Microsoft confirms actively exploited Windows kernel zero-day, plus a wormable DNS flaw, in August Patch Tuesday
Microsoft's August 2026 Patch Tuesday confirmed CVE-2026-68820, a Windows kernel driver flaw in afd.sys, is being actively exploited to gain SYSTEM-level access. A separate, unauthenticated Windows DNS Server bug could be wormable.
Microsoft's August 2026 Patch Tuesday confirmed that CVE-2026-68820, a use-after-free flaw in afd.sys (the Windows kernel driver underlying WinSock), is being actively exploited in the wild to grant attackers SYSTEM-level privileges. Researchers note this is the fourth afd.sys zero-day exploited since 2022, with an earlier one linked to North Korea's Lazarus group. The same update fixes CVE-2026-62878, an unauthenticated, potentially wormable Windows DNS Server flaw, plus an Exchange Server bug with working exploit code demonstrated at Pwn2Own Berlin.