More than 400 CVEs in a single Patch Tuesday. Exactly one of them was already being used against defense contractors.
Microsoft's August 2026 release addressed over 400 vulnerabilities — 42 rated Critical, 37 of those remote code execution — with CVE-2026-68820 confirmed exploited in the wild before the patch shipped.
WHAT ACTUALLY HAPPENED
CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys). An authenticated local attacker triggers a race condition and gains SYSTEM. Lazarus Group used it in Operation Dream Job against aerospace and aviation targets in Europe and India, pairing it with the FudModule 3.1 kernel rootkit to disable EDR telemetry.
CISA added it to KEV on August 11. A week later, on August 18, four more went in: CVE-2026-33824 (Windows IKE Service Extensions double free), CVE-2026-55040 (SharePoint weak authentication), CVE-2026-59310 (VMware vCenter path traversal) and CVE-2026-65400 (Apple macOS improper authentication).
WHY VOLUME IS THE ADVERSARY'S FRIEND
A 400-CVE release is not a patching problem, it is a triage problem. Rank strictly by CVSS and the SYSTEM-level local escalation actually being used by a nation-state actor sits below dozens of theoretical criticals that nobody has ever weaponized.
Exploitation status beats severity score. A CVSS 7.8 with a working exploit in a live campaign is more urgent than a CVSS 9.8 with no public proof of concept and no exposed instances in your estate.
WHAT TO DO NOW
PATCH THE KEV ENTRIES FIRST, ALWAYS — CVE-2026-68820 and the August 18 batch outrank everything else in this cycle regardless of their CVSS numbers.
DO NOT DEPRIORITIZE LOCAL PRIVILEGE ESCALATION — "requires local access" describes every phishing victim, and it is the hinge that turns an initial foothold into a rootkit.
SEPARATE WORKSTATION AND SERVER RINGS — afd.sys exposure is endpoint-wide, so your laptop fleet needs the same urgency you reserve for datacenter assets.
CLOSE THE IKE AND SHAREPOINT GAPS THIS WEEK — CVE-2026-33824 and CVE-2026-55040 are both internet-reachable in many designs and both now confirmed exploited.
Patching everything is not a strategy. Patching what is being used against people like you, first, is.
Does your prioritization start from CVSS — or from exploitation evidence?