Microsoft's August Patch Tuesday Fixes 421 Flaws, Including a Windows Zero-Day Under Attack

What happened

Microsoft shipped its August 2026 security update on Tuesday, August 11, and it is a big one: 421 CVEs across the company's products. That is the largest single Patch Tuesday of the year to date, and among the heaviest Microsoft has ever released in one month.

The bulk falls on Windows itself, with 236 fixes. Office accounts for 98, SharePoint Server for 30, developer tools for 26, Azure for 17, and Exchange Server for 7. Microsoft Defender received a single fix. Buried in that pile is the part that changes the priority for defenders: one flaw is already being exploited in the wild, and two more were publicly disclosed before a patch existed.

The zero-day being exploited

The flaw under active attack is CVE-2026-68820, a use-after-free bug in the Ancillary Function Driver for WinSock, better known by its filename, afd.sys. It is an elevation-of-privilege bug rather than a remote one. An attacker who is already running code on a machine can use a specially crafted application to climb from a normal user account to SYSTEM, the highest privilege level on Windows.

That "already on the machine" caveat matters, and it cuts both ways. It means CVE-2026-68820 is not a click-and-you-are-owned internet worm. It also means it is exactly the second stage a real intrusion needs: phishing or a poisoned download gets a foothold as an ordinary user, and a bug like this turns that foothold into full control of the box.

The afd.sys driver has a track record here. Satnam Narang, senior staff research engineer at Tenable, noted that this is the fourth afd.sys zero-day since 2022, and that one of the earlier ones, CVE-2024-38193, was reportedly exploited by the North Korea-linked Lazarus group. Microsoft has not attributed the current activity, but a WinSock driver that keeps producing privilege-escalation zero-days is the kind of thing nation-state operators return to.

What else got patched

Two vulnerabilities were publicly disclosed before this update, which is what puts them a notch above the rest even though there are no confirmed attacks yet:

• CVE-2026-62832: an elevation-of-privilege flaw in the Windows User Profile Service.
• CVE-2026-72971: a link-following bug in the Windows Container Isolation FS Filter Driver.

Public disclosure means the technical details were already circulating, which shortens the runway between "researchers know" and "attackers weaponize."

Several remote code execution bugs are worth flagging for anyone running the affected roles, since RCE is the class that lets an attacker in from the network rather than escalating once inside:

• CVE-2026-62878: Windows DNS Server.
• CVE-2026-62893: the TFTP component of Windows Deployment Services.
• CVE-2026-62815: Microsoft QUIC.
• CVE-2026-59124: Microsoft HPC Pack.

None of these carried in-the-wild exploitation as of the August 11 release, but a DNS Server RCE on a domain controller is the sort of thing that should not wait for the next maintenance window.

Why it matters

A 421-CVE month is not just a headline number. It is a workload problem. Patch testing, staged rollouts and reboot scheduling all scale with the size of the batch, and the bigger the batch, the more likely a team triages instead of applying everything at once. The risk is that the one flaw that is actually being exploited gets lost in the noise of four hundred that are not.

CVE-2026-68820 is the one to pull out of the pile. Privilege escalation rarely makes the mainstream news because it is not the flashy remote break-in, but it is the quiet workhorse of nearly every serious breach. Ransomware crews and espionage groups alike need SYSTEM to disable protections, move laterally and clear their tracks, and a driver bug that hands it over is precisely that tool.

What to do now

The practical advice is unglamorous and unchanged. Prioritize CVE-2026-68820 first because it is being exploited, then the two publicly disclosed elevation-of-privilege flaws, then the network-facing RCEs on any exposed server roles. For most home and small-business users, the fix is automatic: Windows Update will pull the August package down on its own, and confirming it installed is enough.

Organizations running Windows Server Update Services or a management tool such as Intune or Configuration Manager should get CVE-2026-68820 into their fast-track ring rather than the standard monthly cadence. Microsoft's own guidance in the Security Update Guide lists no workarounds for the exploited flaw, so the patch is the mitigation. The next Patch Tuesday is scheduled for September 8, 2026.