Microsoft's August 2026 Patch Tuesday, released August 11, is an unusually heavy one: 398 new CVEs across Windows, Office, Azure, Exchange, SharePoint, Teams, GitHub Copilot and .NET, 62 of them rated Critical. For defenders trying to triage a list that long, two bugs deserve to jump the queue. The first is CVE-2026-68820, a use-after-free in afd.sys, the kernel driver behind the Windows Sockets API, which Microsoft confirms is already being exploited in the wild to gain SYSTEM-level privileges — though it requires winning a race condition, so it's a local elevation primitive rather than something remotely triggerable on its own. The second, and the one worth actual urgency, is CVE-2026-62878: a stack-based buffer overflow in Windows DNS Server that lets an unauthenticated attacker execute code by sending a single crafted packet, no user interaction required, on a service that's essentially always internet-facing wherever it's deployed. Security researchers are flagging it as potentially wormable, which is the same class of risk that made EternalBlue and similar bugs so damaging. Several other fixes round out the priority list: an unauthenticated RCE in Windows Deployment Services' TFTP server (CVE-2026-62893, relevant to any PXE-boot environment), a bug in Microsoft's QUIC/HTTP-3 implementation estimated to affect around 13.5 million websites (CVE-2026-62815), and an Exchange Server authentication-bypass flaw (CVE-2026-62911) that was demonstrated with working exploit code at Pwn2Own Berlin and, if exploited, hands an attacker read/send/download access to every mailbox on the server. For engineering and IT teams, the practical takeaway is to patch DNS Server and Exchange first — those have either wormable potential or a public working exploit — and treat the WinSock zero-day as a high-priority local privilege-escalation risk to close during the same maintenance window, rather than trying to work through all 398 CVEs in CVSS-score order.