Microsoft August Patch Tuesday: 398 Fixes, Windows Driver LPE Zero-Day Exploited

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Act: CVE-2026-68820 is CISA KEV-listed with a public GitHub PoC and confirmed active exploitation — apply August 2026 Patch Tuesday updates immediately, prioritizing this kernel driver fix to close the SYSTEM-level LPE path.
SOC/IR — Act: Active in-the-wild exploitation of a SYSTEM-level LPE means attackers may already have escalated on unpatched endpoints — hunt for anomalous SYSTEM-privilege process spawns from unexpected parent processes and tune EDR alerts for T1068 kernel-driver abuse since the public PoC widens attacker access.
Leader — Plan: A 398-patch batch with one actively exploited zero-day may strain standard patch SLAs — confirm your teams have triaged CVE-2026-68820 as this week’s priority and verify compliance with your critical-patch SLA before the next board or audit checkpoint.
Signals: CVE-2026-68820 — CISA KEV: listed, EPSS n/a, public PoC on GitHub

Windows-Lpe on CuraSec