Windows DNS Wormable RCE + SharePoint Ransomware: 5 Threats to Patch This Week

CVE-2026-62878 is a stack-based buffer overflow in dns.exe, the Windows DNS Server service process. A remote unauthenticated attacker sends a crafted DNS query containing a payload sized to overflow a fixed-size stack buffer in the DNS response-processing code path. The overflow overwrites the saved return address with attacker-controlled shellcode that executes at the privilege level of the DNS Server service, which runs as SYSTEM on Windows Server. No credentials are required. No user interaction is required. The attack is effective against any host listening on UDP or TCP port 53 with the DNS Server role active.

Security Affairs described CVE-2026-62878 as "a good ol' fashioned stack-based buffer overflow" and noted that a compromised DNS server running on a domain controller provides a direct path into Active Directory services including authentication, name resolution, and Group Policy distribution for the entire domain. The wormable designation confirms that an exploit can scan for and attack other reachable DNS servers autonomously, without additional human direction.

Affected systems include Windows Server 2025, Windows Server 2022, and Windows Server 2019 with the DNS Server role active. Standard Active Directory deployments place the DNS role on every domain controller, which means the highest-value servers in most enterprise environments are directly exposed.

Apply the fix from CVE-2026-62878 advisory: KB5121003 on Windows Server 2025 and KB5120249 on Windows Server 2022 and 2019 via Windows Update, WSUS, or direct MSU deployment. This cumulative update also resolves the Lazarus Group-exploited CVE-2026-68820 zero-day -- full details on that nation-state campaign are in the Lazarus FudModule 3.1 deep dive.

No confirmed exploitation of CVE-2026-62878 has been publicly reported as of August 17. Historical patterns with DNS server vulnerabilities show functional exploits typically emerge one to three weeks after patch release.

CVE-2026-45659 is a deserialization of untrusted data flaw in Microsoft SharePoint Server. Deserialization vulnerabilities occur when an application reconstructs attacker-supplied data back into executable .NET objects without validating the object type or content. The architectural root cause creates broad attack surface because the vulnerable code path handles routine SharePoint operations, making patch testing time-consuming and creating long deployment windows during which ransomware groups operate freely.

The documented attack chain begins with low-privilege SharePoint credentials obtained through phishing or credential stuffing. The attacker authenticates to the SharePoint web frontend and sends a crafted HTTP POST request to a SharePoint endpoint that processes serialized .NET objects. The server's deserialization routine reconstructs the malicious payload and executes the embedded code as the w3wp.exe IIS worker process, which runs as the SharePoint application pool service account -- a high-privilege domain account in most deployments.

From that initial code execution, attackers extract the IIS machine keys stored in the SharePoint application configuration. Machine keys allow signing arbitrary authentication tokens, which the attacker uses to forge persistent session cookies that bypass all authentication checks and survive password resets on the compromised account. Resecurity's analysis of the July 2026 SharePoint attack wave documented a case where operators moved from initial SharePoint access to domain controller compromise in under six hours using this exact machine key forgery technique.

CISA confirmed active ransomware exploitation and added CVE-2026-45659 to the Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline. Of 14 SharePoint vulnerabilities CISA has flagged since 2021, eight have been exploited directly in ransomware attacks. Apply the SharePoint Server cumulative update for your version immediately. Hunt for unexpected file writes in the SharePoint layouts directories as evidence of prior webshell deployment.

Two additional CISA-flagged vulnerabilities require action today.

CVE-2026-71362 is an incorrect authorization vulnerability in Adobe Commerce, Commerce B2B, and Magento Open Source. An unauthenticated attacker can switch a store visitor's session to any registered customer account without credentials, gaining access to order history, saved payment methods, shipping addresses, and all personal account data. Sansec, an ecommerce security research firm, reported active exploitation attempts in its WAF telemetry before Adobe released the August 2026 security update. No account, administrator access, or user interaction is required to trigger the attack -- an attacker browsing the storefront can hijack any customer session in a single request. Apply the isolated patch files for your branch from Adobe security advisory APSB26-92 before the store accepts customer traffic this week.

CVE-2026-20349 is a heap inspection vulnerability in Cisco Secure Firewall ASA and FTD software that CISA added to its Known Exploited Vulnerabilities catalog on August 11, 2026, confirming active in-the-wild exploitation. The flaw can expose sensitive memory contents including cryptographic material and session tokens that enable follow-on attacks. Cisco ASA and FTD appliances manage perimeter access for enterprise, government, and critical infrastructure networks globally. Apply the vendor advisory fix immediately. Treat any perimeter firewall that may have been exposed to active exploitation as potentially compromised and conduct a full configuration audit before treating it as a trusted network boundary.

The 2024 ArcaneDoor campaign demonstrated how nation-state actors compromise Cisco perimeter devices to maintain long-term invisible persistence in government networks -- the Cisco ASA ArcaneDoor breakdown provides the full attack pattern.

Two ransomware and extortion groups confirmed active data exfiltration operations this week against large enterprise targets.

Cl0p ransomware claimed responsibility for exfiltrating sensitive internal data from Shell, the multinational energy and petrochemical company operating across more than 70 countries. Shell launched a formal investigation following the Cl0p claim. Cl0p's established playbook involves bulk data exfiltration without deploying encryption, followed by publication of stolen files on the group's leak site when ransom negotiations fail, typically 30 to 60 days after the initial breach. The group has previously targeted organizations through exploited managed file transfer platforms and enterprise software vulnerabilities. Organizations that supply products or services to Shell, operate joint ventures with Shell entities, or share data through integrated systems should assess what data may be within scope of the breach and review contractual breach notification obligations.

ShinyHunters ransomware targeted Lumenis, an Israeli medical device and aesthetic laser technology company, and claimed to have stolen 1.1 million records totaling 176 gigabytes of internal data. The stolen data includes customer and employee personally identifiable information. Lumenis customers and employees should monitor for credential stuffing attempts against any accounts sharing email addresses or passwords with Lumenis-connected services and enable multi-factor authentication immediately on all such accounts.

Neither the Cl0p/Shell breach nor the Lumenis breach has produced specific network infrastructure indicators of compromise as of August 17. The Cl0p group typically releases a partial data sample alongside the victim claim as verification before the 60-day publication deadline.

No CVE-specific Sigma rule targeting CVE-2026-45659's deserialization payload exists yet in the SigmaHQ library -- the vulnerability was added to the CISA KEV list this week and community rules for specific deserialization CVEs typically lag by two to four weeks. The two rules below target the post-exploitation behavior that is consistent across SharePoint deserialization attacks: webshell strings in web server access logs and suspicious file writes to the SharePoint layouts directory, which is where attackers drop webshells after achieving code execution.

Both rules require different telemetry sources. The webshell strings rule operates on web server access logs (IIS logs for Windows SharePoint deployments). The SharePoint layouts file write rule requires Windows file event telemetry from Sysmon event ID 11 (FileCreate) with process image logging. Enable Sysmon with at minimum FileCreate events filtered to the SharePoint Web Server Extensions directory paths before deploying this rule.

Deploy in detection mode and validate against known-good SharePoint administrative operations before switching to blocking mode.

The WAF rules below target CVE-2026-45659 at the HTTP layer -- the deserialization payload arrives as a POST body to SharePoint layout endpoints. Deploy all four platform rules in log/count mode first to baseline legitimate SharePoint traffic before switching to block mode. The ModSecurity rule is OWASP CRS compatible at rule ID 926045659 and includes rate-limiting counters per source IP.

Five actions, ranked by exploitation urgency, close the majority of today's critical exposure. Execute them in order before Friday.

The August 2026 Patch Tuesday release is notable for four converging factors that make delayed patching unusually dangerous.

First, the wormable classification of CVE-2026-62878 means standard patch deployment timelines are inappropriate. A wormable DNS vulnerability on domain controllers does not wait for the next maintenance window. Every day of exposure is a day where a single network-adjacent exploit turns into organization-wide DNS compromise.

Second, CISA's three-day federal deadline for CVE-2026-45659 is the strongest signal the agency can send about active ransomware exploitation in production environments. Federal deadlines are not the relevant metric for private organizations, but the three-day window reflects confirmed incidents where ransomware operators moved from initial SharePoint access to data exfiltration in hours, not days.

Third, the concentration of critical patches touching identity infrastructure -- Active Directory Certificate Services (CVE-2026-62818), DNS Server (CVE-2026-62878), and SharePoint (CVE-2026-45659) -- means unpatched organizations face a situation where multiple independent attack paths can produce domain-level compromise. Patching any one without patching the others leaves compounding risk.

Fourth, the Cl0p and ShinyHunters campaigns demonstrate that enterprise-scale data exfiltration is ongoing alongside vulnerability exploitation. Organizations focused exclusively on perimeter patching may miss active lateral movement by threat actors who entered through a different vector.

Apply the five patches above before Friday. Schedule a Monday morning review of patch deployment status across DNS servers, SharePoint farms, Cisco perimeter devices, and Adobe Commerce instances to confirm coverage before the week ends.