Microsoft’s August 2026 Patch Tuesday included a Critical remote code execution flaw in MsQuic, Microsoft’s implementation of the QUIC transport protocol that underpins HTTP/3 across Windows and Azure services. CVE-2026-62815 carries a CVSS score of 9.8 — unauthenticated, network-reachable, no user interaction, low attack complexity.

What happened

QUIC is a UDP-based transport protocol designed to replace TCP+TLS for latency-sensitive, encrypted connections, and Microsoft’s MsQuic library backs HTTP/3 support in IIS, Windows networking stacks, and a growing set of Azure-hosted services. That makes it a component many administrators don’t think of as a discrete attack surface — it’s typically bundled invisibly underneath whatever web or API service actually terminates the connection.

CVE-2026-62815 is a use-after-free (CWE-416) in MsQuic’s packet-handling path. An attacker sends a specially crafted QUIC packet to a service that has QUIC/HTTP-3 enabled; the flawed object-lifetime handling lets that packet trigger memory corruption and, ultimately, arbitrary code execution in the context of the affected service — no credentials, no prior session state, and no interaction from a legitimate user needed. Microsoft has not confirmed active exploitation or public proof-of-concept code as of this writing, but a CVSS 9.8 unauthenticated RCE in a network transport library sets a narrow but real patching window before that changes.

This shipped in the same August round as the wormable Windows DNS Server bug (CVE-2026-62878) and the actively exploited AFD.sys kernel zero-day (CVE-2026-68820) — a Patch Tuesday with an unusually dense cluster of pre-auth, network-facing Windows vulnerabilities.

Technical details

  • CVE: CVE-2026-62815, CVSS 9.8, use-after-free (CWE-416) in Microsoft QUIC (MsQuic)
  • Affected: Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2022/2025, including Server Core installations, on any host with QUIC/HTTP-3 enabled for a listening service
  • Attack vector: network, unauthenticated, no user interaction — a single crafted UDP/QUIC packet sent to an exposed service
  • Exploit maturity: no public PoC or confirmed in-the-wild exploitation reported as of August 14; Microsoft has not flagged it as “exploitation more likely,” but the bug class (pre-auth UAF in a widely bundled transport library) has historically moved fast once researchers start probing it
  • Fixed: Microsoft’s August 2026 Patch Tuesday cumulative updates, released August 11

Impact

QUIC support ships enabled-by-default or easily toggled on across a growing number of Windows and Azure-hosted services — IIS with HTTP/3, SMB over QUIC deployments, and internal Microsoft services that adopted the protocol for its performance characteristics. Because MsQuic sits underneath the application layer, an organization can be exposed without any admin having deliberately “installed” anything separately — the risk surface tracks wherever QUIC is turned on, not wherever it was explicitly provisioned. A successful exploit hands an attacker code execution in the context of the QUIC-terminating service with zero prior access, which on an internet-facing IIS or Azure edge node is a direct path to full host or service compromise.

Mitigation

  • Apply the August 2026 cumulative update to every Windows 11 and Windows Server 2022/2025 host; confirm the patch installed successfully and the required restart completed rather than assuming approval equals deployment.
  • Inventory where QUIC/HTTP-3 is actually enabled — IIS bindings, SMB over QUIC, and any custom services built on MsQuic — since this bug is easy to miss in an asset inventory that tracks services, not transport-layer libraries.
  • Disable HTTP/3/QUIC on internet-facing listeners that don’t specifically need it, as a stopgap where immediate patching isn’t feasible; falling back to HTTP/2 over TCP removes the exposed attack surface entirely.
  • Monitor for anomalous crashes or restarts in QUIC-terminating services, which can indicate failed exploitation attempts against the use-after-free before a reliable exploit chain matures.
  • Don’t deprioritize this behind the DNS Server or AFD.sys bugs from the same Patch Tuesday — CVE-2026-62815’s CVSS 9.8 and zero-interaction requirement put it in the same emergency-patch tier, even without confirmed active exploitation yet.

Sources: Windows Forum — CVE-2026-62815: Patch Microsoft QUIC Remote Code Execution, Strix — CVE-2026-62815 Severity, CVSS & Fix, Microsoft Security Update Guide — CVE-2026-62815, Zero Day Initiative — The August 2026 Security Update Review, SecurityWeek — August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day.