398 CVEs in a Single Tuesday, One Already Being Used Against Defense Firms — Patching Is Now a Prioritisation Problem

Microsoft shipped its August 2026 security updates on Tuesday, and the headline number is the story: 398 new CVEs, 62 of them rated Critical, by the Zero Day Initiative's count reported in The Hacker News. Some tallies run higher once third-party advisories are folded in — SecurityWeek counted 421. Either way, this is a single vendor, on a single day, handing every Windows shop on earth a backlog that no team is going to clear this week.

Exactly one of those 398 is confirmed under active attack. That ratio — one in three hundred and ninety-eight — is the entire vulnerability management problem in miniature.

The one that matters: CVE-2026-68820

CVE-2026-68820 is a use-after-free race condition in afd.sys, the Ancillary Function Driver that underpins the Windows Sockets API in kernel mode. It carries a CVSS base score of 7.0 — unremarkable. It requires an attacker to already have local code execution. It requires winning a race. On a spreadsheet ranked by severity, it sits somewhere in the middle of the pile, well below the CVSS 9.8 entries.

It is also the only flaw in the release Microsoft flagged as exploited in the wild, and Check Point Research attributes that exploitation to North Korea's Lazarus group, running its long-lived Operation Dream Job campaign against defense, aerospace, and aviation targets across Western Europe, India, and Brazil. Check Point reported the bug to Microsoft on July 28 and published on August 11 — the day the patch shipped. Before that, it was a live zero-day for five weeks.

The tradecraft around it is worth reading in full, but two details stand out for defenders:

• The malware negotiated its command channel using a post-quantum key exchange before pulling down the exploit, as Infosecurity Magazine reported. Harvest-now-decrypt-later is usually framed as a defender's problem. Here an attacker used it first, to make captured traffic useless to anyone analysing it afterwards.
• Post-exploitation, Lazarus deployed FudModule v3.1, its kernel rootkit, which disables telemetry callbacks, strips minifilters, kills the NT Kernel Logger, and blinds 94 Event Tracing for Windows providers. In other words: the exploit's job is to get to SYSTEM, and SYSTEM's job is to switch off the sensors your detection stack depends on.

Infrastructure was almost entirely borrowed — compromised Roundcube webmail servers reached via CVE-2025-49113 with credentials likely bought from leak markets, plus hijacked PrestaShop sites. Nothing to seize, nothing to attribute by ownership.

CVSS said something else entirely

Rank August's release by severity and CVE-2026-68820 does not make the first page. Four unauthenticated RCEs share a CVSS of 9.8:

CVE	Component	Note
CVE-2026-62878	Windows DNS Server	Stack-based buffer overflow; ZDI describes it as potentially wormable
CVE-2026-62893	Windows Deployment Services	TFTP handling
CVE-2026-62815	Microsoft QUIC	Transport protocol flaw
CVE-2026-59124	HPC Pack	Non-default install, so rated Important

The DNS Server bug genuinely deserves urgency — remote, unauthenticated, no user interaction, on a service that is frequently internet-facing and that everything else depends on. The release also closes CVE-2026-63520, completing a two-part SharePoint chain that started with July's authentication bypass (CVE-2026-55040); together they gave unauthenticated RCE against on-premises SharePoint farms.

But note what a purely CVSS-driven queue produces: four 9.8s with no confirmed in-the-wild exploitation ranked above the 7.0 that a state-sponsored group has been using against aerospace suppliers for over a month. Severity scores what an attacker could do. It says nothing about what anyone is doing.

The two signals that actually order the queue

There are two public feeds that answer the question CVSS cannot, and they are free:

• CISA's Known Exploited Vulnerabilities catalog — a curated list of CVEs with confirmed exploitation in the wild. Binary, evidence-based, and short enough to act on.
• FIRST.org's EPSS — a probability, refreshed daily, that a given CVE will be exploited in the next 30 days. It resolves the long tail that KEV leaves untouched, and it routinely disagrees with CVSS by an order of magnitude.

Cross-reference August's 398 against those two and the list of things you must ship tonight collapses from hundreds to a handful. That is the difference between a patch program that works and one that generates a burndown chart nobody believes.

The problem is that almost nobody does this cross-referencing continuously. It gets done manually, in a spreadsheet, in the days after Patch Tuesday — and then not again until next month, while KEV additions and EPSS scores keep moving in between. A CVE that was low-probability on the 12th is in KEV on the 20th, and your queue does not know.

Where Obiguard fits: prioritisation, not another scanner

Most teams do not have a discovery problem. They know they are behind. What they lack is a defensible answer to which of these hundreds goes first — and the freshness to keep that answer correct as the threat landscape moves underneath it.

That is the specific job Obiguard SOC does. Every connected repo is scanned for vulnerable dependencies on every push and once a day, so exposure is tracked continuously rather than at monthly intervals. Each finding arrives with an AI explanation, the exact file and line to fix, and — before you upgrade — a compatibility risk report scored 0–100 with the blast radius across every other repo depending on the same package, because the fastest way to stall a patch program is one upgrade that breaks production.

Threat Intelligence then cross-checks every finding against CISA KEV and FIRST.org EPSS on a schedule, so a CVE that is being exploited right now is flagged immediately instead of sitting in a queue of hundreds ranked only by CVSS. That is precisely the sort you would want surfaced first from a release like this one. And because Lazarus's post-exploitation move was to blind ETW and kill telemetry, the other half matters too: logs, metrics, and traces stream in live through a Splunk HEC-compatible forwarder and OpenTelemetry, with alerts arriving as an AI-written incident report and a remediation plan split into now / this week / long-term. No detection rules to author first.

For the AI systems your organization is deploying alongside all of this, the same prioritisation discipline belongs at the policy layer — Governance AI and Obiguard's allow-lists govern which models and tools your agents may reach, so an AI workload does not quietly become the next unpatched, unmonitored surface.

Microsoft will ship another few hundred CVEs on the second Tuesday of September. The number is not going down. The only thing you control is whether your team spends that week guessing at the order. Launch SOC or talk to us about ranking your open CVEs by what is actually being exploited.