Microsoft August 2026 Patch Tuesday: DNS RCE, Zero-Day

Microsoft shipped another outsized security release on August 11, 2026, patching more than 400 vulnerabilities and confirming that one of them was already being exploited in the wild. Buried in the volume is a flaw defenders will want at the top of their queue: a wormable, unauthenticated remote-code-execution bug in Windows DNS Server rated 9.8 on the CVSS scale. The month continues the pattern set earlier in the summer, when Microsoft’s record July release topped 600 CVEs — a volume the company has attributed to AI-accelerated internal bug hunting.

The headline numbers

As with recent months, the exact CVE tally depends on who is counting. SecurityWeek logged 421 CVEs; Tenable scoped Microsoft-issued fixes at 398; BleepingComputer and CrowdStrike reported around 400; and other trackers landed between the high 390s and low 420s. The spread reflects how vendors handle Microsoft-issued versus republished third-party CVEs, but the shape is consistent: this is another very large Patch Tuesday, and Windows accounts for the bulk of it. Trackers broke the fixes down roughly as 236 in Windows, close to 98 across Office, 30 in SharePoint Server, 26 in developer tools, 17 in Azure, 7 in Exchange Server, and one in Defender.

By most counts the release includes three zero-days — vulnerabilities that were public or under attack before a patch existed — of which one was actively exploited in the wild. That trio, not the raw four-hundred-plus total, is where the urgency sits.

The exploited zero-day: a WinSock privilege bug

The flaw confirmed under active attack is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) — the kernel-mode driver that underpins the Windows Sockets API. Exploitation lets a low-privileged local attacker elevate to SYSTEM, the highest privilege level on a Windows machine.

Elevation-of-privilege bugs like this one rarely provide the initial break-in. Instead they are the second stage of an intrusion: an attacker who already has a foothold — through phishing, a stolen credential, or another exploit — uses the flaw to escalate from a restricted account to full control of the host. That afd.sys, a driver present on every Windows system, is the vehicle makes it a broadly useful tool, which is likely why it was weaponized before a patch landed. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, obligating federal agencies to remediate on an accelerated timeline and signaling to everyone else that exploitation is real, not theoretical.

The wormable one: Windows DNS Server RCE

The vulnerability drawing the most alarm from severity, rather than confirmed exploitation, is CVE-2026-62878, a remote-code-execution flaw in Windows DNS Server carrying a CVSS score of 9.8. Described as a stack-based buffer overflow, it requires no user interaction and can be triggered by a remote attacker — the profile of a bug that could be wormable, spreading machine to machine without human help.

DNS servers are among the most exposed and most trusted pieces of infrastructure an organization runs; a server that resolves names for an entire network sitting at the edge of that network is close to a worst case for a pre-authentication RCE. Microsoft did not report in-the-wild exploitation of CVE-2026-62878 at release, but the combination of a 9.8 score, no authentication, and wormable potential is exactly the pattern defenders treat as urgent regardless. Any internet-facing or internally critical DNS server running the affected role should be patched ahead of the routine queue.

The publicly disclosed flaw

The third zero-day, CVE-2026-62832, is an elevation-of-privilege vulnerability in the Windows User Profile Service that was publicly disclosed before a patch was available but not, as of release, observed under attack. A public proof-of-concept shortens the runway between disclosure and exploitation, so while it ranks below the actively exploited WinSock bug, it belongs in the same near-term patch cycle rather than a later one.

Why the counts keep running high

August’s 400-plus is the new normal, and the cause is by now familiar. Microsoft has said it is using AI to accelerate internal vulnerability discovery, finding more flaws faster than human review alone and shipping them in ever-larger monthly batches. The company has told customers plainly to expect a higher volume of updates as a direct result.

That reframes what a “big” Patch Tuesday means. A spike in fixes once hinted at a surge in attacker interest or newly scrutinized code; increasingly it reflects the defender’s own tooling surfacing bugs internally before adversaries reach them — a genuinely positive dynamic that nonetheless shifts the burden downstream. AI is compressing the discovery half of the vulnerability lifecycle while the testing-and-deployment half still runs at human speed. Administrators now triage hundreds of CVEs a month, and the skill that matters is no longer patching everything at once but ranking what to patch first. As always, the distinction between a publicly known and an actively exploited zero-day is the line that should drive that ranking.

What to prioritize

With 400-plus fixes on the table, triage is the whole exercise. The order is dictated by exploitation status and reachability, not raw severity:

1. Patch the exploited WinSock zero-day (CVE-2026-68820) everywhere. It is under active attack and on CISA’s KEV list. Because it is an escalation used mid-intrusion, patching it removes a reliable rung attackers rely on after gaining a foothold.
2. Patch Windows DNS Server (CVE-2026-62878) on every server running the role, prioritizing internet-facing and internally critical resolvers. A wormable, unauthenticated 9.8 is the kind of flaw that turns a single exposed server into a network-wide event, and DNS has a long history of being probed hard once a fix telegraphs the bug.
3. Address the publicly disclosed User Profile Service flaw (CVE-2026-62832) in the same cycle, given the shortened window a public disclosure creates.
4. Work through the remaining critical Windows, Office, and SharePoint CVEs on a normal risk-ranked schedule. SharePoint in particular has been a repeat target this year, and on-premises servers should not sit unpatched — the platform sits too close to identity and file infrastructure to treat casually, as a run of SharePoint remote-code-execution flaws under active attack has shown.

What it means

The August release reinforces two trends that now define enterprise patching. The first is volume as the baseline: 400-plus CVEs is no longer an anomaly but the expected monthly load, driven by Microsoft’s own AI-assisted discovery. The second is that triage beats coverage. No team patches everything the day it ships, so the winners are the organizations that can quickly separate the two or three genuinely dangerous flaws — the exploited WinSock bug and the wormable DNS RCE this month — from the long tail of lower-risk fixes.

The losers, as ever, are the laggards. A wormable pre-authentication RCE in DNS Server is precisely the class of vulnerability that has powered past mass-exploitation events, and the gap between a patch being available and being deployed is the window attackers race to exploit. Organizations that let internet-facing DNS servers or unpatched federation and profile services sit exposed are the ones that turn a manageable Patch Tuesday into an incident. The volume is not going down; the discipline that separates a routine update cycle from a breach is knowing what to patch first, and moving before the exploit code catches up.