August 2026 is the largest Patch Tuesday on record, and nobody agrees on how large.
| Outlet | CVEs reported |
|---|---|
| The Hacker News | 398 |
| BleepingComputer | 400 |
| SecurityWeek | 421 |
None of them publishes a counting method. The gap is presumably third-party CVEs — SecurityWeek notes two non-Microsoft entries in TPM 2.0 alone — plus republished Chromium advisories and Mariner packages, which some counts fold in and others do not.
We are flagging it rather than picking one, because the number is the least useful thing in the release. Whichever figure is right, no organisation patches four hundred things this week, and the order you do them in is what changes your risk.
The one under attack
CVE-2026-68820 — a use-after-free in afd.sys, the Ancillary Function Driver for WinSock, which is the kernel-side component behind Windows networking.
| CVSS | 7.0 |
| Requires | Code already running on the machine |
| Gives | SYSTEM |
Microsoft's description: a locally authenticated attacker runs a crafted application to trigger a race condition, and successful exploitation yields SYSTEM.
Check Point discovered and reported it, and attributes the exploitation to Lazarus. Microsoft has made no official attribution of its own.
A 7.0 that is being used beats a 9.8 that is not, and this is the clearest example of that you will see this year. The score is low because the flaw needs a foothold first — which is a statement about the vulnerability, not about the campaign.
How the foothold arrives
Check Point's chain is worth reading in full, because it explains why "requires local access" is not the mitigation it sounds like:
- Fake recruiter outreach on professional platforms
- A malicious archive containing a PDF viewer, a malicious DLL and an encrypted payload
- DLL sideloading executes the Mistpen downloader in memory
- Reconnaissance and persistence
- CVE-2026-68820 for privilege escalation
- ForestTiger backdoor deployed
An alternative chain uses a trojanised "SecurityPDF" viewer to deploy Troy, a new DLL implant supporting 17 operator commands including file operations and shell access. Infrastructure runs through compromised Roundcube webmail and CMS platforms hosting RelayShell, a relay between infected endpoints and the operator.
Targets: defence, aerospace and aviation in France, Germany, Brazil and India. Active since early 2026.
Step one is a job offer. Every organisation is one convincing recruiter away from step five, and this month step five works on a fully patched machine.
Priority one is this patch, on any Windows estate where a foothold is plausible. That is all of them.
The four that need no foothold at all
Four unauthenticated RCEs at CVSS 9.8 — no authentication, no user interaction, no prior access:
| CVE | Component | Note |
|---|---|---|
| CVE-2026-62878 | Windows DNS Server | Stack-based buffer overflow; ZDI labels it wormable |
| CVE-2026-62893 | Windows Deployment Services | Exploitable through TFTP handling |
| CVE-2026-62815 | Microsoft QUIC | RCE, no interaction |
| CVE-2026-59124 | HPC Pack | Rated Important; not installed by default; exploitation "more likely" |
"Wormable" on a DNS server is the phrase to stop at. Windows DNS Server is usually a domain controller, and a domain controller is usually reachable from everything. If you run one exposed in any form, CVE-2026-62878 is not a monthly-cycle item.
The other three are narrower by deployment: WDS and HPC Pack exist in specific estates, and Microsoft QUIC's exposure depends on what is listening.
The SharePoint chain closes
This one spans two months, which is easy to mishandle:
- CVE-2026-55040 (July) — critical authentication bypass, CVSS 9.1, allowing user impersonation
- CVE-2026-63520 (August) — the RCE component
Chained, they produced unauthenticated remote code execution on SharePoint. Patching the July authentication bypass breaks the demonstrated chain.
If you deferred July's SharePoint update and are now applying August's, you have half a fix. On-premises SharePoint farms need both.
Reading a 398-CVE month
A release this size cannot be triaged by severity alone — there are 62 Criticals and no organisation patches 62 things this week. The order that actually reduces risk:
- CVE-2026-68820 — exploited, and the precondition is one you should assume
- Exposed DNS, WDS, QUIC and HPC services — unauthenticated, and the DNS one is wormable
- On-premises SharePoint — both July and August, or neither counts
Everything else follows your normal cycle.
The pattern is the same one behind the Kemp LoadMaster flaw that reached KEV: the CVSS number describes the vulnerability in isolation, and the thing you are defending against is a campaign. Lazarus does not care that afd.sys scores 7.0. They care that it works after the phishing email lands, and this month it does.
