Every Patch Tuesday produces a headline bug, and this month it was CVE-2026-68820, a Windows Ancillary Function Driver flaw that Check Point traced back to Lazarus Group activity starting in early June, weeks before Microsoft had a patch to offer. That story deserved the attention it got. It also pulled focus from a second flaw in the same release that has a materially larger blast radius if it starts getting exploited.
A buffer overflow that needs nothing from the attacker
CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server, rated critical with a CVSS score of 9.8. An unauthenticated attacker can trigger it by sending a specially crafted packet to an affected DNS service over the network, no login, no user interaction, no social engineering step required. Zero Day Initiative researchers, who reviewed the full August release, singled it out as the standout of the batch precisely because DNS is a foundational service on every Windows Server domain environment. That means the attack surface is not a narrow edge case. It is reachable from an external position if the DNS server is internet-facing, and from an internal position on essentially any compromised foothold inside a Windows domain network.
Microsoft has not confirmed exploitation in the wild as of the patch’s release on August 11. That is meaningfully different from saying it is safe to wait. A wormable, unauthenticated, network-reachable buffer overflow in a service that sits at the centre of Active Directory infrastructure is the exact profile that historically moves from “patched but unexploited” to “mass exploitation campaign” in a matter of weeks once researchers or attackers reverse-engineer the fix.
Why DNS Server deserves the top of this month’s list
Most organisations triage 421 CVEs by CVSS score and public exploitation status, which is a reasonable default and exactly why CVE-2026-68820 got the headlines this month; it already had a confirmed nation-state actor behind it. But CVSS score without confirmed exploitation is not the same as low priority, and DNS Server sits in a different category of risk than most of the other 419 bugs in this release. It is not an endpoint application or a peripheral service. It is infrastructure that every domain-joined machine depends on to resolve names, and a working exploit against it gives an attacker a foothold with implications for everything else on the network.
Internet-facing Windows DNS Server instances, which are less common than internal-only deployments but not rare, should be treated as the priority this week regardless of what else is on the patch queue. Internal DNS servers are lower urgency only in the sense that they require a foothold first, not in the sense that they are safe to leave for next month’s maintenance window.
If your organisation needs help triaging this month’s Patch Tuesday release against your actual Windows Server estate, or a broader vulnerability management process that catches the DNS-level risks before they become the headline, contact Excello Digital. We help European businesses turn a 421-item patch list into a prioritised plan that gets the infrastructure-critical fixes done first.