Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Swati KhandelwalAug 11, 2026Vulnerability / Windows Security

Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks.

The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first.

The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only one in this month’s release Microsoft flags as under active exploitation. Exploitation depends on triggering a race condition in the driver. Microsoft has not publicly attributed the exploitation. Check Point Research says Lazarus used the zero-day in its Operation Dream Job campaign.

Four other flaws in the release need nothing at all from the victim: no account, no password, no click. They affect Windows DNS Server, Windows Deployment Services, Microsoft’s implementation of the QUIC transport protocol, and High Performance…