via improper verification of cryptographic signature.
CVE-2026-65665 Microsoft SharePoint Server 8.8 HIGH NOT in KEV Authorised network RCE via deserialization of untrusted data; "more likely" exploitation.
CVE-2026-62823 Windows DHCP Server 8.8 HIGH NOT in KEV Unauthorised adjacent-network RCE via heap-based buffer overflow; "more likely" exploitation.
CVE-2026-62911 Microsoft Exchange Server 8.0 HIGH NOT in KEV Authorised network EoP via authentication bypass by capture-replay.
CVE-2026-62832 Windows User Profile Service 7.8 HIGH NOT in KEV Publicly disclosed zero-day; local EoP to ADMINISTRATOR via link following.
CVE-2026-72971 Windows Container Isolation FS Filter Driver (unionfs.sys) 5.5 MEDIUM NOT in KEV Publicly disclosed zero-day; local tampering on Windows 11 26H1 x64/ARM64.

Attack chain: CVE-2026-68820 (confirmed exploited in the wild)

  1. Initial access: Attacker obtains low-privileged local code execution on a target Windows system (via initial access vector outside the scope of this CVE).
  2. Trigger: Attacker runs a specially crafted application that triggers a use-after-free condition in the Windows Ancillary Function Driver for WinSock (ancillary function driver for WinSock).
  3. Race condition: Exploitation requires winning a race condition (CVSS vector reflects high attack complexity), which increases difficulty of producing a stable exploit but requires no user interaction.
  4. Privilege escalation: Successful exploitation of the use-after-free grants the attacker SYSTEM-level privileges on the local machine.

Confidence caveat: Attribution for CVE-2026-68820 exploitation is unconfirmed. Rapid7 notes Microsoft credited researchers at Check Point for the vulnerability report, and speculates about DPRK nexus actors ("based in Pyongyang") targeting cryptocurrency, but no MITRE ATT&CK actor profile is available in the verified reference data to corroborate this attribution. Treat the actor attribution as single-sourced and unconfirmed.

Attack chain: CVE-2026-62893 (Windows Deployment Services TFTP Server — "more likely" exploitation)

  1. Initial access: Unauthenticated remote attacker sends crafted packets to a vulnerable Windows Deployment Services TFTP Server service exposed on the network.
  2. Trigger: The crafted packets trigger a use-after-free condition in the TFTP Server component.
  3. Execution: Successful exploitation results in remote code execution on the target server with no authentication required and no user interaction.

Attack chain: CVE-2026-62815 (Microsoft QUIC — critical, unauthenticated network RCE)

  1. Initial access: Unauthenticated remote attacker sends a specially crafted QUIC packet to an affected service over the network.
  2. Trigger: The packet triggers a use-after-free condition in the Microsoft QUIC implementation.
  3. Execution: Code execution occurs on the target system. Affected platforms include Windows 11 and Windows Server 2022/2025, including Server Core installations. No user interaction required.

Additional technical detail

CVE-2026-62832 (Windows User Profile Service — publicly disclosed zero-day): A local authenticated attacker with credentials for another local account runs a specially crafted application to load another user's registry hive via improper link resolution ("link following"). Successful exploitation grants administrator privileges. SANS notes this matches the researcher "Nightmare Eclipse's" description of "LegacyHive." Affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025.

CVE-2026-72971 (Windows Container Isolation FS Filter Driver — publicly disclosed zero-day): A link-following flaw in unionfs.sys affecting Windows 11 Version 26H1 on x64 and ARM64. A local authenticated attacker can tamper with files with high integrity impact. Microsoft rates confidentiality and availability impact as none. Assessed as "Exploitation Unlikely."

CVE-2026-63520 (Microsoft SharePoint Server RCE): Rapid7 reports this as the second vulnerability in a chain that, combined with CVE-2026-55040 (patched in July 2026), comprises a critical unauthenticated RCE in SharePoint Server. Patches available for SharePoint Server Subscription Edition, 2019, and 2016. Rapid7 has published a proof-of-concept for CVE-2026-55040.

Snort rule coverage: Talos released Snort 2 rules 1:66902–1:66910, 1:66912–1:66923, 1:66929–1:66932, 1:66935–1:66948 and Snort 3 rules 1:66902, 1:301589–1:301607. Cisco Secure Firewall customers should update their SRU.

Discrepancy note: Source counts vary — Talos reports 421 vulnerabilities, SANS reports 418, Tenable reports 398 CVEs (omitting two MITRE-assigned CVEs). The verified reference data covers the 10 CVEs listed in the authoritative set; all CVSS scores and KEV states in this advisory use those verified values.

4. Mitigation & containment

P1 — Within 24 hours

  • CVE-2026-68820 (KEV, exploited in the wild): Apply the August 2026 Windows security update to all Windows client and server systems immediately. Prioritise multi-user systems, terminal servers, and any host where untrusted users have local code execution. Monitor for suspicious privilege-escalation activity targeting the Ancillary Function Driver for WinSock. EDR rules should alert on SYSTEM-level process creation originating from low-privilege user contexts.
  • CVE-2026-62893 (WDS TFTP Server RCE, CVSS 9.8): Apply the August 2026 update to all systems running Windows Deployment Services. If WDS TFTP is not required, disable and remove the role. Block network access to TFTP ports on systems where the service cannot be immediately patched.
  • CVE-2026-62815 (Microsoft QUIC RCE, CVSS 9.8): Apply the August 2026 update to all Windows 11 and Windows Server 2022/2025 systems, including Server Core. If QUIC-enabled services are exposed to untrusted networks and patching cannot be completed within 24h, consider disabling QUIC at the OS or application level (e.g., IIS HTTP/3) as a temporary containment measure.
  • CVE-2026-62878 (Windows DNS Server RCE, CVSS 9.8): Apply the August 2026 update to all DNS Server roles. Restrict DNS service exposure to trusted network segments only.

P2 — Within 72 hours

  • CVE-2026-62832 (User Profile Service EoP, publicly disclosed): Apply the August 2026 update to all Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 systems. Limit local account reuse. Monitor for unusual registry hive loading or User Profile Service activity.
  • CVE-2026-62823 (DHCP Server RCE, CVSS 8.8): Apply the August 2026 update to all Windows DHCP Server systems. Restrict DHCP service exposure to adjacent trusted network segments.
  • CVE-2026-65665 (SharePoint Server RCE, CVSS 8.8): Apply the August 2026 update to all SharePoint Server deployments. Ensure AMSI integration is enabled for SharePoint where available.
  • CVE-2026-63520 (SharePoint Server RCE): Apply the August 2026 update to SharePoint Server Subscription Edition, 2019, and 2016. This patches the second half of an unauthenticated RCE chain (paired with CVE-2026-55040 patched in July). Verify that July 2026 patches were also applied.
  • CVE-2026-62911 (Exchange Server EoP, CVSS 8.0): Apply the August 2026 update to all Exchange Server deployments.
  • Azure-hosted critical vulnerabilities (CVE-2026-56162, CVE-2026-50515, CVE-2026-50481, CVE-2026-59115, CVE-2026-62830, CVE-2026-50516, CVE-2026-68823, CVE-2026-56161, CVE-2026-62873, CVE-2026-63508, CVE-2026-65667, CVE-2026-62896, CVE-2026-70332): These are cloud-service vulnerabilities. Confirm that Microsoft has applied the service-side patch in the affected Azure/M365 tenant. Review Azure SQL Database, Azure Service Bus, Azure AKS, Azure Entra ID, and Microsoft Teams configurations for evidence of exploitation. No client-side patch action is required for managed services, but access logs should be reviewed for anomalous privilege escalation.

P3 — Within 7 days

  • Apply the August 2026 update across all remaining Windows and Office/Excel/Word/SharePoint systems, covering the long tail of RCE and EoP vulnerabilities in Microsoft Office, Office Graphics Component, Office Word, Excel, GDI+, DNS Server, RRAS, SSTP, RMCAST, AD CS, Remote Desktop Client, and Device Health Attestation.
  • Update Snort/Suricata rule sets to the latest Talos release (Snort 2: 1:66902–1:66948; Snort 3: 1:66902, 1:301589–1:301607). Cisco Secure Firewall customers: update SRU.
  • Patch CVE-2026-72971 (unionfs.sys tampering) on Windows 11 26H1 systems using container isolation features.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Low-privilege user process triggering SYSTEM-level process creation via WinSock ancillary function driver EDR / Sysmon Event ID 1 (process creation), Event ID 4688 (process creation with command line) High — consistent with CVE-2026-68820 exploitation mechanism
Unusual registry hive loading by User Profile Service from a non-standard account context EDR / Sysmon Event ID 12, 13, 14 (registry object create/set/rename), Windows Event Log Medium — consistent with CVE-2026-62832 "LegacyHive" description
Unauthenticated crafted packet traffic to TFTP service (WDS) Network IDS / firewall logs (Snort rules 1:66902–1:66948) Medium — consistent with CVE-2026-62893 attack vector
Crafted QUIC packet traffic to exposed QUIC-enabled services Network IDS / firewall logs Medium — consistent with CVE-2026-62815 attack vector

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

10 referenced CVEs — 1 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

CVE CVSS Exploited EPSS Summary
CVE-2026-68820 7.0 High ⚠ KEV 2026-08-11 — Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-62830 9.9 Critical — 0% Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
CVE-2026-62893 9.8 Critical — — Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
CVE-2026-50516 9.4 Critical — — Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate p…
CVE-2026-65665 8.8 High — — Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-62823 8.8 High — — Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-62911 8.0 High — — Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a…
CVE-2026-68794 7.8 High — — Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-68816 7.8 High — — Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2026-68804 7.8 High — — Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

7. Sources

  • Cisco Talos, "Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities," https://blog.talosintelligence.com/microsoft-patch-tuesday-for-august-2026/, 2026-08-11
  • SANS Internet Storm Center, "Microsoft Patch Tuesday August 2026," https://isc.sans.edu/diary/rss/33236, 2026-08-11
  • Rapid7, "Patch Tuesday - August 2026," https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026, 2026-08-11
  • Tenable Research, "Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)," https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820, 2026-08-11

8. Adverse Trace position

This is a high-severity patch cycle. The single confirmed exploited-in-the-wild vulnerability (CVE-2026-68820, CVSS 7.0 HIGH, in CISA KEV) demands immediate patching on multi-user and internet-facing Windows systems, though the race-condition complexity may slow weaponisation for broad exploitation. The more urgent risk to EMEA financial services lies in the cluster of unauthenticated network RCE flaws in core infrastructure components — Windows Deployment Services TFTP Server (CVE-2026-62893, CVSS 9.8), Microsoft QUIC (CVE-2026-62815, CVSS 9.8), and Windows DNS Server (CVE-2026-62878, CVSS 9.8) — any of which could enable unauthenticated remote code execution on exposed server infrastructure. The publicly disclosed zero-days (CVE-2026-62832, CVE-2026-72971) lower the barrier for local privilege escalation and container escape but require prior local access. The Azure cloud-service vulnerabilities (including CVSS 10.0 flaws in Azure SQL Database, Teams, and Planetary Computer Pro) are Microsoft-side patches; clients should verify remediation in their tenants and audit access logs for anomalous activity. We will monitor for proof-of-concept releases targeting CVE-2026-68820 and the SharePoint RCE chain (CVE-2026-63520 / CVE-2026-55040) and will issue a follow-up advisory if weaponisation is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies