Microsoft August 2026 Patch Tuesday: 418 Vulnerabilities Addressed, Including Exploited Zero-Day
Microsoft's August 2026 Patch Tuesday addresses 418 vulnerabilities, featuring an actively exploited Windows privilege escalation flaw and two disclosed zero-days.
Microsoft's August 2026 Patch Tuesday has rolled out with a substantial update, patching a total of 418 vulnerabilities across its product lines. Among these, 62 are classified as critical, with one already being exploited in the wild and two others publicly disclosed as zero-days, underscoring the urgency for administrators to apply these security updates.
The most pressing issue highlighted is CVE-2026-68820, a Windows Ancillary Function Driver for WinSock use-after-free vulnerability. Rated as Important with a CVSS score of 7.0, this flaw allows a locally authenticated attacker with low privileges to gain SYSTEM privileges by running a specially crafted application that triggers a race condition. Microsoft has confirmed this vulnerability is being exploited in the wild, making it a priority for patching, especially on systems accessible to untrusted users.
Two zero-day vulnerabilities were also disclosed this month. The first, CVE-2026-62832, affects the Windows User Profile Service and is an improper link resolution issue. While not confirmed to be exploited in the wild, this Important-severity flaw (CVSS 7.8) could allow a local authenticated attacker to elevate privileges by manipulating user profile data. The second zero-day, CVE-2026-72971, impacts the Windows Container Isolation FS Filter Driver (unionfs.sys). Rated Important with a CVSS of 5.5, this vulnerability allows a local attacker to tamper with files, though Microsoft states it has not been exploited in the wild.
Beyond privilege escalation and tampering, Microsoft has also addressed critical remote code execution (RCE) vulnerabilities. CVE-2026-62815, a critical flaw in the Microsoft QUIC protocol, carries a CVSS score of 9.8. This use-after-free vulnerability could allow an unauthenticated remote attacker to execute code on the target system by sending a specially crafted network packet. Given its critical nature and potential for remote exploitation, patching systems exposed to untrusted networks is paramount.
Another critical RCE vulnerability, CVE-2026-62878, affects the Windows DNS Server. This stack-based buffer overflow flaw also has a CVSS score of 9.8 and can be triggered remotely by an unauthenticated attacker. Affected systems include a wide range of Windows Server releases, making prompt patching essential for network infrastructure security.
Administrators are advised to prioritize patching the actively exploited CVE-2026-68820, followed by the publicly disclosed zero-days (CVE-2026-62832 and CVE-2026-72971). Additionally, the critical RCE vulnerabilities in QUIC (CVE-2026-62815) and DNS Server (CVE-2026-62878) require immediate attention, particularly on internet-facing systems.
This month's Patch Tuesday highlights the ongoing challenges in securing complex software ecosystems. The combination of actively exploited vulnerabilities, zero-days, and critical RCE flaws underscores the need for robust patch management strategies and continuous monitoring for suspicious activity across Windows environments.
This August 2026 Patch Tuesday update from Microsoft addresses a total of 394 vulnerabilities, a slightly lower count than the 418 detailed in a previous report. Notably, this release includes fixes for three zero-day vulnerabilities: CVE-2026-68820, an actively exploited elevation of privilege in the Windows Ancillary Function Driver for WinSock; CVE-2026-72971, a publicly disclosed tampering vulnerability in the Windows Container Isolation driver; and CVE-2026-62832, another publicly disclosed elevation of privilege in the Windows User Profile Service. Additionally, a critical remote code execution vulnerability (CVE-2026-71331) affecting Azure Attestation services is also patched.
The new article provides additional detail on the exploited zero-day, identifying it as CVE-2026-68820, a use-after-free vulnerability in the afd.sys driver that allows for SYSTEM privilege escalation. It also highlights that this is the fourth afd.sys zero-day exploited since 2022, with previous instances linked to nation-state actors, including North Korea's Lazarus group.
This August 2026 Patch Tuesday from Microsoft addresses a total of 398 CVEs, an increase from the 418 vulnerabilities detailed in the previous month's update. While the total number of patched vulnerabilities is slightly lower, this month's release includes three zero-day vulnerabilities, one of which has been confirmed to be exploited in the wild, highlighting continued active threats.
The Krebs on Security article provides additional context on Microsoft's August 2026 Patch Tuesday, noting that while the total number of vulnerabilities patched (398) is lower than the previous month's record-breaking release, it still represents a significant volume. It also elaborates on the role of AI in vulnerability discovery and the current limitations of AI-generated patches, highlighting that human oversight remains critical for reliable fixes.
This Cisco Talos report provides a more granular breakdown of Microsoft's August 2026 Patch Tuesday, detailing specific vulnerabilities beyond the initial summary. It highlights CVE-2026-62893 in Windows Deployment Services TFTP Server and CVE-2026-65657 in Microsoft SharePoint Server as particularly concerning RCE flaws, alongside the actively exploited CVE-2026-68820. The article also lists several other RCE and elevation of privilege vulnerabilities across various Microsoft products, including Azure and Office components.
While Microsoft's August Patch Tuesday addresses a substantial number of vulnerabilities, security experts emphasize that organizations should prioritize patching based on exploitability and potential impact rather than solely on the sheer volume of CVEs. This strategic approach ensures that critical systems are protected efficiently against the most immediate threats.
Zero Day Initiative has disclosed a local privilege escalation vulnerability in Microsoft Windows' ipt.sys driver, assigned CVE-2026-65773. This flaw, stemming from incorrect permissions on a registry key, allows an attacker with initial low-privileged code execution to escalate to SYSTEM privileges. The vulnerability has a CVSS score of 7.8 and was publicly disclosed on August 11, 2026, with researchers from DEVCORE credited for its discovery.
This advisory from Zero Day Initiative details a specific use-after-free vulnerability within the win32kfull driver, assigned CVE-2026-65776. While the broader Microsoft August 2026 Patch Tuesday addressed numerous flaws, this particular vulnerability allows local attackers with low-privileged code execution to disclose sensitive information, with a CVSS score of 6.5. Microsoft has since released an update to address this specific issue.