Cybersecurity Weekly Update: 10–17 August 2026

1. Microsoft Windows Zero-Day Exploited by Lazarus

Microsoft's August security updates addressed a Windows zero-day vulnerability that has been actively exploited by the Lazarus threat group. The vulnerability affects the Windows Ancillary Function Driver for WinSock (AFD.sys) and can allow an attacker with local access to elevate privileges to SYSTEM.

Researchers have linked exploitation of the vulnerability to attacks involving the FudModule kernel rootkit.

CVE ID: CVE-2026-68820 (CVSS Score: 7.0)

Why It Matters: SYSTEM-level access gives an attacker extensive control over a Windows endpoint and can enable credential theft, security-tool interference, persistence and further lateral movement. The activity is particularly relevant to defence and aerospace organisations, which have been identified among the targeted sectors.

Actions: Apply Microsoft's August security updates immediately. Prioritise endpoints that may already be exposed through phishing, stolen credentials or other initial-access techniques. Monitor for suspicious privilege escalation and unexpected kernel-level activity.

Source: Safeguard Research – CVE-2026-68820: A 7.0 That Ends With a Kernel Rootkit and Your EDR Switched Off https://safeguard.sh/resources/blog/cve-2026-68820-afd-sys-lazarus-fudmodule-local-privilege-escalation?utm_source

2. Microsoft SharePoint Exploit Chain Enables Unauthenticated Remote Code Execution

Security researchers disclosed a new Microsoft SharePoint vulnerability that can be chained with a previously disclosed flaw to achieve unauthenticated remote code execution against vulnerable on-premises SharePoint servers.

The research showed that attackers can combine CVE-2026-55040 with CVE-2026-63520 to bypass authentication and execute code on affected SharePoint infrastructure.

CVE ID: CVE-2026-55040 + CVE-2026-63520 (CVSS Score: 8.1 for CVE-2026-63520)

Why It Matters: SharePoint servers frequently contain sensitive corporate documents, credentials and information belonging to employees, customers and business partners. Successful exploitation can provide attackers with a foothold inside an organisation and potentially expose large amounts of sensitive information.

Actions: Organisations running on-premises SharePoint should verify that both vulnerabilities have been patched. Restrict unnecessary external access to SharePoint servers and monitor for suspicious authentication, file access and process execution activity.

Source: Rapid7 – CVE-2026-63520: Microsoft SharePoint Remote Code Execution https://www.rapid7.com/blog/post/etr-cve-2026-63520-microsoft-sharepoint-remote-code-execution-fixed/?utm_source

3. Windows DNS Server Vulnerability Creates Potential Wormable Risk

Microsoft's August Patch Tuesday included several critical vulnerabilities affecting Windows DNS Server. One of the most serious is a stack-based buffer overflow that could allow an unauthenticated attacker to execute arbitrary code remotely.

Because DNS servers are commonly deployed as core infrastructure and may be reachable across large network segments, successful exploitation could have significant consequences.

CVE ID: CVE-2026-62878 (CVSS Score: 9.8)

Why It Matters: DNS infrastructure is fundamental to enterprise networks. Compromise of a DNS server could allow attackers to disrupt network services, execute malicious code or potentially establish a foothold within critical infrastructure.

The vulnerability is particularly important for large financial, healthcare, education and defence environments where DNS infrastructure supports thousands of systems.

Actions: Prioritise patching of Windows DNS Server systems. Ensure DNS infrastructure is not unnecessarily exposed to untrusted networks and monitor for abnormal DNS-server processes, network connections and unexpected administrative activity.

Source: Cisco Talos – Microsoft Patch Tuesday for August 2026 https://zerohunt.ai/blog/windows-dns-server-cve-2026-62878-wormable-rce/

4. ASUS Armoury Crate Vulnerability Allows Local Privilege Escalation

A high-severity vulnerability affecting ASUS Armoury Crate and related ASUS system-management software could allow a local attacker to write specific values to arbitrary memory addresses and potentially escalate privileges.

The vulnerability affects components used by ASUS GPU Tweak III, GPU Tweak II, AI Suite 3 and Armoury Crate.

CVE ID: CVE-2026-8917 (CVSS Score: 8.4)

Why It Matters: Privileged hardware-management utilities operate with elevated permissions and can therefore become attractive targets for attackers who already have a foothold on an endpoint. Exploiting the vulnerability could allow a low-privileged attacker to increase their control over the affected system.

Actions: Update affected ASUS software to the latest available versions. Review enterprise endpoints for ASUS management utilities and remove unnecessary software where appropriate. Monitor for unexpected privilege escalation on affected devices.

Source: PC Gamer – ASUS Armoury Crate vulnerability exposes users to privilege escalation https://www.pcgamer.com/software/security/its-time-to-update-asus-armoury-crate-and-several-other-asus-software-tools-again-as-another-high-severity-security-vulnerability-has-been-discovered/?utm_source

Key Recommendations

• Patch actively exploited vulnerabilities: CVE-2026-68820 should be treated as a high priority because exploitation has been observed in the wild.

• Prioritise internet-facing infrastructure: SharePoint and DNS infrastructure can provide attackers with significant access to enterprise environments when vulnerable.

• Review privileged software: Hardware-management and endpoint utilities such as ASUS Armoury Crate should be included in vulnerability-management programmes.

• Monitor beyond traditional IOCs: Blockchain-based command-and-control demonstrates why behavioural detection and network monitoring remain important alongside IP and domain blocking.

• Strengthen endpoint monitoring: Detect privilege escalation, suspicious process creation and unexpected SYSTEM-level activity, particularly on high-value endpoints.

• Maintain layered controls: Patching, network segmentation, endpoint detection, privileged-access controls and tested incident-response procedures should operate together rather than relying on a single security control.