Microsoft patches actively exploited Windows flaw

CERT-FR flags a massive Microsoft Windows patch batch including CVE-2026-68820, which Microsoft confirms is being actively exploited in the wild.

CERT-FR's advisory catalogs an unusually large batch of Microsoft Windows vulnerabilities patched in the August 2026 update cycle, spanning nearly every supported Windows client and server version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The flaws collectively enable remote code execution, privilege escalation, remote denial of service, data integrity/confidentiality compromise, and security policy bypass, indicating the update addresses a broad cross-section of Windows kernel, service, and component-level bugs rather than a single flaw class.

Of particular note, Microsoft has confirmed that CVE-2026-68820 is being actively exploited in the wild, elevating the urgency of patch deployment for this specific CVE even though the full CVE list runs into the hundreds. No further technical detail on the exploitation vector, targeted sector, or associated threat actor/malware was provided by Microsoft or CERT-FR in this bulletin. Organizations running any of the listed Windows versions should prioritize testing and deploying the August 2026 cumulative updates, with particular urgency for systems that cannot be patched immediately given the confirmed in-the-wild exploitation of CVE-2026-68820.

Given the breadth of affected products (essentially all current Windows client and server releases) and the confirmed active exploitation of at least one RCE/privilege-escalation-capable flaw, this advisory represents a high-priority patching event, though it lacks the campaign-level detail (actor, malware, victims) needed to elevate it to critical.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1001