Microsoft fixes 421 flaws in August 2026, including a Lazarus-exploited zero-day

August 11, 2026. Microsoft shipped its monthly Patch Tuesday with 421 fixes — 62 critical and 357 important. A record volume that almost buries the headline: inside that mass, one flaw is already being exploited in the wild, and two more allow remote code execution with no authentication. The security team’s job this month is not to patch everything at once — it is to triage fast, and in the right order.

The exploited zero-day, CVE-2026-68820, is a use-after-free in the afd.sys driver (Ancillary Function Driver for WinSock). A locally authenticated attacker, even at low privilege, can trigger a race condition to reach SYSTEM — “user interaction is not required,” Microsoft notes.

What makes this bug the top priority is who is using it. Check Point researchers attribute the exploitation to North Korea’s Lazarus group, inside the Operation Dream Job campaign: the flaw is used to drop a kernel-mode rootkit on the victim’s machine. The full chain — social engineering through a fake job offer, then a zero-day, then a rootkit — is a reminder that a “local” privilege-escalation flaw is only local for the attacker, never for the victim.

Operation Dream Job is not a new campaign: ESET has documented it since 2023. What changes in 2026 is that Lazarus still holds fresh zero-days to feed it. The playbook is constant — fake job offer, trapped interview, then malware payload — and it carries an operational truth: here, the patch closes the door after the attacker already gained initial access. Anti-phishing awareness for technical staff is therefore worth as much as the patch itself.

Volume as the new normal

421 fixes in a single month, after an already heavy July 2026: the underlying trend is an explosion in reported bugs. Dustin Childs, of the Zero Day Initiative, puts it plainly — “this volume of updates seems to be the new normal, at least for now.” The corollary is less comfortable: Microsoft lists some exploited flaws as “unproven” and downplays working Pwn2Own exploits, which forces teams into independent risk triage. Relying on the vendor’s classification alone means falling behind.

That triage must separate impact from exploitability. Ivanti offers a simple criterion: a high-CVSS CVE that is neither exploited nor internet-facing is not the same urgency as a pre-authentication flaw on an exposed service. A score does not tell you who is attacking or through which door — only the CISA KEV, exploitation advisories and your exposure map do. That is the discipline behind a good triage: separating the noise of 421 bulletins from the signal of a handful of exploited or pre-auth flaws.

Two network flaws exploitable without authentication

Behind the zero-day, two vulnerabilities deserve a “before the weekend” treatment because they are pre-authentication:

• CVE-2026-62815 — a critical flaw in Microsoft QUIC. An unauthenticated attacker can execute code remotely by sending a specially crafted packet to an affected service. “No authentication or user interaction is required,” Microsoft states.
• CVE-2026-62878 — a stack-based buffer overflow in Windows DNS leading to remote code execution, described as reliable, remote and unauthenticated.

These two are a CISO’s nightmare: services exposed to the Internet (DNS, QUIC/HTTP/3), exploitable with no account, and requiring a reboot to remediate. On an internet-facing Windows DNS server, the order is simple: CVE-2026-62878 before everything else.

Finally, CVE-2026-63520 is a SharePoint RCE discovered by Rapid7 that, chained with CVE-2026-55040 — already patched in July — yields unauthenticated RCE against a vulnerable server. Internet-exposed SharePoint instances belong in the same patch wave.

Three publicly disclosed flaws

Microsoft lists three vulnerabilities “publicly disclosed” before the patches shipped — meaning the PoC is already circulating:

• CVE-2026-62832, dubbed LegacyHive, in the Windows User Profile Service: a standard user can force the service to load an administrator’s registry hive and gain admin privileges. The PoC, released by researcher Nightmare-Eclipse hours after July’s Patch Tuesday, has been public for three weeks.
• CVE-2026-72971 — the unionfs.sys driver (Windows Container Isolation FS Filter Driver), ARM64 systems only.
• CVE-2026-62737 — a privilege escalation in the Windows kernel. CrowdStrike flags a Chinese-language blog that published a PoC on August 9, 2026, capable of triggering a crash.

The patch-bypass that complicates matters

The same researcher, Nightmare Eclipse, also released ShieldBreak, a PoC that bypasses the patch for CVE-2026-50656, the RoguePlanet Microsoft Defender flaw fixed in July 2026. Analyst Will Dormann confirmed the PoC works with Defender enabled, on Windows 11, Windows 10 and Windows Server 2025.

The lesson is twofold: a defense layer is itself patchable, and the gap between a fix and its bypass keeps shrinking. Tracking bypass advisories is now part of the threat-intel cycle, right alongside the CVEs.

The patch order that actually protects

The 421-fix volume is the “new normal,” argues Dustin Childs (Zero Day Initiative) — but the explosion in reported bugs has not come with any equivalent rise in bugs actually exploited. The risk is not the volume; it is the selection.

The triage in three waves:

1. Wave 1 (24-48 h): CVE-2026-68820 on every endpoint, then CVE-2026-62878 (DNS) and CVE-2026-62815 (QUIC) on anything exposed. Add CVE-2026-63520 if you expose SharePoint.
2. Wave 2 (standard cycle): the disclosed escalations — CVE-2026-62832, CVE-2026-62737 — serious but post-authentication.
3. Wave 3: everything else, respecting test phases. Tyler Reguly (Fortra) warns that patching too fast sometimes breaks more than it protects.

Ivanti adds a decisive triage criterion: a high-CVSS CVE that is neither exploited nor internet-facing can wait for the second wave. CVSS alone should not dictate the order — real exploitability (exploited, disclosed, exposed) should.

Verdict

Three decisions for this Patch Tuesday. If your estate runs internet-facing Windows DNS or QUIC/HTTP/3 endpoints, patch CVE-2026-62878 and CVE-2026-62815 first: they are your two network entry points. The CVE-2026-68820 zero-day is your endpoint emergency — Lazarus does not spray at random, it targets your company through a job offer. And if you expose SharePoint, treat CVE-2026-63520 in the same window.

The remaining 421 fixes can follow your standard cycle: volume is no reason to rush untested reboots. This month, the skill that matters is not patch speed — it is triage quality.

References

• Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820) — Help Net Security, August 12, 2026
• Microsoft Patch Tuesday, August 2026 Security Update Review — Qualys, August 11, 2026
• August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs — SecurityWeek, August 11, 2026
• The August 2026 Security Update Review — Zero Day Initiative, August 11, 2026
• Shattering the Dream: when a job offer becomes a zero-day attack — Check Point Research
• Patch Tuesday Analysis — August 2026 — CrowdStrike