Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack
Summary: Microsoft released its monthly security updates on Tuesday, closing 398 new CVEs, 62 of them rated Critical, including CVE-2026-68820, a use-after-free in the afd.sys Windows kernel driver that Microsoft flags as under active exploitation. That flaw requires code already running on the machine to escalate to SYSTEM, while four other flaws in Windows DNS Server, Windows Deployment Services, QUIC, and HPC Pack carry CVSS scores of 9.8 and need no account, password, or click.
Key Takeaway: Check Point Research attributes the exploited driver zero-day to Lazarus in its Operation Dream Job campaign, and the four 9.8 flaws can hand an attacker code on a server without an account or user action - so patch order depends on which vulnerable services are actually present and reachable in your environment.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-55040CVE-2026-63520CVE-2026-68820
- Related
- Researchers Disclose AI-Assisted Share Point Exploit Chain Reaching Unauthenticated RCE Cyber Risks ·CVE-2026-55040: Microsoft Share Point Weak Authentication Vulnerability Known Exploited Vulnerabilities · Aug 18, 2026CVE-2026-68820: Microsoft Windows Ancillary Function Driver for Win Sock Use-After-Free Vulnerability Known Exploited Vulnerabilities · Aug 11, 2026