The latest articles on DEV Community by Ian Bishop (@ian_bishop_98bf15c6a498d4). https://dev.to/ian_bishop_98bf15c6a498d4 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4076715%2F81dcf8e4-3b5f-44b9-83db-77242e834fc2.png https://dev.to/ian_bishop_98bf15c6a498d4 en Ian Bishop Thu, 13 Aug 2026 19:04:33 +0000 https://dev.to/ian_bishop_98bf15c6a498d4/patch-tuesday-august-2026-1-zero-day-109-critical-fixes-among-790-cves-3hdc https://dev.to/ian_bishop_98bf15c6a498d4/patch-tuesday-august-2026-1-zero-day-109-critical-fixes-among-790-cves-3hdc <p>Microsoft's August 2026 security update addresses 790 vulnerabilities: 109 rated Critical, 396 Important. 1 is already exploited in the wild and 2 were publicly disclosed before today.</p> <p>This month's headline is a single actively exploited zero-day: CVE-2026-68820, a use-after-free EoP in the Windows Ancillary Function Driver for WinSock, already confirmed in KEV. It's the one CVE in this 790-fix batch you cannot leave for next week. Beyond that, the release is heavy on volume — 109 critical and 111 RCE fixes — but light on other confirmed exploitation, with two publicly disclosed EoP/tampering bugs in User Profile Service and the Container Isolation FS Filter Driver rounding out the disclosed-but-not-yet-exploited list.</p> <h2> Patch these first </h2> <ul> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820" rel="noopener noreferrer">CVE-2026-68820</a></strong> (Important, CVSS 7.0) — Windows Ancillary Function Driver for WinSock: Elevation of Privilege — <strong>exploited in the wild</strong>, <strong>CISA KEV</strong> </li> </ul> <p>CVE-2026-68820 (Windows Ancillary Function Driver for WinSock, CVSS 7.0): a use-after-free that lets an already-authenticated local attacker elevate privileges to SYSTEM. It's marked exploited in the wild and is in KEV, so treat it as your top priority patch this cycle regardless of platform — AFD.sys underpins core networking on every supported Windows version, meaning any endpoint or server where a low-priv user or process can execute code is a viable target for local privilege escalation chains. Patch this today.</p> <h2> Publicly disclosed </h2> <ul> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62832" rel="noopener noreferrer">CVE-2026-62832</a></strong> (Important, CVSS 7.8) — Windows User Profile Service: Elevation of Privilege — publicly disclosed</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72971" rel="noopener noreferrer">CVE-2026-72971</a></strong> (Important, CVSS 5.5) — Windows Container Isolation FS Filter Driver (unionfs.sys): Tampering — publicly disclosed</li> </ul> <h2> Also notable </h2> <ul> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65665" rel="noopener noreferrer">CVE-2026-65665</a></strong> (Critical, CVSS 8.8) — Microsoft Office SharePoint: Remote Code Execution</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-63520" rel="noopener noreferrer">CVE-2026-63520</a></strong> (Important, CVSS 8.1) — Microsoft Office SharePoint: Remote Code Execution</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59124" rel="noopener noreferrer">CVE-2026-59124</a></strong> (Important, CVSS 9.8) — Microsoft High Performance Computing (HPC) Pack: Remote Code Execution</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62893" rel="noopener noreferrer">CVE-2026-62893</a></strong> (Critical, CVSS 9.8) — Windows Deployment Services: Remote Code Execution</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59133" rel="noopener noreferrer">CVE-2026-59133</a></strong> (Important, CVSS 8.8) — Microsoft High Performance Computing (HPC) Pack: Elevation of Privilege</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62823" rel="noopener noreferrer">CVE-2026-62823</a></strong> (Critical, CVSS 8.8) — Windows DHCP Server: Remote Code Execution</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56162" rel="noopener noreferrer">CVE-2026-56162</a></strong> (Critical, CVSS 10.0) — Azure SQL Database: Elevation of Privilege</li> <li> <strong><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50481" rel="noopener noreferrer">CVE-2026-50481</a></strong> (Critical, CVSS 9.9) — Azure Active Directory: Elevation of Privilege</li> </ul> <h2> By the numbers </h2> <ul> <li>Unspecified: <strong>369</strong> </li> <li>Elevation of Privilege: <strong>176</strong> </li> <li>Remote Code Execution: <strong>111</strong> </li> <li>Information Disclosure: <strong>86</strong> </li> <li>Spoofing: <strong>21</strong> </li> <li>Denial of Service: <strong>12</strong> </li> <li>Security Feature Bypass: <strong>11</strong> </li> <li>Tampering: <strong>4</strong> </li> </ul> <p><em>Source: <a href="https://msrc.microsoft.com/update-guide" rel="noopener noreferrer">Microsoft Security Update Guide</a> and the <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" rel="noopener noreferrer">CISA KEV catalog</a>.</em></p> <p><strong><a href="https://secnewsheadlines.com/?utm_source=devto&amp;utm_medium=blog&amp;utm_campaign=patch-tuesday-2026-aug" rel="noopener noreferrer">Subscribe free →</a></strong> I write a curated cybersecurity news roundup, including this breakdown each Patch Tuesday. Get it in your inbox.</p> cybersecurity