By ByteBot
The August 2026 Patch Tuesday dropped 398 CVEs — and the story that captured every security headline was North Korea. The Lazarus Group, kernel-mode rootkits, Operation Dream Job. It’s a compelling narrative. It’s also a distraction. The vulnerability your Windows servers need patched today is CVE-2026-62815: a use-after-free in Microsoft QUIC that scores 9.8 on the CVSS scale, requires zero authentication, and can hit any HTTP/3-enabled server with nothing more than a crafted UDP packet. No credentials. No user. No warning.
What CVE-2026-62815 Actually Does
QUIC is the transport protocol underneath HTTP/3. It runs over UDP port 443 — already open on every production web server — and Microsoft’s implementation (msquic) ships built into Windows Server 2022, Windows Server 2025, and Windows 11. When IIS or .NET Kestrel enables HTTP/3, msquic handles the handshake.
The bug is a use-after-free in that handshake code. An attacker sends a specially crafted QUIC packet to UDP port 443. The server frees a memory object and then references it again before the slot is cleared. That window is enough for code execution at server privilege level. The full CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-accessible, low complexity, no privileges required, no user interaction. That’s as clean as RCEs get.
Check your build number against these patched versions:
- Windows Server 2022: needs build ≥
10.0.20348.5499 - Windows Server 2025: needs build ≥
10.0.26100.33296 - Windows 11 23H2: needs build ≥
10.0.22631.7517 - Windows 11 24H2/25H2/26H1: apply the August 2026 cumulative update
Windows Server 2019 and earlier are not affected — QUIC is not built in.
HTTP/3 Is What Makes This Dangerous at Scale
HTTP/3 is on by default in IIS on Windows Server 2022 and newer. It’s on by default in .NET Kestrel if you configure HTTPS on port 443. Microsoft enabled it to improve performance for modern clients — and they did. They also quietly expanded the QUIC attack surface to every Windows web server in the ecosystem.
According to the Zero Day Initiative’s August review, approximately 13.5 million websites run HTTP/3. UDP port 443 is open on essentially every production HTTPS server. There’s no authentication handshake before the vulnerable code path is reached. An attacker scans for UDP port 443, sends the packet, and waits.
There’s Also a Wormable DNS RCE
CVE-2026-62815 isn’t alone. CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server that also scores 9.8 and also requires zero authentication. ZDI explicitly flagged it as wormable — capable of self-propagating across networks without human intervention, similar to EternalBlue-era vulnerabilities.
Microsoft’s official rating is “exploitation less likely.” ZDI disagrees, and their track record on this kind of assessment is better than Microsoft’s. DNS is universally exposed. The overflow is reliable. Patch your DNS servers alongside your web servers. Three additional DNS RCEs shipped in the same release: CVE-2026-62817 (CVSS 8.8), CVE-2026-62820 (CVSS 8.1), and CVE-2026-65789 (CVSS 8.1).
The Lazarus Story Is Real — Just Not Your Biggest Problem
CVE-2026-68820, the vulnerability that dominated August 12 headlines, is a local privilege escalation in the Windows Ancillary Function Driver. CVSS 7.0. It requires an attacker to already be on the machine with a low-privilege account. Lazarus is using it as a second stage — after a phishing compromise — to escalate to SYSTEM and drop a kernel rootkit. Genuinely dangerous. Not a server-side remote attack.
Patch it. After you patch the two 9.8 unauthenticated RCEs.
How to Patch and Verify
Apply the August 2026 cumulative update through Windows Update or WSUS. Run winver after the update and confirm your build number is at or above the values listed above.
If you cannot patch immediately, disable HTTP/3 at the application layer. For .NET Kestrel:
// Temporary mitigation — remove after applying the August 2026 CU
builder.WebHost.ConfigureKestrel(options =>
{
options.ListenAnyIP(443, listenOptions =>
{
listenOptions.Protocols = HttpProtocols.Http1AndHttp2;
listenOptions.UseHttps();
});
});For IIS: set http3.enabled=false in applicationHost.config and restart the site. Alternatively, block UDP port 443 at the perimeter firewall — clients fall back to HTTP/2. You’ll take a performance hit, but you’ll close the attack vector. If you’re running Snort, apply Talos rules 1:66902–1:66910 from the August release.
398 CVEs Is a Triage Problem
The real lesson of August 2026 Patch Tuesday isn’t any single vulnerability. It’s that shipping 398 CVEs in one batch guarantees the most dangerous ones get buried under the most dramatic ones. The Lazarus story is more interesting to write about than a use-after-free in a transport protocol. CVE-2026-62815 got less coverage. Your attack surface doesn’t care about narrative appeal.
If your team is manually triaging Patch Tuesdays at this scale, automate. Set cumulative updates to apply in test environments automatically and promote to production within 48 hours for Critical-rated CVEs. The alternative is reading about an exploit for a vulnerability that’s been patched for three weeks.
