Multiple vulnerabilities affecting Microsoft products

Microsoft is a software publisher whose range of products (Windows Server, DNS Server, Windows Deployment Services, Exchange Server, Windows, etc.) is widely deployed in professional environments. As part of its August 2026 Patch Tuesday, Microsoft corrected 421 vulnerabilities, including around sixty classified critical, as well as one (01) actively exploited zero-day vulnerability. These products are affected by several vulnerabilities labeled as follows: CVE-2026-62878 (CVSS 9.8): Remote code execution via the DNS Server role, exploitable without authentication by sending a specially crafted network packet; CVE-2026-62893 (CVSS 9.8): Remote code execution via Windows Deployment Services TFTP server, exploitable without authentication required; CVE-2026-62815 (CVSS 9.8): Remote code execution via Microsoft QUIC implementation; CVE-2026-62817 (CVSS 8.8): Remote code execution via the DNS Server role, exploitable from an adjacent network; CVE-2026-62911 (CVSS 8.0): Privilege escalation via replay authentication bypass (capture-replay) in Microsoft Exchange Server, which could lead to mailbox compromise; CVE-2026-68820 (CVSS 7.0): Privilege escalation via a zero-day use-after-free flaw in the WinSock driver (Ancillary Function Driver), actively exploited in the wild; CVE-2026-50472 (CVSS 7.0): vulnerability affecting the LUAFV component of Windows, exploitable by an authenticated malicious actor and allowing elevated privileges to be obtained. Given the criticality of these vulnerabilities, in particular those affecting the DNS Server role and the actively exploited zero-day flaw, it is strongly recommended to apply the security updates published by Microsoft to all affected products without delay.

• Microsoft products without the 8/11/2026 security update, including Windows Servers running the DNS Server or Windows Deployment Services roles, and Exchange servers;