Microsoft Addresses 398 CVEs with Actively Exploited afd.sys Zero-Day

The release ships four unauthenticated RCEs at CVSS 9.8 affecting Windows DNS Server, Deployment Services TFTP, QUIC implementation, and HPC Pack. CVE-2026-68820 receives priority despite its 7.0 score because Microsoft confirms in-the-wild use; Check Point ties it to Lazarus Operation Dream Job. The update also completes the SharePoint chain started in July with CVE-2026-63520.

Zero Day Initiative independently tallied the same 398 CVEs and 62 Critical ratings. Rapid7 disclosed the SharePoint chain to Microsoft on 18 May after observing the July authentication bypass (CVE-2026-55040) left the RCE half exposed. Microsoft split remediation across cycles, forcing on-premises farms to apply both updates.

Enterprise risk hinges on service inventory rather than CVSS alone. The three wormable-class RCEs require no credentials yet remain unexploited at disclosure; reachability of DNS, WDS, and QUIC endpoints determines actual exposure. Kernel driver flaws like afd.sys recur because they sit at the boundary between user-mode networking and privileged operations.

Organizations should inventory exposed services within 72 hours and apply the zero-day patch first, followed by the unauthenticated RCEs. Expect secondary tooling to appear once the afd.sys fix is reverse-engineered.