cyberresearch.us

TLP:CLEAR confidence:medium · #cyber-news #emerging

August 2026 Patch Tuesday

Luke Johnson / Cyber Research US

Summary

This memo synthesizes public August 2026 Microsoft Patch Tuesday reporting (SANS ISC, Cisco Talos, CrowdStrike, Dark Reading titles/summaries). Microsoft shipped a large monthly set of fixes (reported as 415–421 CVEs depending on outlet) including 62 Critical issues; vendors agree one vulnerability is exploited in the wild. The confirmed exploited issue is a local Windows privilege-escalation bug; additional Critical RCEs on network-facing Windows and Microsoft server roles are called out as more likely to be exploited after disclosure. Independent reverse engineering was not performed.

Attack vector

The in-the-wild issue, CVE-2026-68820, is local: an already authorized user on a Windows host reaches the Ancillary Function Driver for WinSock (AFD) and elevates privileges (Talos). Separate Critical RCEs that Microsoft rated more likely to be exploited do not require that same local foothold: CVE-2026-62893 is unauthenticated code execution over the network against Windows Deployment Services TFTP Server; CVE-2026-65665 is authenticated code execution over the network against Microsoft SharePoint Server; CVE-2026-62823 is unauthenticated code execution from an adjacent network against Windows DHCP Server (Talos). Office/Excel issues in the same release are local document-driven RCEs (unauthorized attacker, local execution). Azure SRE Agent and AKS issues are network privilege-elevation paths (authorized vs unauthorized respectively). SANS also flags Critical QUIC and DNS Server RCE surfaces and container tampering, but those articles do not give protocol/precondition detail beyond the product names.

Exploit

CVE-2026-68820 is a use-after-free in the WinSock AFD that an authorized local attacker can turn into elevation of privilege (CVSS 7.0) (Talos). CVE-2026-62893 is likewise a use-after-free, but remotely and without authorization, against the WDS TFTP server (CVSS 9.8). CVE-2026-65665 is deserialization of untrusted data on SharePoint Server, allowing an authorized network attacker to execute code (CVSS 8.8). CVE-2026-62823 is a heap-based buffer overflow on Windows DHCP Server for adjacent-network RCE (CVSS 8.8). Other named classes in the same drop include missing authorization (Azure SRE Agent, CVE-2026-62830), missing authentication for a critical function (AKS, CVE-2026-50516), Exchange authentication bypass by capture-replay (CVE-2026-62911), and multiple Office/Excel memory-corruption primitives (heap/stack overflow, numeric truncation, UAF, OOB read/integer underflow). No public exploit chain, PoC, or tooling is described in the provided coverage.

In the wild / novelty

Microsoft (via Talos and echoed by SANS and CrowdStrike) states that one August 2026 vulnerability has been exploited in the wild: CVE-2026-68820. SANS additionally reports two publicly disclosed zero-days in the same release; the provided Talos excerpt names the exploited AFD bug but does not identify which two CVEs were the public zero-days. Coverage is disclosure-day Patch Tuesday analysis, not a named campaign, honeypot write-up, or confirmed victim list. Distinguish: exploited-in-the-wild claim is Microsoft’s (relayed by Talos/SANS/CrowdStrike); public disclosure of additional zero-days is asserted by SANS only in this cluster; no outlet here claims a public PoC.

Risk

Successful use of CVE-2026-68820 turns a low-privilege local account into a privileged Windows identity (typical LPE blast radius: host takeover, credential/token theft, EDR/AV disablement, lateral movement). The higher-severity network RCEs expand that to unauthenticated or authenticated remote compromise of WDS/TFTP imaging infrastructure, SharePoint, and adjacent-network DHCP servers—assets that often sit on privileged management or user-facing segments. Azure SRE Agent (CVSS 9.9) and AKS (CVSS 9.4) EoP bugs, if unpatched, threaten cloud control-plane / cluster privilege boundaries. Office/Excel RCEs risk user-assisted endpoint compromise via documents. Failure mode if patches lag: mixed local LPE plus newly disclosed Critical RCEs on core Microsoft server roles.

Remediation

Apply Microsoft’s August 2026 security updates across Windows, Office/Excel, SharePoint, Exchange, WDS, DHCP Server, and relevant Azure/AKS components as inventoried in the official advisories for the CVEs below (Talos; SANS; CrowdStrike). Prioritize (1) the exploited AFD/WinSock LPE, (2) internet- or campus-exposed WDS TFTP, SharePoint, and DHCP servers, then (3) Exchange and Azure/AKS control-plane roles Microsoft marked important even if “less likely.” Validate by confirming the August 2026 KBs/build revisions on endpoints and servers and by reducing exposure of TFTP/WDS, DHCP, and SharePoint to untrusted networks. Talos’ post is titled around Snort coverage, but specific SID lists are not in the extracted article body—pull those from Talos/Snort after patching rather than inventing detections. Hunt for unexpected local privilege jumps and anomalous access to AFD/WinSock, WDS TFTP, DHCP, and SharePoint after the patch window; this cluster does not publish IOCs.

CVE / identifiers

CVE-2026-68820 (exploited; WinSock AFD UAF EoP); CVE-2026-62893 (WDS TFTP UAF RCE); CVE-2026-65665 (SharePoint deserialization RCE); CVE-2026-62823 (DHCP heap overflow RCE); CVE-2026-62830 (Azure SRE Agent missing authorization EoP); CVE-2026-50516 (AKS missing authentication EoP); CVE-2026-62911 (Exchange capture-replay EoP); Excel CVE-2026-68794, CVE-2026-68816, CVE-2026-68804; Office CVE-2026-63515, CVE-2026-65657, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, CVE-2026-64910, CVE-2026-64911, CVE-2026-70130 (Talos; list truncated in source). CWE-style classes stated: use-after-free, heap/stack buffer overflow, deserialization of untrusted data, missing authorization/authentication, authentication bypass by capture-replay.

Confidence

medium — outlets agree on ~60+ Critical fixes and one exploited zero-day, and Talos gives concrete bug classes and preconditions for several CVEs; CVE totals conflict (415 / 418 / 421), Dark Reading and CrowdStrike bodies in this cluster are incomplete, and SANS’ QUIC/DNS/container items plus the two public zero-days are not mapped to CVEs here.

Open questions

Which two CVEs are the publicly disclosed zero-days SANS counts, and is CVE-2026-68820 one of them or a third issue? Exact Microsoft CVE/KB inventory and why counts differ across SANS, CrowdStrike, and Talos. Technical details for the QUIC, DNS Server RCE, and container-tampering bugs SANS called notable. Exploitation volume, actor, or malware family for CVE-2026-68820 (not stated). Whether WDS TFTP / DHCP / SharePoint bugs have in-the-wild use (Microsoft rated some “more likely,” not “exploited”). Snort/rule IDs promised by Talos’ title but absent from the extracted body.

Sources