[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLYZXywqZnpQDApTXzxA5L1Ph9uXTz2oOK-YyYOxJJlA":3},{"article":4,"iocs":54},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":31,"category":32,"article_tags":36},"edc7720c-6e8c-4076-ba3e-e2ef3d058667","August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day","august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day-93c7e9","A use-after-free in the afd.sys Windows kernel-mode driver has been exploited to gain SYSTEM privileges. The post August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day appeared first on SecurityWeek.","Microsoft's August 2026 Patch Tuesday addresses 421 CVEs, notably a zero-day use-after-free vulnerability (CVE-2026-68820) in the afd.sys kernel driver, exploited for SYSTEM privilege escalation. This marks the fourth afd.sys zero-day exploited since 2022, with past incidents linked to nation-state actors like North Korea's Lazarus group. The update also includes fixes for other critical vulnerabilities, including publicly disclosed flaws and potential remote code execution bugs.","Microsoft patches 421 CVEs, including one zero-day exploited for SYSTEM privileges.","Microsoft on Tuesday announced patches for 421 CVEs, including a high-severity vulnerability that has been exploited in the wild as a zero-day. The exploited flaw, tracked as CVE-2026-68820, is described as a use-after-free issue in Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver functioning as the backbone for the Windows Sockets API. Microsoft says threat actors have been exploiting the security defect to elevate their privileges to System, without sharing details on the observed attacks. “A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition. Successful exploitation could allow the attacker to gain SYSTEM privileges. User interaction is not required,” the tech giant explains. According to Tenable senior staff research engineer Satnam Narang, based on historical tradecraft targeting afd.sys flaws, the CVE might have been exploited by nation-state threat actors. “Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group,” Narang said.Advertisement. Scroll to continue reading. As part of the August 2026 Patch Tuesday release, Microsoft also drew attention to CVE-2026-62832, an improper link resolution before file access (link following) bug in Windows’s User Profile Service, which could allow attackers to elevate their privileges locally. “An authenticated attacker who has credentials for another local account could run a specially crafted application to load another user’s registry hive. Successful exploitation could allow the attacker to access or modify another user’s data and gain administrator privileges. User interaction is not required,” Microsoft says. The tech giant flagged the security defect as publicly disclosed and believes that threat actors are likely to start exploiting it in attacks. CVE-2026-72971, a link following in the Windows Container Isolation FS Filter Driver (unionfs.sys) that could lead to local tampering, was also flagged as publicly disclosed, but Microsoft believes it is unlikely to be exploited in the wild. Other flaws that defenders should pay attention to include CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin Childs notes. In total, Microsoft’s August 2026 security updates resolve 236 vulnerabilities in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products. The updates also include fixes for two non-Microsoft CVEs, namely a spoofing bug (CVE-2026-6726) and an information disclosure issue (CVE-2026-6727) in the TPM 2.0 reference implementation. Related: Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws Related: Zoom Patches Zero-Click Code Execution Vulnerability Related: SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities Related: Microsoft, Apple Release Fresh Security Updates Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents BadMetabase Patches Vulnerability Exploited as Zero-DayCISA Urges Immediate Patching of Exploited Progress LoadMaster VulnerabilityCorporate Data Stolen in Levi Strauss CyberattackVishing Extortion Group UNC6671 Rebrands After Making MillionsMicrosoft, Apple Release Fresh Security Updates3.8 Million Impacted by Unlimited Technology Systems Data Breach Latest News Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic FlawsZoom Patches Zero-Click Code Execution VulnerabilityThe AI Governance Gap Is a Leadership Problem: Waiting Won’t Close ItSAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesUS Water Systems Get Cyber Boost From New Senate Bill and ‘Water Watch Center’Corma Raises $60 Million for Defensive Cybersecurity AI ModelExtension Banned for Stealing AI Chats Returns to Chrome Store, Resumes Malicious ActivitiesHacker Conversations: Marcus Hutchins and the Journey From the Gray Zone to Redemption Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the Move1Kosmos has named Frank Cohen Chief Revenue Officer.ServiceNow has appointed Simon Mouyal as Chief Marketing Officer.James Wilkinson has been named Chief Information Security Officer for the City of Dallas.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Faugust-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F12\u002FMicrosoft-Security-leaders.jpg","2026-08-11T18:46:07+00:00","2026-08-11T20:00:11.419366+00:00",9,[18,21,23,25,27,29],{"name":19,"type":20},"afd.sys","product",{"name":22,"type":20},"Windows Sockets API",{"name":24,"type":20},"Windows User Profile Service",{"name":26,"type":20},"Windows Container Isolation FS Filter Driver",{"name":28,"type":20},"Windows DNS server",{"name":30,"type":20},"Microsoft QUIC","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,64,67,70,73,76,79,82,85,88,91],{"type":56,"value":57,"context":58},"cve","CVE-2026-68820","Exploited zero-day use-after-free in afd.sys for SYSTEM privilege escalation.",{"type":56,"value":60,"context":61},"CVE-2025-32709","Previously exploited afd.sys zero-day.",{"type":56,"value":63,"context":61},"CVE-2025-21418",{"type":56,"value":65,"context":66},"CVE-2024-38193","Previously exploited afd.sys zero-day, linked to Lazarus group.",{"type":56,"value":68,"context":69},"CVE-2026-62832","Publicly disclosed improper link resolution in Windows User Profile Service for privilege escalation.",{"type":56,"value":71,"context":72},"CVE-2026-72971","Publicly disclosed link following in Windows Container Isolation FS Filter Driver.",{"type":56,"value":74,"context":75},"CVE-2026-62878","Remote code execution bug in Windows DNS server.",{"type":56,"value":77,"context":78},"CVE-2026-62893","Remote code execution bug in Windows Deployment Services TFTP server.",{"type":56,"value":80,"context":81},"CVE-2026-62815","Remote code execution bug in Microsoft QUIC.",{"type":56,"value":83,"context":84},"CVE-2026-59124","Remote code execution bug in Microsoft HPC Pack.",{"type":56,"value":86,"context":87},"CVE-2026-62911","Elevation of privilege in Exchange Server.",{"type":56,"value":89,"context":90},"CVE-2026-6726","Spoofing bug in TPM 2.0 reference implementation.",{"type":56,"value":92,"context":93},"CVE-2026-6727","Information disclosure issue in TPM 2.0 reference implementation."]