CyberSip™ — Issue 106 — August 12, 2026

Today's picture

Microsoft's August 2026 Patch Tuesday closed roughly 400 vulnerabilities including CVE-2026-68820, a use-after-free in the WinSock kernel driver that Lazarus Group had already exploited as a zero-day to deploy the FudModule kernel-mode rootkit, a wormable unauthenticated remote code execution flaw in Microsoft QUIC requiring no user interaction, and four additional unauthenticated server remote code execution bugs. The same release patches CVE-2026-62832, the Windows User Profile Service elevation-of-privilege flaw this brief has tracked without a fix since Issue 88, on its 24th day in Still Watching. SAP's August 2026 Security Patch Day addresses 28 new and two updated notes including four critical-severity bugs in SAP NetWeaver, SAP Business Intelligence Platform, and SAP Commerce Cloud, products running financial, HR, and procurement workflows across large enterprises worldwide.

Today's intelligence

3 items

01 HighPatch TuesdayLazarus Group

Lazarus Group exploited the WinSock kernel driver as a zero-day to deploy the FudModule rootkit before August Patch Tuesday closed it

CVE-2026-68820 is a use-after-free in afd.sys, the kernel driver underpinning every Windows network socket. Lazarus used it to reach SYSTEM and install a new FudModule variant before the patch existed. The release also includes a wormable unauthenticated RCE in QUIC and four unauthenticated server RCEs. Patch the exploited driver first, then queue the wormable bug immediately behind it.

Lead CVECVE-2026-68820
CVSS 7.0
EoP, exploited

ActorLazarus Group
(North Korea)
FudModule rootkit

Wormable RCECVE-2026-62815
Microsoft QUIC
No auth, no click

Server RCEsCVE-2026-62878
Windows DNS
+ 3 others

Total patched~400 CVEs
42–62 critical

Sources The Hacker News Help Net Security

What happened

Microsoft released its August 2026 Patch Tuesday on August 12, addressing roughly 400 CVEs across Windows, Office, Exchange Server, SharePoint, Azure, and GitHub Copilot components. The only flaw Microsoft flagged as under active exploitation at patch time is CVE-2026-68820, a use-after-free vulnerability in the Ancillary Function Driver for WinSock, the kernel-mode component that underlies the Windows Sockets API on every Windows endpoint. Check Point Research attributed exploitation to Lazarus Group, North Korea's primary offensive cyber unit, which used CVE-2026-68820 as a zero-day to deploy a new variant of FudModule, its kernel-mode rootkit that specifically targets Windows security products to disable their monitoring capabilities from kernel level. A locally authenticated, low-privileged attacker triggers the race condition in afd.sys by running a crafted application. No user interaction is required beyond the attacker already having code running on the machine. The CVSS score of 7.0 understates the operational impact: the flaw converts any low-privileged foothold into SYSTEM access and then enables FudModule to blind security tooling at the kernel level before further activity. The release includes three additional notable flaws. CVE-2026-62815 is a remote code execution vulnerability in Microsoft QUIC, the QUIC protocol implementation used by Windows for high-performance network communication. An unauthenticated attacker sends a specially crafted packet to an affected service over the network. No authentication and no user interaction is required. Successful exploitation results in code execution on the target. Security Affairs described this as wormable in character. CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server reachable remotely with no authentication and no user interaction. Two additional unauthenticated server-side RCEs round out the urgent queue. CVE-2026-62832, the Windows User Profile Service elevation-of-privilege flaw this brief has tracked since Issue 88 as LegacyHive, is also closed in this release. Microsoft publicly disclosed it before patch availability and noted exploitation is more likely. Three prior disclosures in the same Nightmare Eclipse series were exploited before patches arrived. This one held for 24 days.

Why it matters

The FudModule rootkit detail changes the operational meaning of CVE-2026-68820. A privilege escalation flaw that converts a low-privileged account to SYSTEM is already significant. A privilege escalation flaw that Lazarus Group uses specifically to deploy a kernel-mode rootkit designed to disable Windows security product monitoring is a different category of threat. FudModule does not persist as a standard malware artifact that antivirus and EDR tools detect. It operates at the kernel level and specifically targets the kernel callbacks through which security products receive event notifications. An endpoint where FudModule has been deployed may have had its security tooling blinded before any follow-on activity occurs, meaning the absence of alerts is not evidence of absence of activity. The QUIC wormable RCE is the second urgency: QUIC is broadly enabled in modern Windows environments, and a wormable unauthenticated RCE on a protocol that commonly traverses internal network segments without explicit firewall rules is the kind of flaw that can propagate laterally without requiring a phishing email or user interaction to spread.

Don't miss

Check Point noted that Lazarus Group's exploitation of CVE-2026-68820 is part of Operation Dream Job, the long-running North Korean campaign that uses fake job offers to deliver initial access malware. The WinSock driver flaw was used after initial access was established, not as the initial entry point. That means organizations in aerospace, defense, and technology sectors where Operation Dream Job has historically focused should review both their patch status for CVE-2026-68820 and their detection coverage for FudModule artifacts. Check Point published indicators of compromise alongside its analysis. The LegacyHive closure is also worth noting separately: CVE-2026-62832 has a functional proof-of-concept exploit that has been public for 24 days. The patch is available now, but any endpoint where a threat actor has already leveraged the flaw during that 24-day window will not be cleaned by patching. Investigate before concluding the patch resolves the exposure.

Potential actions

Deploy the August Patch Tuesday update to all Windows endpoints, prioritizing CVE-2026-68820 first given confirmed exploitation. For organizations in Lazarus Group target sectors, check the Check Point indicators of compromise for FudModule artifacts before concluding that patching alone closes the exposure.
Address CVE-2026-62815 in Microsoft QUIC immediately after CVE-2026-68820. A wormable unauthenticated RCE on a broadly enabled network protocol with no authentication requirement warrants emergency treatment regardless of the absence of confirmed exploitation in the wild at patch time.
Patch CVE-2026-62832 and then investigate any Windows endpoints where low-privileged accounts may have had unusual activity over the past 24 days. The flaw has had a public proof-of-concept exploit for 24 days. The patch closes it but does not remediate any access that was already established using it.

The Sip

Lazarus used the WinSock driver to reach SYSTEM, then deployed a rootkit that blinds security tools at the kernel level. The patch closes the entry. It does not remove the rootkit already installed. Check Point published the indicators. Run them before deciding the patch is sufficient.

02 HighSAPAugust Patch Day

SAP's August patch day closes four critical bugs in NetWeaver, Business Intelligence Platform, and Commerce Cloud used across enterprise financial and HR systems

SAP released 28 new security notes and two updates covering products that process payroll, financial close, procurement, and customer data at large enterprises. Critical-severity notes in August SAP releases have historically been exploited by ransomware groups and state actors within weeks of publication. SAP environments that lag on patching are a documented initial access target.

Notes28 new, 2 updated
4 critical severity

Critical productsSAP NetWeaver
SAP BI Platform
SAP Commerce Cloud

Release dateAugust 12, 2026
(second Tuesday)

Prior patternSAP CVEs exploited
within weeks of
disclosure historically

Sources SecurityWeek SAP Security Notes

What happened

SAP released its August 2026 Security Patch Day on August 12, 2026, the same day as Microsoft's Patch Tuesday. The release covers 28 new security notes and two updates to previously published notes. Four notes carry critical severity ratings. The critical-rated vulnerabilities affect SAP NetWeaver, the integration and application platform underpinning most SAP enterprise deployments; SAP Business Intelligence Platform, used for enterprise analytics and reporting on financial, operational, and HR data; and SAP Commerce Cloud, SAP's e-commerce and order management platform. SAP has not disclosed the full technical detail of the critical notes until customers have had time to apply patches, which is the company's standard disclosure practice. The products affected in August are broadly deployed: NetWeaver in particular is foundational to SAP ERP, S/4HANA, and the application integration layer used by large enterprises for payroll, general ledger, procurement, and supply chain functions. Business Intelligence Platform is the analytics layer that connects to those systems and is frequently used for financial reporting. The broader August release also addresses remote code execution, server-side request forgery, XML external entity injection, and authorization bypass vulnerabilities across additional SAP products.

Why it matters

SAP NetWeaver is among the most documented enterprise application exploitation targets for both nation-state and ransomware actors. CVE-2025-31324, a critical NetWeaver vulnerability from April 2025, was added to CISA KEV and exploited by Chinese state-linked actors within days of publication. Multiple SAP NetWeaver critical vulnerabilities between 2023 and 2025 were used in ransomware campaigns specifically targeting the SAP layer because access to NetWeaver gives attackers reach into the financial and HR systems running on top of it. The August release's critical notes in NetWeaver carry this prior exploitation history as context. Any organization running SAP should treat SAP Security Patch Day with the same priority discipline applied to Microsoft Patch Tuesday. SAP environments frequently lag on patching due to complex change management requirements around ERP systems, which is precisely why they are a documented target: attackers have learned that the window between SAP patch publication and enterprise adoption is measurably longer than for operating system patches.

Don't miss

August SAP patch days coincide with Patch Tuesday by convention, which means security teams are processing two major enterprise patch releases simultaneously. The operational temptation is to handle the Microsoft release first because it affects more endpoints and carries the confirmed exploitation of CVE-2026-68820. SAP patches warrant parallel attention rather than sequential processing. NetWeaver is an internet-facing component in many large enterprise configurations, and a critical SAP NetWeaver vulnerability with no remediation is a more attractive initial access target for a financially motivated actor than a Windows privilege escalation that still requires code running on the machine. SAP's Support Portal provides the specific patch instructions for each security note. Customers can access the notes through the SAP Support Portal security notes section.

Potential actions

Access SAP's August 2026 Security Patch Day notes through the SAP Support Portal and apply the four critical-rated notes to NetWeaver, Business Intelligence Platform, and Commerce Cloud deployments. SAP patches require coordination with the application team, not just the OS patching team, because ERP system updates often involve configuration and testing steps beyond binary deployment.
Prioritize internet-facing SAP NetWeaver components in the patching sequence. Web Dispatcher, ICM, and other externally accessible NetWeaver interfaces are the documented exploitation entry points for prior critical NetWeaver CVEs and should receive the critical-note patches first within the SAP environment.

The Sip

Four critical SAP bugs in the system running payroll and financial close, on the same day as Patch Tuesday. SAP patches take longer to apply in large enterprises, which is exactly why SAP is a documented initial access target. Do not let the Microsoft release push the SAP notes to next week.

03 HighZapscapeLinux KVM

Zapscape gives a guest with kernel privileges inside an L1 virtual machine a path to execute code on the underlying host when nested virtualization is enabled

CVE-2026-64561 is a KVM shadow MMU flaw. An attacker who already controls a virtual machine at kernel level can corrupt host memory and escape the VM boundary. The precondition is meaningful but it is commonly met in cloud provider infrastructure, research environments, and any platform that exposes nested virtualization to tenants.

CVECVE-2026-64561
Zapscape

ComponentLinux KVM x86
Shadow MMU

RequiresKernel privileges
inside L1 guest
Nested virt enabled

ExploitationNot confirmed
in wild

Upstream fixAvailable in kernel
stable branches

Sources The Hacker News SecurityWeek

What happened

CVE-2026-64561, named Zapscape by its discoverers, is a vulnerability in the KVM hypervisor's shadow memory management unit implementation for x86 systems in the Linux kernel. KVM is the kernel-based hypervisor that underlies most Linux virtualization, including many cloud provider infrastructure stacks. When nested virtualization is enabled, a virtual machine running inside another virtual machine, known as an L1 guest, can itself act as a hypervisor for a nested L2 guest. The shadow MMU is the component that manages the page tables used by the L1 hypervisor when operating in this nested configuration. Zapscape exploits a flaw in how the shadow MMU handles a specific sequence of memory management operations when an L1 guest with kernel-level privileges manipulates the nested page tables. The attacker can craft those operations to corrupt host memory outside the guest boundary and ultimately execute code in the host context. No exploitation in the wild has been confirmed. The precondition of kernel privileges inside the L1 guest is the primary constraint: the attacker must already control the L1 virtual machine at kernel level before the escape path is reachable. The upstream kernel fix is available in stable kernel branches. Distribution-level patches are rolling out through vendor security channels on varying timelines depending on distribution release track.

Why it matters

The precondition for Zapscape sounds restrictive: an attacker must have kernel privileges inside an L1 virtual machine. In practice that precondition is met in several common environments. Cloud providers that expose nested virtualization to tenants for development or testing purposes give those tenants an L1 guest in which kernel-level access is expected and normal. Security research environments that run hypervisors inside virtual machines for malware analysis or sandbox testing operate the same configuration. Any deployment where a virtual machine is itself running other virtual machines with nested virtualization enabled is in scope. In those environments, Zapscape converts tenant-level or research-environment access into host-level code execution, which in a cloud context means code execution on the underlying physical host that may be running workloads for other tenants.

Don't miss

Zapscape follows two other Linux kernel virtualization escape vulnerabilities this brief has covered in the past three months. OVSwrap CVE-2026-64531 from Issue 102 was a Linux kernel integer wraparound in the Open vSwitch datapath. Zapscape operates at a different layer, the KVM shadow MMU rather than the network datapath, but the pattern is the same: a Linux kernel component involved in isolation between computing contexts contains a memory safety flaw that can be used to cross that isolation boundary. Organizations running KVM-based virtualization in environments where nested virtualization is enabled should treat the upstream patch availability as the trigger for an expedited kernel update cycle, not a scheduled maintenance event. If nested virtualization is not required in an environment, disabling it eliminates the attack surface for Zapscape entirely.

Potential actions

Apply the updated kernel containing the Zapscape fix from your distribution vendor once it is available. Check your vendor's security tracker for CVE-2026-64561 specifically. Distribution patch timelines vary: RHEL, Debian, and Ubuntu each have separate release schedules for kernel updates.
If nested virtualization is not required in a given environment, disable it at the hypervisor configuration level. On KVM this is controlled through the nested kernel module parameter. Disabling nested virtualization removes the precondition for Zapscape and eliminates this specific attack surface without requiring a kernel update.
For cloud provider environments where tenants are given L1 guests with nested virtualization enabled, assess whether exposure to CVE-2026-64561 changes the risk calculation for that configuration and whether restricting nested virtualization access to verified use cases is appropriate while distribution patches are pending.

The Sip

Kernel control inside a virtual machine becomes code execution on the host when nested virtualization is on. No confirmed exploitation yet. If the environment does not need nested virtualization, turn it off and the flaw does not apply. If it does, patch the kernel when the distribution ships the fix.

Cross-source standouts

LegacyHive patched on Day 24: what 24 days without a fix for a publicly known Windows privilege escalation actually means

This brief added CVE-2026-62832, the Windows User Profile Service elevation-of-privilege flaw, to Still Watching in Issue 88 as LegacyHive, part of the Nightmare Eclipse series. At the time of first coverage, it had a working proof-of-concept exploit on fully patched systems. It sat in Still Watching for 24 days without a patch. During those 24 days, any attacker with a low-privileged foothold on a Windows machine could use the public proof-of-concept to reach administrator privileges. Microsoft's advisory released today notes that exploitation is more likely, which is the company's language for a vulnerability with a known and functional exploit path. Three prior flaws in the same Nightmare Eclipse series were exploited before their patches arrived. CVE-2026-62832 patching today closes the vulnerability. It does not tell organizations whether anyone used it against them during the 24 days it was open. The operational task after patching LegacyHive is to hunt for privilege escalation activity on Windows endpoints between July 19 and today, using the indicators from the User Profile Service exploit chain, before concluding that the patch closes all risk from this flaw.

Patch Tuesday, SAP Patch Day, and the enterprise patching capacity problem

Both Microsoft and SAP release their monthly security updates on the second Tuesday of each month by convention. That means every enterprise with both Microsoft and SAP infrastructure faces two simultaneous major patch releases requiring different teams, different change management processes, and different testing cycles. Today's Microsoft release includes an actively exploited kernel driver zero-day used by a nation-state actor, a wormable unauthenticated RCE, four additional server RCEs, and the long-awaited patch for a 24-day Windows privilege escalation. Today's SAP release includes four critical notes across NetWeaver, Business Intelligence Platform, and Commerce Cloud. None of this can wait until next week. The security teams responsible for triaging and deploying these updates are the same teams that processed the Metabase zero-day yesterday, the WebMail injection chains from Black Hat, and the August Patch Tuesday for every other vendor shipping updates today. The volume problem is structural. August 2026 Patch Tuesday's roughly 400 CVEs represents a moderate release for 2026, which has established a new baseline significantly above historical averages. Enterprise security teams are being asked to process more vulnerability disclosures, in parallel, across more systems, on tighter timelines, than at any prior point in the discipline's history. Triage discipline, specifically prioritizing by exploitation status and internet exposure rather than by CVSS score, is the only tool available for managing that volume without either missing the critical items or freezing on the volume itself.

Still watching

Days 2–5

Metabase GHSA-vwf4-m7j8-wcjf (Issue 105 · CVSS 10.0 zero-day, exploited August 3) — patch self-hosted instances immediately. Rotate database credentials for every connected source. Add GHSA-vwf4-m7j8-wcjf to tracking tools manually; CVE-based scanners will not surface this flaw. Downstream victims n8n, Framework, and Tally confirmed.

Day 2

Progress LoadMaster CVE-2026-8037 (Issue 104 · CISA KEV, deadline passed August 10) — update to GA 7.2.63.2 or LTSF 7.2.54.18. Follow CISA forensics triage guidance. Review /accessv2 logs from June 29. Six weeks of active exploitation confirmed across 65 IP addresses.

Day 3

WEL1DROPPER npm campaign (Issue 104 · ~800 packages, August 6 to 7) — audit lockfiles and build caches against Manifold's package list. Hunt DNS logs for TXT queries to wel1.ru subdomains. Removing the package starts the investigation; it does not end it.

Day 4

Atlassian Rovo content-borne prompt injection (Issue 104 · PromptArmor, reported May 2026) — URL parameter path patched July 8. Content-borne path status unconfirmed as of August 12. Scope Rovo access tightly and audit Rovo Connector connections to external platforms until Atlassian confirms both paths are closed.

Day 5