.svg)
In summary: On August 12, 2026, Microsoft released a batch of patches addressing nearly 400 vulnerabilities, including a QUIC flaw rated 9.8/10 and a zero-day vulnerability that had already been exploited. For an SME, the challenge isn’t to patch everything in a single day, but to determine the correct order in which to do so.
What Happened
On August 12, 2026, Microsoft released its monthly Patch Tuesday update. It addresses 398 vulnerabilities, including 44 classified as critical and two zero-days. These figures are taken from Microsoft security bulletins, as reported by the SANS Internet Storm Center, Help Net Security, and CrowdStrike.
Two vulnerabilities stand out from the rest. The first, designated CVE-2026-62815, affects Microsoft’s implementation of QUIC, the protocol that carries HTTP/3. Rated 9.8 out of 10, it allows an unauthenticated attacker to execute code remotely via a single network packet, without any user interaction. It affects Windows 11 and Windows Server 2022 and 2025. The second, CVE-2026-68820, targets afd.sys, the driver that manages network connections in Windows. It is already being exploited in the wild, making it a high priority even though its raw score is lower.
Does this apply to me?
If your workstations are running Windows 11 and your servers are running Windows Server 2022 or 2025, the answer is yes. The afd.sys zero-day vulnerability affects nearly all recent Windows machines, as it targets a core networking component. The QUIC vulnerability primarily exposes servers that publish an HTTP/3 or QUIC service to the outside world: a workstation isolated behind a firewall remains difficult to compromise, whereas a server exposed to the Internet is much more vulnerable.
To assess your risk, check the date of the last patch deployment across your infrastructure and identify the servers that are accessible from the Internet. That's where the exposure becomes real.
What to Do Now
First, address the vulnerability that is already being exploited. CVE-2026-68820 is actively being exploited: apply the afd.sys patch as a priority on workstations and servers, because the risk is real, not theoretical.
Next, patch the exposed servers. Any server that exposes a QUIC or HTTP/3 service to the outside must receive the CVE-2026-62815 patch as soon as possible. Pending deployment, a non-essential service can be temporarily shut down.
Finally, plan the rest. The other patches should be deployed according to your usual cycle, following a quick test on a pilot batch to prevent regressions. Regular patch management is, in fact, one of the measures required by the NIS2 Directive for affected entities. If your IT infrastructure is managed by a third party, ask your service provider for a written update on these two CVEs: which systems are covered, by what date, and what remains to be done.
In a nutshell
A busy Patch Tuesday isn't a cause for panic. Two vulnerabilities deserve your attention this week: the afd.sys zero-day, which is already being exploited, and the QUIC vulnerability on your exposed servers. The rest follows your normal cycle. With a well-monitored infrastructure and an orderly deployment process, this type of month can be handled without any drama.
— Samir Amara, CEO — IT Systèmes
Frequently asked questions
Should we patch everything right away? No. We prioritize addressing the vulnerability that’s already being exploited and the exposed servers, then handle the rest according to the usual schedule after a pilot test.
Is an office workstation behind a firewall vulnerable to the QUIC vulnerability? Much less so than a server exposed to the Internet, but it should still be updated as part of the normal deployment process.
How can I tell if my servers are using QUIC? Check which services are published over HTTP/3 and ask your IT team or service provider for a list of the exposed ports and protocols.
.svg)