Microsoft August 2026 Patch Tuesday Fixes 398 Flaws, Including 1 Actively Exploited Zero-Day

#microsoft #patchtuesday #security #windows

Originally published at https://tekmag.thsite.top/microsoft-august-2026-patch-tuesday-fixes-398-flaws-including-1-actively-exploited-zero-day-2/

Microsoft.com">Microsoft's August 2026 Patch Tuesday addressed 398 vulnerabilities, including 42 rated Critical and one actively exploited zero-day in Windows' afd.sys driver. Organizations should apply updates immediately, prioritizing the local privilege escalation flaw (CVE-2026-68820) that attackers are using in the wild.

Microsoft released its monthly security updates on August 11, 2026, bringing the total count of patched flaws to at least 398 across Windows, Office, and other products. The update follows a pattern of increasingly large patch cycles: June 2026 carried nearly 200 fixes, and July 2026 broke records with over 570. Microsoft has attributed the rising volume to AI-aided vulnerability discovery tools deployed across its engineering teams.

Among the 398 flaws, 42 were rated Critical by Microsoft's severity scale. Two vulnerabilities had been publicly disclosed before the patch dropped: CVE-2026-62832, a Windows User Profile Service elevation of privilege flaw, and CVE-2026-72971, a low-impact local tampering issue. The most urgent item is CVE-2026-68820, a use-after-free vulnerability in the Ancillary Function Driver for WinSock (afd.sys) that allows authorized local attackers to elevate privileges. Microsoft confirmed this zero-day is being exploited in the wild.

Key Takeaways

Microsoft patched 398 vulnerabilities in August 2026, with 42 rated Critical
CVE-2026-68820 is an actively exploited zero-day in afd.sys allowing local privilege escalation (CVSS 7.0 HIGH)
Two additional flaws were publicly disclosed before the patch: CVE-2026-62832 and CVE-2026-72971
The increased patch volume is partly attributed to AI-aided vulnerability discovery
Admins should prioritize applying updates for the afd.sys zero-day immediately

What Patched in August 2026

The August update covers vulnerabilities across Windows operating systems, Microsoft Office, Edge, .NET, and other components. The 42 Critical-rated flaws span multiple product families, though Microsoft did not release a detailed breakdown of which products each Critical vulnerability affects beyond the two zero-days.

CVE-2026-68820 affects the Windows Ancillary Function Driver for WinSock, commonly known as afd.sys. The vulnerability stems from a use-after-free condition (CWE-416) that allows an authenticated local attacker to escalate privileges. Its CVSS 3.1 score is 7.0 (HIGH), with the exploit vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The "E:U" (Exploit Code: Unproven) indicator was later updated to reflect active exploitation in the field.

CVE-2026-62832 targets the Windows User Profile Service. This elevation of privilege flaw (CWE-59, improper link resolution) has a CVSS score of 7.8 (HIGH). An attacker who gains local access could exploit the improper link resolution before file access to escalate privileges. Microsoft published the CVE record on August 12, 2026.

The third publicly disclosed flaw, CVE-2026-72971, carries a lower severity rating and is considered unlikely to be exploited given its limited impact scope.

Why the Patch Count Keeps Rising

Microsoft's patch cadence has accelerated noticeably over the past few months. June 2026 brought nearly 200 fixes, and July 2026 delivered over 570 — then this month's 398 represents another substantial release. Krebs on Security reported that Microsoft attributes the growing volume in part to AI-assisted vulnerability discovery tools running across its engineering divisions.

The trend raises a practical question for IT teams: does a larger patch volume mean Microsoft is discovering more bugs, or simply releasing fixes faster? The answer is likely both. AI tools can scan codebases at scale, finding edge cases human reviewers might miss. But faster discovery also means faster release cycles, which compresses testing windows for enterprise patch management teams.

Security researchers emphasized that while the patch counts are high, the increased volume does not necessarily indicate a decline in code quality. It reflects better detection capabilities. Krebs noted that experts advise organizations to test patches thoroughly before broad deployment rather than rush to install everything at once.

What Administrators Should Do Now

The immediate priority is applying updates for CVE-2026-68820. Because this is an actively exploited zero-day in a core Windows driver, delayed patching leaves systems exposed to local privilege escalation attacks. Any user account with local login access could potentially exploit the flaw.

For CVE-2026-62832, the risk is similar but slightly lower due to its higher complexity requirements (AC:H vs. AC:L). Still, any Windows system with user profile services running should be patched as soon as possible.

Administrators should follow standard change management procedures: test the August updates in a staging environment, verify application compatibility, then deploy to production. The volume of changes means there is a non-trivial chance of regressions, so thorough testing is warranted despite the urgency of the zero-day.

Systems not yet on the latest cumulative update should prioritize this month's release. Organizations using Windows Update for Business or Microsoft Endpoint Configuration Manager can schedule deployment rings to manage risk across their fleets.

Context: Patch Tuesday Is No Longer Quiet

Microsoft's Patch Tuesday tradition — releasing security updates on the second Tuesday of each month — has become a major event for IT operations worldwide. What was once a predictable, moderate-sized update cycle has evolved into a period of intense activity, especially as vulnerability discovery scales up.

The July 2026 update, which set a record with over 570 fixes, demonstrated that Microsoft's backlog of discovered vulnerabilities can accumulate quickly. August's 398 is lower than July's total but still represents a massive workload for any enterprise patch management team.

This pace is unlikely to slow down. As AI tools become more embedded in Microsoft's development and security workflows, the rate of vulnerability discovery should continue climbing. The question for organizations is not whether patch volumes will stay high, but how to adapt their deployment pipelines to keep up.

Conclusion

Microsoft's August 2026 Patch Tuesday delivered 398 fixes, including one actively exploited zero-day and 42 Critical-rated vulnerabilities. The afd.sys privilege escalation flaw (CVE-2026-68820) demands immediate attention. While the growing patch volume reflects improved vulnerability discovery, it also puts pressure on IT teams to keep deployment pipelines current. Apply what you can, test what you must, and prioritize the known-exploited flaws.

What's your patching strategy for this month's large release? Share your approach in the comments.

FAQ

  <h3>Q: What is CVE-2026-68820?</h3>

    <p>CVE-2026-68820 is a use-after-free vulnerability in Windows' afd.sys (Ancillary Function Driver for WinSock). It allows an authenticated local attacker to escalate privileges. Microsoft rates it HIGH (CVSS 7.0) and confirms it is being actively exploited in the wild.</p>



  <h3>Q: How many vulnerabilities did Microsoft patch in August 2026?</h3>

    <p>Microsoft patched at least 398 vulnerabilities in August 2026, with 42 rated Critical. This continues a trend of increasing patch volumes over recent months.</p>



  <h3>Q: Were any vulnerabilities publicly disclosed before the patch?</h3>

    <p>Yes. Two flaws were publicly disclosed prior to the August update: CVE-2026-62832 (Windows User Profile Service EoP, CVSS 7.8) and CVE-2026-72971 (low-impact local tampering). CVE-2026-68820 was also known before patch day, as it is actively exploited.</p>



  <h3>Q: Why is Microsoft patching more vulnerabilities each month?</h3>

    <p>Microsoft attributes the rising patch volume in part to AI-aided vulnerability discovery tools used across its engineering teams. Better detection means more flaws are found — and more are fixed — each cycle.</p>



  <h3>Q: Should I rush to patch or test first?</h3>

    <p>Prioritize the afd.sys zero-day (CVE-2026-68820) — it is actively exploited. For the remaining 397 fixes, follow standard change management: test in a staging environment, then deploy to production. Security researchers advise against blind mass deployment given the size of this update.</p>

References

For related Microsoft platform coverage, see our earlier post on WSL alternatives and the broader risks of automated tooling in vibe-coding governance.