CVE-2026-62878 is a 9.8-severity, zero-click hole in Windows DNS Server. Microsoft rates it 'exploitation less likely.' The researchers who track these for a living aren't so sure.
Microsoft's August Patch Tuesday shipped 398 fixes, and the one getting the most attention is a Windows kernel driver bug already being exploited by North Korea's Lazarus group. It's not the most dangerous bug in that batch. That title belongs to CVE-2026-62878, a 9.8-out-of-10-severity remote code execution flaw in Windows DNS Server that needs no password, no click, and no user anywhere near the machine — just a single crafted network packet aimed at a server most organizations never think about until it stops working.
Microsoft's own advisory rates exploitation of CVE-2026-62878 as 'less likely.' Trend Micro's Zero Day Initiative, which has tracked Microsoft's exploitability predictions against what actually happens for years, published its Patch Tuesday review with a pointed dissent: this is, in ZDI's words, 'a good ol' fashioned stack-based buffer overflow that ends up wormable,' with advice to patch internet-facing DNS servers fast regardless of what the severity label says.
The bug, in plain English
A stack-based buffer overflow means the DNS Server process allocates a fixed-size chunk of memory to hold incoming data, and a malformed packet can write past the end of that chunk — overwriting adjacent memory with attacker-controlled bytes. Done right, that overwrite doesn't just crash the service; it hijacks execution and runs whatever code the attacker packed into the overflow, with the same privileges as the DNS Server process itself. No login. No user has to open anything. The packet does all the work — exactly the profile that let worms like Conficker and WannaCry spread machine to machine in the past, with nobody at a keyboard involved anywhere in the chain.
August's three most-watched CVEs
CVE-2026-62878
CVE
9.8
CVSS
Windows DNS Server RCE, stack overflow
Type
Unpatched systems exposed; MS rates "less likely," ZDI disagrees
CVE-2026-62893
CVE
9.8
CVSS
Windows Deployment Services (TFTP) RCE, use-after-free
Type
MS rates exploitation "more likely"
CVE-2026-68820
CVE
7.0
CVSS
Windows afd.sys elevation of privilege
Type
Confirmed exploited in the wild by Lazarus
CVE
CVSS
Type
Status
CVE-2026-62878
9.8
Windows DNS Server RCE, stack overflow
Unpatched systems exposed; MS rates "less likely," ZDI disagrees
CVE-2026-62893
9.8
Windows Deployment Services (TFTP) RCE, use-after-free
MS rates exploitation "more likely"
CVE-2026-68820
7.0
Windows afd.sys elevation of privilege
Confirmed exploited in the wild by Lazarus
Windows DNS Server typically runs on Active Directory domain controllers — exactly the systems this bug targets. · Unsplash
Microsoft says 'less likely.' Here's why I wouldn't bet on that.
Microsoft's exploitability index is a genuinely useful tool most months — it's built from real signal about exploit complexity and what researchers are seeing in underground markets. But it's a prediction, not a guarantee, and it's been wrong before on exactly this class of bug: a remotely reachable, unauthenticated, memory-corruption flaw in a service that's hard to take offline for testing and, once patched, gets reverse-engineered from the patch diff within days by anyone motivated to build a working exploit. That's the same gap CVE-2026-68820 exploited — a bug that started as a disclosed vulnerability and ended up an active Lazarus tool within months, the same month ShieldBreak showed Microsoft's own patches don't always hold on the first try, either.
A good ol' fashioned stack-based buffer overflow that ends up wormable.
Trend Micro Zero Day Initiative, August 2026 Patch Tuesday review
Are you actually exposed?
1
Check whether any server has the DNS Server role installed — run Get-WindowsFeature DNS on Windows Server to confirm.
Prioritize Active Directory domain controllers first — DNS is commonly co-installed there, and a compromised DC is a compromised domain.
3
Apply the August 11, 2026 cumulative update immediately on anything internet-facing or perimeter-adjacent.
If you can't patch immediately, restrict inbound access to DNS servers to known, trusted IP ranges as a stopgap — not a substitute for patching.
Has CVE-2026-62878 been exploited in the wild?
Not as of this writing. Microsoft rates exploitation 'less likely,' though Trend Micro's Zero Day Initiative publicly disputes that assessment and calls the bug wormable.
What makes a bug 'wormable'?
A vulnerability that malware can trigger against another vulnerable machine automatically, without any user action — the same property that let WannaCry and NotPetya spread server to server in 2017.
Do I need to patch CVE-2026-62893 too?
Yes. It's a separate critical (CVSS 9.8) bug in Windows Deployment Services patched the same day, and Microsoft rates exploitation of it 'more likely' than CVE-2026-62878.
Which Patch Tuesday bug is actually being exploited right now?
CVE-2026-68820, a privilege escalation flaw in the Windows afd.sys driver, linked by Check Point Research to North Korea's Lazarus group and its Operation Dream Job campaign.
398 patches is a lot to prioritize in one night, and it's tempting to default to whatever Microsoft's own severity label tells you to fix first. This month, I'd override it: patch the DNS bug ahead of the confirmed zero-day, because unauthenticated and wormable beats actively exploited but access-gated when you're deciding what gets tested and deployed tonight versus next week. Do both. Just don't do the second one first.
