Microsoft’s August 2026 Patch Tuesday update cycle is a substantial one: the company disclosed patches for 421 CVEs, and it also highlighted a critical weakness that has already been used in real-world attacks as a zero-day. For security teams, the message is clear—this release deserves prompt testing and deployment, especially where Windows systems rely on network stack components and user privilege boundaries.
Below, you’ll find a practical overview of what Microsoft fixed, which vulnerabilities stand out, and how defenders can prioritize patching across Windows and related products.
The zero-day spotlight: CVE-2026-68820 in afd.sys
The most urgent issue in this August 2026 Patch Tuesday release is tracked as CVE-2026-68820. Microsoft describes it as a use-after-free condition in Ancillary Function Driver for WinSock (afd.sys), a kernel-mode driver that underpins the Windows Sockets API.
Microsoft states that threat actors are exploiting the defect to elevate privileges to System. Importantly for incident response, the company indicates that the attack does not require user interaction.
In Microsoft’s account, a locally authenticated attacker could run a specially crafted application to trigger a race condition. If successful, the attacker can gain SYSTEM privileges. That combination—local authenticated access plus no user interaction—often means attackers can operate through stolen credentials or other footholds, and defenders should treat it as a high-priority escalation risk.
Why afd.sys matters: history of exploited winsock driver flaws
Security researcher Satnam Narang from Tenable offered additional context by referencing previous real-world activity affecting afd.sys. He noted that since 2022, there have been multiple afd.sys zero-days exploited in the wild.
Narang specifically mentioned three earlier exploited examples: CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. He also reported that CVE-2024-38193 was exploited by threat actors associated with the Lazarus group.
Based on this historical targeting pattern, Narang suggests that CVE-2026-68820 could also involve nation-state level actors. While organizations can’t confirm the actor in every case, the pattern is useful for planning: when a component has a track record of exploitation, patching urgency typically increases.
Another local privilege escalation risk: CVE-2026-62832
Microsoft also called out CVE-2026-62832, which involves improper link resolution before file access (commonly referred to as link following) in Windows’s User Profile Service.
According to Microsoft, an authenticated attacker with credentials for another local account could run a specially crafted application to load another user’s registry hive. A successful exploit may allow attackers to access or modify another user’s data and then gain administrator privileges.
As with the afd.sys issue, Microsoft states that user interaction is not required. For defenders, that means credential hygiene and lateral movement controls become just as important as patching—because the exploit path depends on authenticated conditions.
Other items Microsoft flagged for defenders
Beyond the two major callouts above, Microsoft and third-party commentary also highlighted several additional vulnerabilities that defenders should track. Some are publicly disclosed, which can accelerate attacker interest even if immediate exploitation is not confirmed.
Publicly disclosed link following: CVE-2026-72971
CVE-2026-72971 is a link following issue in the Windows Container Isolation FS Filter Driver (unionfs.sys). Microsoft flagged it as publicly disclosed and indicated that it could enable local tampering.
However, Microsoft believes it is unlikely to be exploited in the wild. Even so, teams often still include such items in their internal risk assessments, especially in environments that use container isolation features.
Additional CVEs to prioritize: RCE and elevation paths
Security researcher Dustin Childs from ZDI pointed to several other vulnerabilities that organizations should pay attention to. These include potential remote code execution (RCE) weaknesses in:
- Windows DNS server (CVE-2026-62878)
- Windows Deployment Services TFTP server (CVE-2026-62893)
- Microsoft QUIC (CVE-2026-62815)
- Microsoft HPC Pack (CVE-2026-59124)
Childs also noted CVE-2026-62911, described as an EoP (elevation of privilege) in Exchange Server. While this article doesn’t list the exploitation requirements, elevation vulnerabilities in mail systems are typically treated as urgent due to the value of the target and the potential for privilege misuse after compromise.
Scope of the August 2026 updates
Microsoft’s August 2026 Patch Tuesday release resolves a large number of vulnerabilities across multiple product areas. In total, the update addresses:
- 236 vulnerabilities in Windows
- 98 in Office
- 98 in Office 2016
- 30 in SharePoint Server
- 26 in Developer Tools
- 17 in Azure
- 7 in Exchange Server
- 1 in Defender
- 6 in other products
That breakdown matters for planning, because it reflects how widely the release may affect patch cadence and testing requirements across departments (for example, endpoints, collaboration platforms, developer environments, and cloud services).
Non-Microsoft vulnerabilities included
Alongside Microsoft-authored fixes, the release also includes patches for two non-Microsoft CVEs in the TPM 2.0 reference implementation. Microsoft listed:
- CVE-2026-6726, a spoofing issue
- CVE-2026-6727, an information disclosure vulnerability
Even when TPM-related issues are less visible to everyday users, they can still be important for organizations that rely on hardware-backed security features.
What defenders should do next
Given that CVE-2026-68820 was exploited as a zero-day, the most defensible approach is to treat this August 2026 Patch Tuesday rollout as time-sensitive. Start by identifying systems exposed to local authenticated threats and any workloads that depend on network stack drivers and user profile operations.
Then, move through a standard response workflow:
- Validate patch eligibility for your Windows versions and critical roles (DNS, deployment services, container isolation scenarios).
- Prioritize high-impact escalation paths, particularly afd.sys and User Profile Service related issues.
- Monitor for signs of exploitation consistent with local privilege escalation activity, especially where credentials may already be compromised.
- Stage deployments using your normal test rings, without unduly delaying the most critical environments.
While some issues in the release may be less likely to see immediate exploitation—Microsoft’s view of CVE-2026-72971 is one example—this type of large bulletin is where attackers often pivot quickly once patches are available.
Conclusion
The August 2026 Patch Tuesday release is significant both in volume and in urgency. Microsoft patched 421 CVEs, including a use-after-free in afd.sys labeled as a zero-day already exploited in the wild (CVE-2026-68820). In addition, the bulletin includes other privilege escalation and RCE risks across Windows and server components.
If you manage Windows infrastructure, the best next step is to prioritize these updates according to exploit likelihood and exposure, then expand deployment coverage across Office, server products, and related environments as appropriate.
