Table of Contents
Microsoft Patch Tuesday for August 2026 arrived with 421 CVEs patched — including 42 critical vulnerabilities and 3 zero-days, one of which was actively exploited in the wild by threat actors linked to North Korea’s Lazarus Group. The scale of the release and the severity of the exploited flaw make this Patch Tuesday a priority for every IT team running Microsoft infrastructure, from small businesses to enterprise environments.
Key Takeaway
- 📊 Scale: Microsoft patched 421 CVEs in August 2026 — 236 in Windows, 98 in Office, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, and 7 in Exchange Server. 42 were rated critical.
- 🔴 Zero-days: Three zero-day vulnerabilities were addressed: CVE-2026-68820 (actively exploited, linked to Lazarus Group), CVE-2026-62832 (publicly disclosed), and CVE-2026-72971 (publicly disclosed).
- ⚔️ The exploited flaw: CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) that grants SYSTEM-level privileges. It has been exploited by nation-state actors since at least 2022 through similar afd.sys flaws.
- 🛡️ TPM risk: Two non-Microsoft CVEs in the TPM 2.0 reference implementation (CVE-2026-6726, CVE-2026-6727) were also patched — affecting the Trusted Platform Module, the most security-critical hardware component in modern PCs.
- ⚡ Action: Deploy all August 2026 patches immediately. The actively exploited zero-day (CVE-2026-68820) and the publicly disclosed flaws (CVE-2026-62832, CVE-2026-72971) should be treated as emergency priorities.
Every month, Microsoft Patch Tuesday delivers a new set of vulnerabilities for IT teams to triage and deploy. Most months, the process is routine: prioritize critical items, test, deploy, verify. The August 2026 Microsoft Patch Tuesday is not a routine month. The combination of an actively exploited kernel-level zero-day with ties to North Korean threat actors, two additional publicly disclosed vulnerabilities, and a critical DNS server remote code execution flaw elevates this Microsoft Patch Tuesday from maintenance to emergency response. For security professionals, the question is not whether to patch — it is how quickly the patches can be deployed across all affected systems before threat actors reverse-engineer the fixes and build exploits for the publicly disclosed flaws.
The Exploited Zero-Day: CVE-2026-68820
The most urgent vulnerability in this Microsoft Patch Tuesday release is CVE-2026-68820, a use-after-free vulnerability in the Ancillary Function Driver for WinSock (afd.sys). This kernel-mode driver functions as the backbone for the Windows Sockets API — the interface that handles network communications for virtually every Windows application. A flaw in this driver is not a peripheral concern; it sits at the core of the Windows networking stack.
Microsoft confirmed that threat actors have been exploiting this vulnerability in the wild to elevate their privileges to SYSTEM — the highest privilege level on a Windows machine. The company’s advisory states: “A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition. Successful exploitation could allow the attacker to gain SYSTEM privileges. User interaction is not required.”
What makes CVE-2026-68820 particularly alarming is the threat actor behind it. Satnam Narang, senior staff research engineer at Tenable, noted that based on historical tradecraft targeting afd.sys flaws, the CVE was likely exploited by nation-state threat actors. “Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group,” Narang said.
The Lazarus Group connection is significant. North Korea’s state-sponsored hacking operation has demonstrated a consistent pattern of exploiting Windows kernel vulnerabilities as part of its financial theft campaigns — targeting banks, cryptocurrency exchanges, and financial infrastructure worldwide. The fact that the same class of vulnerability (afd.sys use-after-free) has been exploited four times since 2022, with at least one confirmed Lazarus attribution, suggests that this attack surface is well-understood by nation-state actors and will continue to be targeted. For organizations that have experienced the broader pattern of AI-era security threats, the Lazarus connection reinforces the need for rapid patching cycles.
The Publicly Disclosed Flaws
Beyond the actively exploited zero-day, Microsoft flagged two additional vulnerabilities as publicly disclosed — meaning proof-of-concept information is available, and threat actors are likely to begin exploiting them rapidly. CVE-2026-62832 is an improper link resolution vulnerability in the Windows User Profile Service. An authenticated attacker with credentials for another local account could run a specially crafted application to load another user’s registry hive, gaining access to that user’s data and potentially achieving administrator privileges. Microsoft believes threat actors are likely to start exploiting this flaw in attacks.
CVE-2026-72971 is a link following vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys) that could lead to local tampering. While Microsoft flagged this as publicly disclosed, the company believes it is unlikely to be exploited in the wild — a assessment that provides some comfort but does not eliminate the risk, particularly for organizations running containerized Windows workloads.
Both publicly disclosed flaws share a common characteristic: they require local authentication and local execution. This means they are primarily useful to attackers who have already gained initial access to a system — through phishing, credential theft, or another vulnerability — and are seeking to escalate privileges. In the context of a kill chain, these are privilege escalation steps, not initial access vectors. But in modern attack patterns, where attackers chain multiple vulnerabilities to achieve full system compromise, every link in the chain matters.
The Critical Flaws Beyond the Zero-Days
The 42 critical vulnerabilities in this Microsoft Patch Tuesday release include several that deserve specific attention from IT teams. CVE-2026-62878 is a remote code execution vulnerability in the Windows DNS server, scored at 9.8 on the CVSS scale. The attack vector is over the network, the attack complexity is low, no privileges are required, and no user interaction is needed. In practical terms, this means an unauthenticated attacker could send a crafted request to a Windows DNS server and achieve remote code execution — potentially taking control of the server and every system that depends on it for name resolution.
For organizations running their own DNS infrastructure on Windows Server, this vulnerability is a priority. DNS servers are typically internet-facing, which means the attack surface is exposed to the entire internet, not just authenticated internal users. A compromised DNS server can be used to redirect traffic, intercept communications, and pivot into the internal network — making this flaw potentially more dangerous than the locally-exploited zero-day, despite receiving less attention.
Other critical flaws include CVE-2026-62893 (RCE in Windows Deployment Services TFTP server), CVE-2026-62815 (RCE in Microsoft QUIC), CVE-2026-59124 (RCE in Microsoft HPC Pack), and CVE-2026-62911 (elevation of privilege in Exchange Server). Each of these represents a distinct attack vector that could be chained with the privilege escalation flaws to achieve full domain compromise in an enterprise environment. The growing sophistication of email-based attacks makes the Exchange Server vulnerability particularly concerning for organizations that have not yet migrated to cloud-based email.
The TPM 2.0 Vulnerabilities
The August 2026 Microsoft Patch Tuesday also included fixes for two non-Microsoft CVEs that deserve attention: CVE-2026-6726 (a spoofing vulnerability) and CVE-2026-6727 (an information disclosure vulnerability) in the TPM 2.0 reference implementation. The Trusted Platform Module is the hardware component responsible for the most security-critical functions on a modern PC — cryptographic key storage, secure boot verification, and hardware-based attestation. A vulnerability in the TPM reference implementation affects every system that uses a TPM conforming to that specification.
While Microsoft rated these as Important rather than Critical, the significance of TPM vulnerabilities extends beyond the CVSS score. The TPM is designed to be the most trusted component in a computer — the hardware root of trust. If that trust is compromised, the entire security model of the system is undermined. Organizations that rely on TPM-based features such as BitLocker, Windows Hello for Business, Virtual Smart Cards, and measured boot should treat these patches as a priority, even though they are not rated Critical.
The Breakdown by Product
The 421 CVEs patched in this Microsoft Patch Tuesday are distributed across Microsoft’s product portfolio in a pattern that reflects where the most code complexity — and therefore the most attack surface — exists. Windows accounts for 236 vulnerabilities, more than half the total. Office and Office 2016 each account for 98 vulnerabilities — a significant number that reflects the complexity of the Office document parsing engine and its long history of being targeted by attackers. SharePoint Server accounts for 30, Developer Tools for 26, Azure for 17, Exchange Server for 7, and Defender for 1.
The SharePoint Server count is particularly relevant because CISA separately warned that a previously disclosed Microsoft SharePoint vulnerability is now being actively exploited in ransomware attacks. While this specific SharePoint flaw may have been addressed in a previous patch cycle, the fact that ransomware operators are actively targeting SharePoint vulnerabilities means that any outstanding SharePoint patches should be treated as urgent.
For IT teams, the product breakdown provides a triage framework. Windows and Office patches should be deployed first — they represent the largest attack surface and the most commonly exploited components. SharePoint Server patches are next, given the active ransomware exploitation. Azure and Exchange Server patches follow, with Developer Tools and Defender completing the list. However, every organization should assess its own risk profile: an organization running Exchange Server on-premises should prioritize the Exchange patch regardless of its position in a general triage hierarchy.
What This Means for IT Teams
For IT teams worldwide, the August 2026 Microsoft Patch Tuesday is a reminder that patching is not optional and delay is not a strategy. The actively exploited zero-day (CVE-2026-68820) means that threat actors are already using this vulnerability in real attacks. The publicly disclosed flaws mean that exploit code for CVE-2026-62832 and CVE-2026-72971 will likely appear in exploit kits and criminal tooling within days to weeks. The critical DNS server vulnerability means that internet-facing infrastructure is at risk from unauthenticated remote attacks.
The recommended approach is to deploy all critical patches immediately, followed by the important patches within the standard patching window. For the actively exploited zero-day, do not wait for the normal patching cycle — deploy the afd.sys patch as an emergency out-of-band update. For the DNS server vulnerability, if your organization runs Windows DNS servers exposed to the internet, treat this as a critical infrastructure risk and patch before the next business day.
Testing is important, but the risk of an actively exploited kernel zero-day outweighs the risk of a patch causing compatibility issues. If testing reveals problems, the patch should be deployed to a pilot group first, then rolled out to the full environment as quickly as possible. Organizations that have invested in incident response planning should activate their patch deployment procedures now. For those looking to strengthen their broader security posture against this class of threat, reviewing comprehensive cybersecurity defense frameworks provides additional context on how patching fits into a defense-in-depth strategy.
The Bigger Trend
The August 2026 Microsoft Patch Tuesday is not an isolated event. It is part of a pattern in which Microsoft Patch Tuesday consistently delivers 400+ CVEs, with at least one actively exploited zero-day in many months. The afd.sys vulnerability is the fourth use-after-free flaw in this specific driver to be exploited since 2022 — a pattern that suggests the driver’s design or implementation has systemic weaknesses that continue to be discovered and exploited by nation-state actors.
For security professionals, the recurring pattern of afd.sys exploitation highlights the importance of kernel-level attack surface reduction. While patching addresses known vulnerabilities, the underlying issue — that a single kernel-mode driver responsible for network socket operations has been repeatedly exploited — suggests that architectural changes may be needed in the long term. In the short term, organizations should consider deploying kernel-level exploit mitigation tools (such as Microsoft’s Attack Surface Reduction rules in Defender for Endpoint) that can detect and block suspicious behavior patterns associated with kernel privilege escalation, even when the specific vulnerability is not yet known. The connection between AI regulation debates and the broader cybersecurity landscape is also relevant here — as AI-powered tools increasingly automate vulnerability discovery and exploitation, the patching window will continue to shrink.
Frequently Asked Questions About Microsoft Patch Tuesday August 2026
How many vulnerabilities did Microsoft patch in August 2026?
Microsoft Patch Tuesday for August 2026 addressed 421 CVEs across its product portfolio, including 42 rated critical. The breakdown: 236 in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products. Two non-Microsoft TPM 2.0 vulnerabilities were also patched in this Microsoft Patch Tuesday release.
Which zero-day was actively exploited in the August 2026 Patch Tuesday?
CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), was actively exploited in the wild. The vulnerability allows a locally authenticated attacker to gain SYSTEM privileges. Tenable researcher Satnam Narang attributed the exploitation to nation-state actors, noting that the same afd.sys driver has been exploited four times since 2022, with at least one instance linked to North Korea’s Lazarus Group.
What is CVE-2026-62832 and why is it concerning?
CVE-2026-62832 is an improper link resolution vulnerability in the Windows User Profile Service. An authenticated attacker with credentials for another local account could load that user’s registry hive and gain access to their data or administrator privileges. Microsoft flagged this vulnerability as publicly disclosed, meaning exploit information is available and threat actors are likely to begin exploiting it in attacks.
What is the TPM 2.0 vulnerability patched in August 2026?
Microsoft patched two non-Microsoft CVEs in the TPM 2.0 reference implementation: CVE-2026-6726 (spoofing) and CVE-2026-6727 (information disclosure). The Trusted Platform Module is the hardware root of trust in modern PCs, responsible for cryptographic key storage and secure boot verification. While rated Important rather than Critical, vulnerabilities in the TPM undermine the entire security model of affected systems.
Which is the most critical vulnerability in the August 2026 Patch Tuesday?
Beyond the actively exploited zero-day (CVE-2026-68820), CVE-2026-62878 is a critical remote code execution vulnerability in the Windows DNS server scored at 9.8 CVSS. It can be exploited over the network with low complexity, no privileges, and no user interaction — making it potentially more dangerous than the locally-exploited zero-day for organizations running internet-facing DNS servers. This flaw is one of the highest-severity items in the August 2026 Microsoft Patch Tuesday release.
How quickly should organizations deploy the August 2026 patches?
Organizations should deploy the patch for CVE-2026-68820 (actively exploited zero-day) as an emergency out-of-band update. The DNS server vulnerability (CVE-2026-62878) should be patched before the next business day for internet-facing DNS servers. The publicly disclosed flaws (CVE-2026-62832, CVE-2026-72971) should be patched within the standard patching window, recognizing that exploit code will likely appear quickly. All remaining critical patches should follow standard deployment procedures.
Why does the afd.sys driver keep being exploited?
The Windows Ancillary Function Driver for WinSock (afd.sys) has been exploited four times since 2022 through use-after-free vulnerabilities. The driver operates in kernel mode and handles network socket operations for all Windows applications. The repeated exploitation pattern suggests systemic design or implementation weaknesses in the driver that continue to be discovered by both researchers and threat actors, particularly nation-state groups like North Korea’s Lazarus Group.
Sources: SecurityWeek, BleepingComputer, Zero Day Initiative, Microsoft Security Response Center
