398 Microsoft Fixes: Prioritize Active Exploitation, Not the CVE Count

Verified Context

Microsoft released its August security update package, which according to Zero Day Initiative’s independent count includes 398 new vulnerabilities, 62 of them rated Critical.

The most important vulnerability in the release is CVE-2026-68820. Microsoft marks it as actively exploited. It affects AFD.sys, a Windows driver related to network socket operations, and allows privilege escalation to SYSTEM if an attacker already has code execution on the device.

Check Point Research links exploitation of CVE-2026-68820 to Operation Dream Job, a Lazarus-associated campaign targeting organizations in the defense, aviation and related sectors.

The Order of Action

With a release of this size, the easiest mistake is to focus only on the number of vulnerabilities. The practical order is different.

First, prioritize the actively exploited CVE-2026-68820, especially for systems where initial access risk already exists through phishing, malicious files, remote support tools or compromised user accounts.

Next come vulnerabilities that allow remote code execution without an account and without user interaction. These affect Windows DNS Server, Windows Deployment Services, Microsoft QUIC and HPC Pack. Their real urgency depends on whether the service is installed, active and reachable in the specific environment.

Where the Risk Concentrates

CVE-2026-68820 is a privilege escalation vulnerability. It is not the first door into the system, but a way for an attacker to move from an already compromised user context to SYSTEM privileges.

This makes it important in environments exposed to targeted phishing, malicious attachments, compromised users or attacks against workstations used by privileged staff.

The critical remote vulnerabilities in server services have a different profile. The question is whether the service is exposed to a network, whether it is reachable from the internet or a less trusted segment, and whether it can be used without authentication.

SharePoint Remains a Separate Check

The August release also includes a fix for CVE-2026-63520, a remote code execution vulnerability in SharePoint. It is part of a chain described by Rapid7, where the July vulnerability CVE-2026-55040 provides authentication bypass and the August fix closes the code execution component.

This distinction matters. CVE-2026-63520 is not the entire unauthenticated chain by itself. Organizations running on-premises SharePoint Server environments should confirm that both the July and August updates have been applied.

What Should Be Checked

Practical focus for IT and security teams:

• which Windows systems carry higher initial access risk;
• whether CVE-2026-68820 has been applied to critical workstations and servers;
• whether Windows DNS Server, Windows Deployment Services, QUIC or HPC Pack services are active;
• which of those services are reachable from the internet or less trusted network segments;
• whether on-premises SharePoint Server environments have both July and August fixes;
• whether there are signs of unusual privilege escalation, new administrative actions or system component changes;
• whether logs are available for retrospective review.

The key question is not “how many CVEs were released this month,” but “which of them affect our real environment and can be used first.”

DIAMATIX Comment

From the DIAMATIX perspective, this Patch Tuesday shows why vulnerability management must be connected to real exposure, not only CVSS score.

An actively exploited vulnerability with a lower score may have higher operational priority than a critical vulnerability in a service that is not installed or reachable. This is why patch management needs inventory, network visibility, exploitation context and post-update verification.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes help connect vulnerabilities, assets, service reachability and behavior in the environment. That allows teams to work by risk, not only by a list of numbers.

Questions for CISO and IT Teams

• Do we have a clear list of systems affected by the August Microsoft updates?
• Do we know which services are active and reachable?
• Can we prioritize an actively exploited vulnerability over a high-scored but unreachable service?
• Do we check for signs of compromise after applying patches?
• Do we have a separate process for on-premises SharePoint Server environments?
• Can we prove that critical systems were updated within internal deadlines?

The practical takeaway: large patch releases should not be handled with equal priority for every CVE. They need ordering by active exploitation, reachability and business criticality.

Prioritize updates by real risk

DIAMATIX can help assess vulnerabilities, exposure, active services, logs and response readiness around actively exploited Microsoft vulnerabilities.

Request a vulnerability management process review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• Microsoft Security Update Guide.
• The Hacker News. Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack.
• Check Point Research. Shattering the Dream — When a Job Offer Becomes a Zero-Day Attack.
• Zero Day Initiative. August 2026 Security Update Review.
• Rapid7 Labs. Microsoft SharePoint CVE-2026-55040 and related exploit chain analysis.

This article is based on publicly available information as of  August 2026.