Skip to content
OriginalSign in
Image: SecurityWeek

SecurityWeekIonut Arghire

Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820

Part of the CVE-2026-68820 story · since 11 Aug

Quiet for 12 weekslast report 17 Aug17 articles10 outlets
11 Aug · Check Point first28 Sep14 OctNowThis article2nd of 17
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV. This article, 2nd of 17.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.

Microsoft's August 2026 Patch Tuesday addressed 421 CVEs, including a high-severity zero-day vulnerability (CVE-2026-68820) in WinSock's Ancillary Function Driver, allowing privilege escalation without user interaction. Other noteworthy vulnerabilities include CVE-2026-62832, which permits local privilege elevation via improper link resolution in the User Profile Service, and CVE-2026-72971 in Windows Container Isolation.

In total, the updates remediate 236 vulnerabilities in Windows, 98 in Office, and several in other products. Microsoft has indicated that some flaws may be targeted by threat actors, especially given the history of exploitation related to afd.sys vulnerabilities.

How the story developed

All 17 articles
Quiet for 12 weekslast report 17 Aug17 articles10 outlets

17 articles from 10 outlets since 11 Aug. Quiet since 17 Aug. This was the 2nd report, 1 hour after the first.

Now11 Aug12131415161718First reportCheck Point · 11 Aug, 17:51
  • Tue 11 Aug, 17:51 UTC. Check Point, first report. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 18:58 UTC. SecurityWeek, its first report on the story. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-68820. Cites a CVE in CISA KEV. This article, 2nd of 17.
  • Tue 11 Aug, 20:11 UTC. SANS ISC, its first report on the story. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th). Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:01 UTC. Krebs on Security, its first report on the story. Microsoft Plugs Nearly 400 Security Holes. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:32 UTC. Dark Reading, its first report on the story. Microsoft's Patch Tuesday Deluge Continues With August Updates. Cites a CVE in CISA KEV.
  • Tue 11 Aug, 22:36 UTC. CISA, its first report on the story. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:17 UTC. CISA. CISA Flags Windows Driver Use After Free Flaw CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 00:47 UTC. Rapid7, its first report on the story. Microsoft Fixes 421 Flaws Including SharePoint Zero Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline, its first report on the story. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 07:31 UTC. Security Affairs, its first report on the story. Microsoft patches wormable DNS flaw and critical WinSock zero day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. Infosecurity, its first report on the story. Microsoft Fixes 400 Flaws on August Patch Tuesday. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 13:32 UTC. SecurityOnline. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 17 Aug, 02:40 UTC. SecurityOnline. Critical Metabase SQLi flaw lets attackers seize full admin control. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 17 articles as a list
  1. Tue 11 AugDay 06
    1. Lazarus hits defence via fake job PDFs, CVE-2026-6882017:51 · Check Point · First report · Known exploited CVE
    2. Microsoft Patch Tuesday Fixes Zero Day Winsock Flaw CVE-2026-6882018:58 · SecurityWeek · Known exploited CVE · This article, 2nd of 17
    3. CISA Flags High Risk Windows WinSock Use After Free Flaw in KEV22:36 · CISA · official · CISA alert · Known exploited CVE
    Show 3 more from 11 Aug
    1. Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)20:11 · SANS ISC · Known exploited CVE
    2. Microsoft Plugs Nearly 400 Security Holes22:01 · Krebs on Security · Known exploited CVE
    3. Microsoft's Patch Tuesday Deluge Continues With August Updates22:32 · Dark Reading · Known exploited CVE
  2. Wed 12 AugDay 19
    1. CISA Flags Windows Driver Use After Free Flaw CVE-2026-6882000:17 · CISA · official · Known exploited CVE
    2. Microsoft Fixes 421 Flaws Including SharePoint Zero Day00:47 · Rapid7 · Known exploited CVE
    3. Microsoft Patch Tuesday Patches Critical WinSock Exploit03:40 · SecurityOnline · Known exploited CVE
    Show 6 more from 12 Aug
    1. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks03:41 · SecurityOnline · Known exploited CVE
    2. Microsoft patches wormable DNS flaw and critical WinSock zero day07:31 · Security Affairs · Known exploited CVE
    3. Lazarus uses fake job offers to exploit Windows CVE-2026-6882009:11 · SecurityWeek · Known exploited CVE
    4. Microsoft Fixes 400 Flaws on August Patch Tuesday09:11 · Infosecurity · Known exploited CVE
    5. CVE-2026-61515: Unauthenticated Command Injection in Puwell IP Cameras, PoC Exploit Code Publicly Disclosed13:32 · SecurityOnline · Known exploited CVE
    6. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day14:11 · Infosecurity · Known exploited CVE
  3. Thu 13 AugDay 21
    1. Lazarus Group exploits CVE‑2026‑68820 via fake job offers08:52 · Security Affairs · Known exploited CVE

  4. Quiet for 4 days

    Mon 17 AugDay 61
    1. Critical Metabase SQLi flaw lets attackers seize full admin control02:40 · SecurityOnline · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in