398 CVEs, One Emergency: The afd.sys Bug That Earns an Off-Cycle Push

Microsoft shipped its monthly security updates on Tuesday, and the Zero Day Initiative, counting independently, puts the release at 398 new CVEs with 62 rated Critical ^[1][8]. Exactly one of them is flagged as under active exploitation ^[2], which is the only fact in the pile that should move a change window.

That one is CVE-2026-68820, scored 7.0 ^[2]. It sits in a core Windows kernel driver that handles network socket operations, and an attacker who already has code running on a machine can use it to escalate to SYSTEM ^[3]. Exploitation depends on winning a race condition in the driver ^[4]. Check Point Research describes the flaw as a use-after-free in afd.sys, the Ancillary Function Driver for WinSock and a kernel-side component of Windows networking ^[7], and says Lazarus used the zero-day in its Operation Dream Job campaign ^[6]. Microsoft itself has not publicly attributed the exploitation ^[5], so the actor call belongs to Check Point, not the vendor.

The scoring is the part operators tend to argue about. A 7.0 privilege escalation ranks 2.8 points below this month's highest-scored bugs ^[4], and it needs a foothold before it does anything ^[3]. It goes first anyway, because it is the only one being used ^[2]. Actively exploited beats theoretically severe, every time.

Behind it, four flaws need nothing from the victim: no account, no password, no click ^[9]. They hit Windows DNS Server, Windows Deployment Services, Microsoft's QUIC implementation, and HPC Pack, each at CVSS 9.8, and none was flagged as exploited when the updates shipped ^[9]. CVE-2026-62878 in DNS Server is a stack-based buffer overflow reachable remotely without authentication or user interaction; ZDI calls the condition wormable even though Microsoft rates exploitation as less likely, and that label describes the technical condition rather than an existing worm ^[10]. CVE-2026-62893 in WDS is reachable through the service's TFTP handling ^[11]. CVE-2026-62815 is unauthenticated remote code execution in Microsoft QUIC ^[12]. CVE-2026-59124 in HPC Pack carries the same 9.8 but is rated Important rather than Critical because HPC Pack is not installed by default, and Microsoft rates exploitation as more likely ^[13]. For all four, whether the vulnerable service is actually present and reachable matters as much as the score ^[14].

The release also completes a two-part SharePoint fix. Rapid7 Labs reported a chain to Microsoft on May 18 that combined an authentication bypass with a separate code execution bug to reach unauthenticated RCE against on-premises SharePoint ^[15], and Microsoft confirmed two days later that it would split the remediation across July and August ^[16][3]. July closed CVE-2026-55040, a Critical 9.1 authentication bypass that let a remote unauthenticated attacker assume the identity of a site user or administrator if the attacker knew whom to impersonate ^[17]. August supplies the code execution half, CVE-2026-63520 ^[18]. Rapid7 says the July patch already broke the demonstrated chain ^[19], but on-premises farms should hold both ^[20].