August Alert: active operation of CVE-2026-68820 and four critical CERs failures without authentication on Windows

Microsoft published in its monthly patch cycle and among the August corrections there is a vulnerability that the company itself points out as actively exploited: CVE-2026-68820. This is a failure in the afd.sys core controller, the kernel component that manages Windows socket operations (the so-called Ancient Function Driver for WinSock). According to the technical analyses available, it is a condition of use-after-free / race which allows code already running on a machine to raise privileges to the SYSTEM account. Microsoft has not publicly attributed the intrusions; Check Point Research has reported that actor Lazarus used this zero-day in the campaign called "Operation Dream Job." (Official sources and technical analysis: Microsoft Security Update Guide, Check Point Research.)

Confirmed facts: Microsoft marked CVE-2026-68820 as exploited in nature and classified it with a medium-high gravity (CVSS 7.0). The mechanism described is dependent on a race condition in afd.sys, which means that an attacker first needs to run code in the target system to take advantage of it and, from there, obtain SYSTEM privileges. Information reported but not confirmed by Microsoft: Check Point Research attributes uses of this failure to Lazarus in a specific campaign; Microsoft has not yet published an attribution.

Technically, a use-after-free in a kernel network controller is dangerous because the kernel manages central resources and SYSTEM privileges allow total control of equipment and credentials in memory. The vector described requires the presence of previous hostile code (e.g. a compromised application, already executed malicious macro, or remote shell obtained by another failure). Once the attacker runs local code, the exploitation of the race in afd.sys gives him the final step towards complete control of the system, facilitating persistence, deployment of rootkits and lateral movement within the network.

In addition to this zero-day operation, the update package includes four vulnerabilities with CVSS 9.8 score that can allow remote execution without authentication (i.e., "no account, no password, no click"): CVE-2026-62878 on Windows DNS Server (overflow of buffer in stack, ZDI describes it as "wormable"), CVE-2026-62893 on Windows Deployment Services (TFTP), CVE-2026-62815 on Microsoft QUIC and CVE559PC in H124. Microsoft did not point to active exploitation for these four failures when publishing the patches. The practical importance of these CERs depends on the vulnerable service being installed and accessible from the attacker's network.

Useful distinctions: ZDI (Zero Day Initiative) accounts for the size of the patch package and classifies technical conditions as "wormable" when a vulnerability allows automatic propagation; that is a technical indicator, not proof that a worm already exists by exploiting it. Microsoft prioritizes active exploitation above the mere CVSS score by suggesting the order of patching; therefore CVE-2026-68820 (exploited) takes precedence despite its lower score.

Another relevant point that completes the August cycle is the second half of a SharePoint chain reported by Rapid7. In July Microsoft patched CVE-2026-55040, an authentication bypass (Critical, 9.1) that allowed to supplant the identity of a user or administrator if the identity was known to be falsified. In August the remote execution part is closed with CVE-2026-63520. Rapid7 reported the initial chain to Microsoft; the combination of both failures was the one that allowed an unauthenticated CERs in on-premises environments. Microsoft divided the mitigation into two updates; applying the July one was already interrupting the chain and the August one is over the correction.

What real consequences can this have: for endpoints where an attacker already has code execution, CVE-2026-68820 offers the way to rise to SYSTEM and fully commit workstations and servers. For the four bugs 9.8, a remote attacker without credentials could run code on exposed servers (DNS, WDS, QUIC, HPC), which facilitates initial and potentially self-propagation commitments within networks with accessible services. In SharePoint on-premises the absence of both patches would leave a route for CERs without authentication.

Specific and orderly recommendations (practical actions): in production environments, priority according to exposure and active exploitation.

1) Immediate patch of systems at risk of local climbing: for equipment where there is a possibility that an attacker has already executed code (e.g., working stations with users exposed to phishing, environments with unreliable processes), install the patch for CVE-2026-68820 as a priority and restart as indicated by Microsoft.

2) Plot or mitigate exposed critical remote services: identify servers that run Windows DNS Server, Windows Deployment Services (WDS / TFTP), Microsoft QUIC or HPC Pack. If the service is not necessary, uninstall it or block it from the perimeter (filter ports: 53 TCP / UDP for DNS, 69 UDP for TFTP / WDS, 443 UDP for QUIC) to apply patches. If you must remain active, plan the urgent update and pre-deployment testing.

3) Correct SharePoint on-premises: confirm that the on-premises farms applied the July (CVE-2026-55040) and August (CVE-2026-63520) correction. Both are necessary to close the chain that Rapid7 demonstrated.

4) Inventory and segmentation: make an inventory of installed roles and servers listening on the Internet; prioritize those that are accessible from the Internet. Apply segmentation and control lists to limit the scope of administrative services.

(5) Detection and containment: activate telemetry / EDR to detect attempts to raise privileges (token manipulation, suspicious kernel calls, aff.sys instability). Review logs and alerts related to afd.sys failures, start of unusual processes with SYSTEM privileges and incoming connections to vulnerable services. Consider searches led by IOC and behavior (e.g. processes that attempt to manipulate sockets at the kernel level after unusual network activity).

(6) Tests and controlled deployment: apply patches first in test environments, confirm compatibility (third-party drivers who interact with WinSock may require additional test) and then deploy to production using WSUS / Intune / SCCM according to your process.

What is confirmed is the existence of the active explosion for CVE-2026-68820 and the presence of four remote CERs without high impact authentication. The uncertain: the actual extension of customer commitments and the complete attribution by Microsoft (which has not yet published it). In any case, the combination - active operation on a network controller and multiple high-gravity RCEs - makes this August patch cycle one that security teams must address immediately with inventory, exposure mitigation and update deployment. For more details on the ads and patches see the Microsoft update guide and the public technical analyses of the laboratories that have published findings on these failures ( MSRC Update Guide, Check Point Research, Zero Day Initiative).