August 2026 Patch Tuesday: What NC SMBs Should Patch First

On August 11, 2026, Microsoft shipped fixes for roughly 400 vulnerabilities, 42 of them rated critical, including three zero-days. [1][2] Every trade outlet led with the same one: an actively exploited hole in a low-level Windows driver that North Korea's Lazarus group used to install a rootkit. Here is the part those headlines skip. For most North Carolina businesses, that bug is the one you are least likely to be hit by, and two quieter critical flaws in the same release are the reason some of your servers should be patched this week rather than next month. The exception is defense, aerospace, and aviation suppliers, who are directly in Lazarus's sights and should treat the exploited zero-day as a first-order risk regardless of what their servers run.

This is a triage guide, not a catalog. You are never going to review 400 security bulletins, and you should not try. You need a rule for which machines to patch first, and a reason to trust it. And if you cannot personally say whether your server runs the services named below, that is exactly the point: checking that is a job for whoever handles your IT, and if that is nobody, it is work we can scope and take on. How long it runs depends on how many servers you have and your maintenance windows, which a quick inventory settles.

Not sure whether your servers are exposed to the critical ones this month? Ask Preferred Data Corporation for a patch exposure check. High Point based since 1987, on-site within 200 miles. Call (336) 886-3282.

Which August 2026 patch is actually being exploited?

One, and only one: CVE-2026-68820, a flaw in a core Windows networking driver (afd.sys, the piece that handles network sockets) that lets an attacker who already has code running on a machine take full administrator-level control, what Windows calls SYSTEM. [1] Its severity score is 7.0 out of 10, which Microsoft rates only Important, not Critical, because it cannot be fired at you across the internet. The attacker needs a foothold on the box first.

It made every front page because of who was using it. Check Point Research reported the flaw to Microsoft on July 28, 2026, after catching Lazarus exploiting it in the wild to deploy a new version of its FudModule kernel rootkit. [3] That campaign, tracked as Operation Dream Job, lures engineers at defense, aerospace, and aviation firms with fake recruiter offers. CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog on August 11, the federal list of bugs confirmed to be under active attack. [4]

Two more zero-days shipped as publicly disclosed but not yet exploited: CVE-2026-62832 in the Windows User Profile Service (severity 7.8) is an elevation bug, and CVE-2026-72971 in the Windows Container Isolation driver (severity 5.5) is a tampering bug, meaning it lets an attacker alter protected data. [1] Both still need a local foothold to matter.

Key takeaway: An elevation bug is a second-stage weapon. It matters enormously once an attacker is already inside, which is why it stays on your list, but it cannot get anyone in on its own. It is the second move, not the first.

So what does let a stranger in without a key?

Two critical flaws in Windows Server roles that a lot of small businesses run without thinking about them. CVE-2026-62893 lives in Windows Deployment Services, the tool IT uses to image and set up new PCs, and scores 9.8 out of 10, about as high as the scale goes. CVE-2026-62823 lives in the DHCP server, the service that hands every device in your building its network address, and scores 8.8. [1] Both let an unauthenticated attacker on your network send a crafted packet and run their own code on the server. No password, no user clicking anything, no prior foothold.

That distinction is what decides which servers get patched this week. If you run a Windows Server as your domain controller, you are very likely running DHCP and DNS (the service that turns names into addresses) on that same box, and if your team images machines in-house, Deployment Services may be there too. A bug an attacker can reach from your network without logging in, on a server that hands out every IP address in the building, is a categorically different risk from an elevation bug that needs a foothold first. One correction, because some early coverage blurred it: none of this month's flaws are self-propagating or wormable. [2] Nothing here jumps machine to machine on its own overnight. The danger is that these servers are reachable and unauthenticated, not that a patch delay lets an infection spread by itself.

How do I actually deploy this without cherry-picking CVEs?

You do not deploy individual CVE fixes, and this trips up a lot of small businesses. For supported Windows and Windows Server, these OS fixes ship inside a single cumulative update each month, one rollup per operating system. You cannot install the DHCP fix while holding back the rest. Installing this month's cumulative update on a server brings the Deployment Services, DHCP, DNS, and afd.sys fixes together, which on an exposed server is exactly what you want. So the real question is not which CVEs to pick. It is which machines get the August cumulative update first.

Here is the operator judgment. The morning after Patch Tuesday, Preferred Data does not sort 400 bulletins by severity. We sort the fleet by two questions: which machines are reachable from the network without a password, and which run a role that is exposed. The answer sets the rollout order for the same cumulative update everyone eventually installs.

Severity alone would have you starting at the top of a CVSS-sorted list and burying the DHCP server, which every device in your Winston-Salem office depends on, underneath dozens of louder-sounding bugs. Exposure-first ordering puts the update where it stops an unauthenticated attacker first, then rolls the same fix to the rest of the fleet before it settles into normal cadence.

Want that rollout order set against your actual servers instead of a generic list? Explore Preferred Data managed IT services or call (336) 886-3282.

Why does the exploited elevation bug still deserve the fast ring if it needs a foothold?

Because of what this specific one delivers once it lands. The FudModule rootkit that Lazarus paired with CVE-2026-68820 is built to blind your security tools: Check Point reports the new version removes the callbacks Windows uses to flag suspicious driver behavior, disables security filters, kills the kernel event logger, and jams more than 90 of the tracing channels that endpoint tools listen to. [3] Once it is running at the kernel level, it can degrade even good tools, and your sensors may report a quiet network that is not quiet.

That is the honest case for endpoint detection and response, EDR, as defense-in-depth rather than a guarantee. Plain signature antivirus can easily miss a kernel rootkit once it has disabled the sensors those tools rely on, though a known sample might still be caught before the driver loads or by an offline scan. EDR with tamper protection will not reliably survive kernel manipulation either, but it raises the cost of the earlier steps and gives you a real chance to catch the intrusion before the rootkit is installed, at the initial access or the privilege-escalation stage. Patch the elevation path fast so that stage never succeeds, and run detection that might flag it if it does. Preferred Data builds managed detection and cybersecurity around that layered assumption for businesses across the Piedmont Triad.

Key takeaway: Patch the exposed servers so nobody walks in for free, patch the exploited elevation bug fast so a foothold cannot quietly become full control, and run EDR that improves your odds of catching the earlier stages. No one of the three is enough on its own.

What should a 20 to 250 person NC business do this week?

Confirm what you expose, roll the August cumulative update by exposure, and stop hand-managing the rest.

1. Inventory your Windows Servers and their roles. Know which boxes run DHCP, DNS, and Deployment Services, and whether any of them are reachable from outside a trusted segment.
2. Push the August cumulative update to any server running DHCP or Deployment Services within 48 hours, after a quick pilot on one server of each Windows Server version you run. Those roles carry the unauthenticated RCE fixes, and each OS version gets its own cumulative package, so pilot each one.
3. Roll the same cumulative update to the rest of the fleet over the next several days on an accelerated ring, because every machine carries the exploited afd.sys fix. If you are a defense, aerospace, or aviation supplier, move your workstations into the 48-hour lane instead, since those are the Operation Dream Job target for this zero-day.
4. Confirm behavior-based security with tamper protection is live on all endpoints, and treat it as one layer, not a guarantee against a kernel rootkit.
5. Keep non-Windows updates on their own tested cycle, with the same exception that governs everything else: if a third-party product (a firewall, a browser, a self-hosted app) is actively exploited or lands on CISA's KEV list, it jumps to the 48-hour lane no matter who makes it. This same week, for example, CISA added actively-exploited non-Microsoft products to that list, so "Microsoft's Patch Tuesday" is not the whole job.

Preferred Data has served North Carolina businesses since 1987. Cumulative updates do sometimes break line-of-business software, an ERP that will not launch after a framework rollup or a driver that fails on a print fix, which is exactly why a staged ring exists: its whole purpose is to catch an update that breaks a representative application stack before it reaches your users.

So here is Monday: pull up your server list, find any box running DHCP or Windows Deployment Services, and confirm the August cumulative update is on it before you do anything else. If you cannot tell whether it is, that uncertainty is the real problem, and it is the one we fix first.

Want your August patch exposure confirmed and a rollout you do not have to babysit? Schedule a patch and vulnerability review or call (336) 886-3282.

Straight answers on the August 2026 patches

How many vulnerabilities did Microsoft fix in August 2026, and how many are being exploited?

Microsoft addressed roughly 400 vulnerabilities on August 11, 2026, with 42 rated critical and three zero-days. [1][2] Exactly one, CVE-2026-68820 in the afd.sys networking driver, was being exploited in the wild at release, by North Korea's Lazarus group. [3] The other two zero-days were publicly disclosed but not observed in active attacks.

Is my small business a target of the Lazarus zero-day?

It depends on what you make. Operation Dream Job targets engineers at defense, aerospace, and aviation firms with fake job offers, and the CVE-2026-68820 exploit is a second-stage tool used after an initial compromise. [3] If you are a defense, aerospace, or aviation supplier, including a small NC subcontractor in that supply chain, you are squarely in that profile and should treat this as a targeted threat, not a distant one. If you make furniture, distribute parts, or pour concrete, you are almost certainly not on North Korea's list this week. Either way, patch it fast, because a public zero-day tends to spread beyond the actor who found it as the technique gets picked up and reused more broadly, and at that point the worry is not Lazarus but whoever adopted it.

We run a Windows domain controller. Which patches matter most for us?

It depends on which roles that controller actually runs. If it hosts the DHCP or Deployment Services role, it is your highest priority, because this month's cumulative carries the unauthenticated Deployment Services (CVE-2026-62893) and DHCP (CVE-2026-62823) fixes and an attacker on your LAN could exploit those with no credentials. [1] A controller that runs only DNS exposes neither of those, so it rides the accelerated ring with the rest of the fleet for the exploited afd.sys fix. Check the installed roles before you assume the box belongs in the 48-hour lane.

Does antivirus protect us from the FudModule rootkit?

Not on its own. Signature antivirus can miss a kernel-level rootkit once it has disabled the security callbacks and event logging, which is what the FudModule variant does, though a known sample may still be caught before the driver loads or by an offline scan. [3] EDR with tamper protection is better placed to flag the earlier stages of the attack, but it is not guaranteed to see the rootkit once it is fully installed at the kernel level, which is why fast patching of the elevation path matters as much as the detection layer.

Should we patch all 400 fixes this week?

You are not patching 400 separate items. The Windows OS fixes arrive as one cumulative update, so the decision is which machines get it first. Push it to your exposed servers within 48 hours after a pilot on one server of each Windows Server version you run, roll it to the rest of the fleet over the next several days (workstations at defense, aerospace, and aviation suppliers move into the 48-hour lane, since those are the Lazarus target), and keep third-party app updates on their own tested cycle, with one exception: anything actively exploited or on CISA's KEV list, whoever makes it, jumps to that same 48-hour lane too. That order protects the machines that matter without turning every second Tuesday into a fire drill.

Can Preferred Data handle this for us?

Yes. Preferred Data runs managed patch and vulnerability programs for businesses across High Point, Greensboro, Charlotte, and Raleigh, including the fast ring for exposed servers and the tested rollout for everything else. A patch exposure check, scheduled after a short intake, tells you where you stand on this month's release specifically.

Related Resources

• Managed IT Services
• Cybersecurity and Managed Detection
• Network Services
• Schedule a Patch and Vulnerability Review
• Contact Preferred Data for an August patch exposure check

References

1. Tenable. (2026, August 11). Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820). https://www.tenable.com/blog/microsofts-august-2026-patch-tuesday-addresses-398-cves-cve-2026-68820
2. BleepingComputer. (2026, August 11). Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days. https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/
3. Check Point Research. (2026, August). Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack (CVE-2026-68820). https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/
4. CISA. (2026). Known Exploited Vulnerabilities Catalog (CVE-2026-68820). https://www.cisa.gov/known-exploited-vulnerabilities-catalog