Microsoft Patches 398 Flaws, Including Actively Exploited Windows Driver Zero-Day

Microsoft has released its latest security updates, patching a total of 398 vulnerabilities. One notable flaw is CVE-2026-68820, a Windows driver zero-day vulnerability that has been actively exploited by attackers. This bug sits in the core Windows kernel driver and allows an attacker to escalate to SYSTEM privileges.

The exploitation of this vulnerability depends on triggering a race condition in the driver, and Microsoft has not publicly attributed the exploitation. Check Point Research, however, revealed that Lazarus group used this zero-day in its Operation Dream Job campaign.

In addition to CVE-2026-68820, four other flaws have been patched without requiring any interaction from the victim. These vulnerabilities affect Windows DNS Server, Windows Deployment Services, Microsoft's QUIC transport protocol, and High Performance Computing (HPC) Pack, with each carrying a CVSS score of 9.8.