Microsoft's August 2026 Patch Tuesday delivers security updates for 400 vulnerabilities, including one flaw already exploited in attacks and two more disclosed publicly before patches shipped. Of the total, 42 are rated Critical — 37 of them remote code execution and five elevation of privilege. Microsoft expects such large update batches to keep coming, saying an AI-powered vulnerability discovery system is surfacing more bugs across its products.

Patch Tuesday scope and severity breakdown

The August release covers a wide spread of vulnerability classes, with the approximate counts per category as follows:

  • 176 Elevation of Privilege Vulnerabilities
  • 11 Security Feature Bypass Vulnerabilities
  • 110 Remote Code Execution Vulnerabilities
  • 86 Information Disclosure Vulnerabilities

As with every Patch Tuesday, these totals count only fixes Microsoft shipped today. Flaws addressed earlier in the month across Mariner, Microsoft Teams, Microsoft Azure, Microsoft Entra, Microsoft Office, and Power Apps are not included. While this month is smaller than July's record batch of 570 flaws, it remains substantially larger than the months before that.

Non-security improvements landed alongside the patches in the Windows 11 KB5121003 and KB5120240 cumulative updates and the Windows 10 KB5120249 extended security update.

The actively exploited zero-day: CVE-2026-68820

The most urgent fix targets a use-after-free in the Windows Ancillary Function Driver for WinSock (AFD.sys) that Microsoft describes as allowing an authorized attacker to elevate privileges locally. Per Microsoft, a locally authenticated attacker can run a specially crafted application to trigger a race condition; successful exploitation grants SYSTEM privileges and requires no user interaction.

The bug was credited to Moshe Marelus and David Driker of Check Point, whose report says the flaw was used in zero-day attacks by the North Korean Lazarus group. According to Check Point, during the intrusion the actors exploited CVE-2026-68820 in the AFD.sys driver to deploy a new version of FudModule, Lazarus' kernel-mode rootkit. Microsoft has not disclosed technical details of how the flaw was exploited.

Publicly disclosed zero-days

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege. Microsoft says the root cause is improper link resolution before file access ("link following") in the Windows User Profile service, which allows local privilege escalation. An authenticated attacker with credentials for another local account can run a specially crafted application to load that user's registry hive, then access or modify the other user's data and gain administrator privileges — again without user interaction. Although Microsoft attributed the finding to an anonymous researcher, the details line up with a vulnerability called "LegacyHive" disclosed last month by researcher Nightmare Eclipse. Tharros principal vulnerability analyst Will Dormann previously observed that non-admin users could exploit LegacyHive to modify a registry hive and launch commands with administrative privileges whenever the admin account logs into the compromised device.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering. The second publicly known zero-day involves improper link resolution before file access ("link following") in the Container Isolation FS Filter Driver, permitting an authorized attacker to perform tampering locally. Microsoft attributed the discovery to yhw & txz but shared no details on where the flaw was disclosed.

Other vendor updates in August 2026

Beyond Microsoft, several vendors shipped fixes or advisories this month:

  • Adobe — security updates for ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Campaign Classic.
  • Cisco — patches across numerous products, including Cisco Catalyst SD-WAN, IOS, IOS XE, and ClamAV flaws with public exploits.
  • Metabase — a fix for a critical SQL injection flaw exploited in data-theft attacks.
  • N-able — an update for an actively exploited authentication bypass (CVE-2026-18577) affecting hosted and on-premises N-central servers.
  • SAP — August security updates across products, including a 10.0-severity improper authorization flaw in SAP Commerce Cloud (Data Hub Adapter).
  • TP-Link — 15 patches for flaws in the zero-touch provisioning (ZTP) mechanism of its Omada network devices that could enable RCE.
  • VMware — updates for VMware Avi Load Balancer covering authentication bypasses and remote code execution flaws.

Technical background

For readers new to these bug classes, it helps to know how the two themes in this Patch Tuesday work in general.

Link-following (junction/symlink) privilege escalation is a classic Windows technique. Programs that write files or open registry hives using attacker-influenced paths can be redirected through a junction or symbolic link to a location the attacker controls. A non-privileged user can create a link such as:


mklink /J C:\Users\victim\AppData\Local\Custom C:\Users\attacker\payload

If a privileged service later follows that path when processing another user's profile or hive, the attacker's content is written or read with elevated rights. The "LegacyHive" style of issue is this family applied to the registry hive-loading logic in the User Profile service.

Use-after-free in a kernel driver occurs when a driver keeps referencing memory it has already freed. An attacker who can race the free and reallocation can often redirect control flow or corrupt structures the kernel trusts. In an ancillary-function driver like AFD.sys, this class of bug can turn a locally authenticated caller into a SYSTEM process, which is exactly why such flaws are treated as critical even when user interaction is absent.

References