Microsoft 's August Patch Tuesday brings one of the largest patch cycles of 2026, with hundreds of CVEs in Windows and other products. Among them is CVE-2026-68820, a vulnerability in the afd.sys driver that attackers are already exploiting to gain SYSTEM privileges.
Counts vary depending on the scope of the products and how the fixes are grouped. SecurityWeek lists 421 CVEs, while Krebs on Security and The Hacker News report 398 and 398 respectively. BleepingComputer talks about 400 vulnerabilities and three zero-days, but all sources agree that immediate prioritization is needed.
The difference in numbers doesn't change the practical conclusion: IT teams should prioritize the actively exploited driver and servers that are accessible from the internet. A staged deployment, with backups and critical business functions checked, limits the risk of downtime.
See also: Microsoft Planetary Computer Pro: CVE-2026-63508 without authentication
Microsoft Patch Tuesday August and the afd.sys driver
CVE -2026-68820 is a use-after-free vulnerability in the Ancillary Function Driver for WinSock, known as afd.sys. The driver operates at the kernel level and supports Windows network sockets functions. Microsoft has identified it as a vulnerability that is actively being exploited by attackers.
The attack is not an initial remote login. The attacker needs to have already executed code on the computer, usually through a previous compromise or phishing. They then execute a specially crafted application and cause a race condition in the driver to elevate their privileges to SYSTEM level, without requiring any action from the user.
The CVSS score is 7.0, but the active exploitation makes it more urgent than some remote vulnerabilities with higher theoretical scores. Microsoft did not provide details about the attacks. Check Point, according to reports from The Hacker News and BleepingComputer, linked its use to the Lazarus group and the development of a kernel-level rootkit.
Critical remote vulnerabilities in Windows
The same cycle includes four remote code execution vulnerabilities with a CVSS score of 9.8. CVE-2026-62878 affects Windows DNS Server, CVE-2026-62893 Windows Deployment Services, CVE-2026-62815 affects Microsoft QUIC implementation, and CVE-2026-59124 affects HPC Pack.
These vulnerabilities do not require an account or user interaction, but actual exposure depends on whether the corresponding services are installed and accessible from the network. Administrators should review the exposure of DNS, TFTP, and QUIC services, as well as any HPC Pack installations, before determining the order of deployment of updates.
According to SecurityWeek's analysis, most of the fixes are for Windows, while a significant number cover Office and SharePoint Server. This picture shows that the update is not limited to workstations, but also touches critical server roles that often remain exposed for a longer period of time.
See also: Microsoft 365 AitM Phishing: Collects Payroll and Finance Emails
The two publicly known vulnerabilities
CVE -2026-62832 affects the Windows User Profile service and allows an authenticated local user to load the registry hive of another account. This could allow them to access or modify data and gain administrative privileges. Microsoft believes that further exploit attempts are likely.
The second publicly known vulnerability, CVE-2026-72971, is in the unionfs.sys filter of Windows Container Isolation and involves local spoofing. Microsoft considers it less likely to be exploited in real-world attacks, but the disclosure of the technical details increases the value of timely patching.
Organizations using SharePoint Server should also confirm that they have installed both the July authentication bypass fix and the new August code execution fix. The combination of the two vulnerabilities had been used to allow unauthenticated remote code execution on on-premises installations.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Windows Hello for Business: Malware for persistent access to Entra ID
What should administrators do?
The SecNews technical team recommends an immediate inventory of Windows versions, server roles, and services exposed to the internet. Updates should be tested in a representative environment and deployed first to systems where there is an active exploit or unnecessary external exposure.
At the same time, security teams should look for unusual application execution from local accounts, elevation of privilege attempts, and suspicious registry loading. Microsoft’s August Patch Tuesday is not just a large number of fixes; it’s a reminder that update speed must be combined with proper assessment of each organization’s exposure.
