A single malformed UDP packet. No username. No password. No phishing link. No victim who needs to click anything. That is all an attacker requires to achieve full remote code execution on any Windows Server 2022, Windows Server 2025, or Windows 11 system running Microsoft’s QUIC stack — thanks to CVE-2026-62815, a use-after-free flaw quietly patched on 11 August 2026 as part of Microsoft’s August Patch Tuesday. With a CVSS 3.1 base score of 9.8 and an attack vector string of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, this is as dangerous as network vulnerabilities get. If you have not deployed this month’s updates yet, you are running on borrowed time.

▶ Key Takeaways

  • CVE-2026-62815 is a CWE-416 (Use After Free) flaw in Microsoft’s QUIC transport-layer library (msquic) rated CVSS 9.8 Critical.
  • Exploitation requires zero authentication and zero user interaction — an unauthenticated remote attacker sends a crafted packet over the network and gains code execution.
  • Affected systems include Windows 11 23H2, 24H2, 25H2, 26H1 and Windows Server 2022 and 2025 (including Server Core).
  • QUIC underpins HTTP/3 — the next-generation web protocol already deployed on roughly 13.5 million internet-facing servers worldwide.
  • No active exploitation has been confirmed as of publication, giving organisations a narrow but real patching window.
  • Two companion CVSS 9.8 vulnerabilities — CVE-2026-62878 (Windows DNS Server) and CVE-2026-62893 (Windows Deployment Services TFTP) — were fixed in the same release and deserve equal urgency.
  • Patch: apply Microsoft’s August 2026 security updates immediately; interim mitigation is to block inbound UDP on exposed QUIC ports (typically UDP 443) at the perimeter where patching is delayed.

What Is Microsoft QUIC — and Why Should Network Defenders Care?

QUIC (Quick UDP Internet Connections) is an IETF-standardised transport protocol that moves packets over UDP instead of TCP. Conceived by Google and formalised as RFC 9000, it is the backbone of HTTP/3, the latest version of the web’s foundational application protocol. Unlike HTTP/1.1 and HTTP/2 which run on TCP, HTTP/3 runs entirely over QUIC, promising faster connection setup, built-in TLS 1.3 encryption, and resilience to packet loss.

Microsoft ships its own open-source QUIC implementation — msquic — baked directly into Windows Server 2022 onwards and Windows 11. It is used not only by IIS and edge services but also by internal Microsoft components and increasingly by third-party applications that link against the Windows QUIC API. That ubiquity is precisely what makes CVE-2026-62815 so alarming: unlike vulnerabilities confined to a niche feature or optional role, this flaw lives in a foundational networking component that modern Windows deployments simply cannot turn off.

Consider the exposure surface. Any Windows system that:

  • Acts as an HTTP/3-capable web or API server
  • Runs services that advertise QUIC via Alt-Svc headers
  • Hosts applications that use msquic.dll directly
  • Exposes UDP/443 to untrusted networks

…is a candidate target. In enterprise environments, that list can quietly include load balancers, remote-access gateways, internal microservice meshes, and cloud-edge endpoints — often without the security team having explicitly configured “QUIC” anywhere.

CVE-2026-62815 — Deep Technical Breakdown

The root cause is a use-after-free (UAF) condition (CWE-416) inside the msquic library. In a UAF scenario, a program frees a memory object but retains a pointer to it; if a second code path subsequently triggers memory reuse at that location before the stale pointer is cleared, an attacker who can control the timing — or the network packet that causes the free — can corrupt heap memory in a controlled manner.

In the context of a network-facing protocol handler, UAF bugs are especially dangerous because:

  1. Remote reachability. The attacker does not need local access. A crafted sequence of QUIC packets sent across the internet can trigger the vulnerability.
  2. No authentication checkpoint. QUIC’s handshake happens in the transport layer below any application-level login. The bug exists before credentials are ever checked.
  3. Heap grooming potential. A skilled attacker can repeatedly probe the heap layout via benign QUIC traffic to position a replacement object at the freed address, turning an unstable crash into reliable code execution.
Attribute Detail
CVE ID CVE-2026-62815
CVSS 3.1 Score 9.8 / 10 Critical
CVSS Vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type CWE-416 — Use After Free
Component Microsoft QUIC (msquic.dll)
Authentication Required None
User Interaction None
Impact Confidentiality High / Integrity High / Availability High
Affected Platforms Windows 11 23H2/24H2/25H2/26H1 · Windows Server 2022/2025 (incl. Core)
Active Exploitation Not confirmed as of 12 August 2026
Patch Released 11 August 2026 — Microsoft August Patch Tuesday

Specific version boundaries are documented: Windows 11 23H2 builds prior to 10.0.22631.7517, Windows 11 24H2 and 25H2 builds prior to 10.0.26100.9168, Windows 11 26H1 builds prior to 10.0.28000.2704, Windows Server 2022 builds prior to 10.0.20348.5499, and Windows Server 2025 builds prior to 10.0.26100.33296 are all vulnerable.

Context: An Unusually Heavy Patch Tuesday

August 2026’s Patch Tuesday — released on 11 August — is one of the largest in Microsoft’s history: 398 CVEs addressed, including 62 rated Critical. That is not a typo. The scale reflects Microsoft’s ongoing integration of AI-assisted vulnerability discovery into its Security Development Lifecycle, surfacing classes of bugs that might previously have been missed until a researcher or adversary found them externally.

CVE-2026-62815 sits at the top of the risk stack for organisations with internet-facing Windows infrastructure, but security teams should be aware of two companion vulnerabilities patched simultaneously — both also rated CVSS 9.8, both requiring no authentication:

  • CVE-2026-62878 — A stack-based buffer overflow in the Windows DNS Server component enabling remote code execution with elevated privileges. In an enterprise Active Directory environment, a vulnerable domain controller’s DNS port is reachable by every workstation on the network — the wormability potential is significant.
  • CVE-2026-62893 — Remote code execution in Windows Deployment Services via a malformed TFTP packet on UDP port 69. TFTP is unauthenticated by design, making this a near-trivially-exploitable bug on any network that runs WDS for PXE booting.

For the latest analysis of the broader August 2026 Patch Tuesday landscape — including the actively-exploited CVE-2026-68820 Lazarus FudModule kernel zero-day that received the most urgent patching directive — see the linked coverage on this site.

Who Is Most at Risk?

Not every Windows deployment carries equal exposure. The highest-risk environments are those where Windows servers with msquic enabled are:

  • Internet-facing without a WAF or next-gen firewall filtering UDP/443 — cloud-hosted Windows web servers, Azure edge nodes, IIS instances with HTTP/3 enabled.
  • Inside perimeter networks reachable from untrusted zones — a compromised workstation on the same segment can pivot to a vulnerable server even if the server is not directly internet-facing.
  • Running Windows Server 2025 on modern Hyper-V or Azure Stack HCI fabric — these environments eagerly adopt HTTP/3-capable services and are statistically more likely to have QUIC-enabled endpoints.
  • Organisations with slow patch cycles — the Indian enterprise sector, like many markets, often operates patch cycles of 30–90 days. With a vulnerability of this profile, that timeline is unacceptable.

Cisco Talos has released Snort rules (rule family 1:66902–1:66910 and Snort 3 SIDs in the 1:301589–1:301607 range) to detect exploitation attempts. Organisations running Cisco Secure Firewall or IOS XE security features should ensure their SRU (Security Rule Update) is current to gain this detection coverage.

What You Should Do Right Now — Sanjay’s Expert Defence Checklist

Having spent three decades hardening enterprise networks in India and abroad — implementing zero-trust architectures, FortiGate perimeters, and NOC/SOC frameworks — here is how I would approach this vulnerability across a typical mid-to-large enterprise environment:

  1. Patch immediately — treat this as a P0 emergency.
    Deploy Microsoft’s August 2026 security updates to all Windows 11 and Windows Server 2022/2025 systems. Use your RMM or SCCM deployment ring to accelerate to internet-facing and high-value servers first. Do not wait for your next scheduled maintenance window. A CVSS 9.8 unauthenticated RCE demands emergency change procedures.
  2. Audit your QUIC surface area immediately.
    Run netstat -ano | findstr ":443" on your Windows servers and correlate with process names. Identify which services have HTTP/3 / Alt-Svc advertisement enabled. Check IIS application pool configurations and any third-party application manifests for msquic.dll dependencies.
  3. Block inbound UDP/443 at your perimeter for unpatched systems.
    On FortiGate firewalls, create a policy blocking UDP 443 from untrusted zones to your Windows server VLANs as a temporary compensating control. Most legitimate HTTPS traffic still flows over TCP/443 (HTTP/1.1/2); HTTP/3 over QUIC degrades gracefully to HTTP/2 when QUIC is blocked. This is not a permanent fix — patch regardless.
  4. Update your IDS/IPS signatures now.
    For Cisco Secure Firewall users, apply the latest SRU to activate Snort coverage for CVE-2026-62815 (rule family 1:66902–1:66910). For FortiGate IPS, ensure your IPS database is updated to the latest version available as of 12 August 2026 and enable HTTP/3 QUIC inspection profiles on internet-facing policies.
  5. Enable enhanced monitoring on QUIC-capable services.
    Configure your SIEM to alert on unusual UDP/443 traffic patterns from external sources — specifically high-rate packet floods or malformed initial packets that deviate from standard QUIC version negotiation. Flag any anomalous crashes or restarts of msquic-dependent services (e.g., IIS application pool restarts, W3SVC errors) as potential exploitation indicators.
  6. Segment and layer defence-in-depth.
    Even in patched environments, ensure your zero-trust micro-segmentation policies limit which endpoints can initiate QUIC connections to sensitive servers. Least-privilege network access is your last line of defence when a zero-day surfaces before the patch does.
  7. Brief your incident response team.
    Ensure your SOC analysts understand what a QUIC-based intrusion attempt looks like — unusual UDP traffic, msquic-related crash dumps in Windows Event Viewer (Application log, Event ID 1000/1001), and anomalous outbound connections from Windows Server processes immediately following inbound UDP/443 sessions are red flags.

Frequently Asked Questions

Is CVE-2026-62815 being actively exploited right now?

As of 12 August 2026, Microsoft has not marked CVE-2026-62815 as actively exploited or publicly disclosed prior to patching. However, a CVSS 9.8 unauthenticated RCE in a widely deployed networking component will attract rapid reverse-engineering interest from threat actors. Historical precedent shows that critical network-facing vulnerabilities are typically weaponised within days to weeks of the patch release, as researchers diff the patch to reconstruct the vulnerability. Do not treat “not yet exploited” as “safe to defer patching.”

Does blocking QUIC/HTTP/3 break my applications?

In most cases, no. HTTP/3 over QUIC is an optional performance upgrade; modern browsers and clients automatically fall back to HTTP/2 over TCP when QUIC is unavailable. Blocking inbound UDP/443 at your perimeter firewall as a temporary measure will cause browsers to use HTTP/2, with a marginal increase in connection setup latency — an acceptable trade-off for a CVSS 9.8 RCE. Internal applications that explicitly require QUIC (certain gaming or real-time collaboration services) may be affected and should be inventoried before implementing the block.

Are cloud-hosted Windows VMs on Azure or AWS affected?

Yes. The vulnerability is in the Windows operating system’s msquic library, not in the hypervisor or cloud platform. Any Windows Server 2022/2025 or Windows 11 VM on Azure, AWS, or any other cloud that has not been patched to the August 2026 build levels is vulnerable. Cloud providers do not auto-patch guest operating systems — that is the customer’s responsibility. Check your VM fleet for compliance via Azure Policy, AWS Systems Manager Patch Manager, or equivalent tooling immediately.

What is the difference between CVE-2026-62815 and the other CVSS 9.8 bugs in this Patch Tuesday?

All three CVSS 9.8 bugs this month share the no-auth, no-user-interaction attack profile, but they target different components: CVE-2026-62815 is in the QUIC transport layer (used by HTTP/3 services), CVE-2026-62878 is in Windows DNS Server (relevant to Active Directory domain controllers), and CVE-2026-62893 is in Windows Deployment Services’ TFTP handler (relevant to PXE-boot infrastructure). Organisations should patch all three. DNS Server and WDS may require separate manual attention if they are deployed on standalone servers outside normal workstation/client patching scope. Refer to the Zero Day Initiative August 2026 review and Cisco Talos analysis for per-CVE patch priority guidance.

Is Your Windows Infrastructure Exposed?

CVE-2026-62815 is a wake-up call: modern networking protocols carry the same risk surface as the applications they serve, and a single unpatched server can become an attacker’s beachhead into your entire environment. Whether you need an emergency patch-gap assessment, a zero-trust network segmentation review, or ongoing SOC coverage to detect exploitation attempts before they escalate — that is exactly the kind of work I do for organisations across India and the APAC region every day.

Book a free 30-minute security assessment with Sanjay Seth → Let’s audit your exposure to this and the 61 other Critical vulnerabilities patched this month — before an adversary does it for you.

Sources: The Hacker News · BleepingComputer · Zero Day Initiative · Cisco Talos Intelligence · CrowdStrike · NVD