Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
- ID
- 13266
- Status
- summarized
- Published
- 12 Aug 2026, 4:10 AM
- Fetched
- 12 Aug 2026, 4:55 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/microsoft-patches-398-flaws-including.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.0
- Created
- 12 Aug 2026, 5:00 AM
- Tags
- Audience
- developers
What happened
Microsoft's August 2026 Patch Tuesday closes 398 CVEs (62 Critical), including CVE-2026-68820, a use-after-free in afd.sys (Windows kernel WinSock driver) under active exploitation that escalates privileges to SYSTEM. Check Point Research attributes the zero-day to Lazarus's Operation Dream Job campaign. Four unauthenticated 9.8-CVSS remote code execution flaws affect Windows DNS Server (described as wormable by ZDI), Windows Deployment Services, Microsoft's QUIC implementation, and HPC Pack.
Why it matters
If you operate on-prem Windows servers—especially DNS Server, SharePoint farms, or anything using QUIC—patch immediately and prioritize the actively exploited afd.sys privilege escalation first, then the four 9.8 unauthenticated RCEs. Cloud-native builders on managed infrastructure (AWS/Azure/GCP Linux) are largely unaffected and can deprioritize this.
Discussion angle
Which of these CVEs actually matter to a cloud-native or AI/ML workload—almost none, unless you self-host on Windows Server or run SharePoint on-prem.