Microsoft patches actively exploited Windows flaw
CERT-FR flags a massive Microsoft Windows patch batch including CVE-2026-68820, which Microsoft confirms is being actively exploited in the wild.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-68820 as exploited in the wild.
CERT-FR's advisory catalogs an unusually large batch of Microsoft Windows vulnerabilities patched in the August 2026 update cycle, spanning nearly every supported Windows client and server version from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The flaws collectively enable remote code execution, privilege escalation, remote denial of service, data integrity/confidentiality compromise, and security policy bypass, indicating the update addresses a broad cross-section of Windows kernel, service, and component-level bugs rather than a single flaw class.
Of particular note, Microsoft has confirmed that CVE-2026-68820 is being actively exploited in the wild, elevating the urgency of patch deployment for this specific CVE even though the full CVE list runs into the hundreds. No further technical detail on the exploitation vector, targeted sector, or associated threat actor/malware was provided by Microsoft or CERT-FR in this bulletin. Organizations running any of the listed Windows versions should prioritize testing and deploying the August 2026 cumulative updates, with particular urgency for systems that cannot be patched immediately given the confirmed in-the-wild exploitation of CVE-2026-68820.
Given the breadth of affected products (essentially all current Windows client and server releases) and the confirmed active exploitation of at least one RCE/privilege-escalation-capable flaw, this advisory represents a high-priority patching event, though it lacks the campaign-level detail (actor, malware, victims) needed to elevate it to critical.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1001
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs