SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

The second Tuesday of August 2026 brought one of the largest Patch Tuesday releases in recent memory, with Microsoft shipping updates for 421 CVEs across Windows, Office, Azure, SharePoint, Exchange Server, and critical developer tools — including three zero-day vulnerabilities, one of which was actively exploited in the wild.

Aug 13, 2026By Bapanapalli Prem Sai Siddhik

Summary

Microsoft's August 2026 Patch Tuesday delivers security updates for 421 Microsoft CVEs, covering Windows, Microsoft Office, SharePoint Server, Azure services, Exchange Server, Developer Tools, and other enterprise products. This is one of the largest Patch Tuesday releases in recent years, with 62 vulnerabilities rated Critical.

The release addresses three zero-day vulnerabilities, one of which was actively exploited in the wild prior to the availability of patches. The actively exploited flaw (CVE-2026-68820) affects the Windows Ancillary Function Driver for WinSock and enables local privilege escalation to SYSTEM. The other two zero-days were publicly disclosed before the patch release.

Vulnerability Breakdown

Breakdown of the 421 vulnerabilities addressed:

Elevation of Privilege 176 (Critical: 18 · Important: 158)
Remote Code Execution 111 (Critical: 40 · Important: 71)
Information Disclosure 86 (Critical: 1 · Important: 85)
Spoofing 21 (Critical: 3 · Important: 17 · Moderate: 1)
Denial of Service 12 (Important: 12)
Security Feature Bypass 11 (Important: 11)
Tampering 4 (Important: 4)
Total: 421 Critical: 62 · Important: 358 · Moderate: 1

Zero-Day Vulnerabilities

Microsoft's August 2026 security release addresses three zero-day vulnerabilities. One was exploited in attacks before patches became available; the other two had been publicly disclosed.

Zero-Day Actively Exploited

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). A locally authenticated attacker can run a specially crafted application to trigger a race condition and potentially gain SYSTEM-level privileges.

Microsoft confirmed this vulnerability was exploited in the wild before the August update. Public reporting has attributed the activity to a known threat actor that used the flaw to deploy a kernel-mode rootkit.

Recommended Action: Prioritize patching this vulnerability immediately on all Windows systems. Treat as an emergency fix.

Zero-Day Publicly Disclosed

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege

CVE-2026-62832 is a link-following flaw in the Windows User Profile Service. An authenticated attacker can run a specially crafted application to load another user's registry hive, potentially leading to elevation to administrator privileges.

Public disclosure of this issue increases the risk of proof-of-concept development and subsequent exploitation attempts.

Zero-Day Publicly Disclosed

CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering

CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys). It is a link-following flaw that may allow an authenticated attacker to perform local tampering. This vulnerability is particularly relevant for organizations running Windows container workloads.

Critical Severity Vulnerabilities

The August update includes 62 Critical-rated vulnerabilities based on the CSV data. Three of these require no authentication and no user interaction:

Complete list of all 62 Critical-rated CVEs from the August 2026 update:

Affected Products

The August 2026 Patch Tuesday update covers a wide range of Microsoft products:

Windows All supported versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2025, 2022, 2019, 2016, 2012 R2, 2012), including Server Core installations.
Microsoft Office & Productivity Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise (32-bit and 64-bit), including Word, Excel, PowerPoint, Outlook, and Access.
Server and Cloud Products SharePoint Server 2016, 2019, and Subscription Edition; Exchange Server 2016, 2019, and Subscription Edition; Azure CycleCloud, Azure Storage Explorer, and Microsoft Entra Connect.
Developer Tools and Platforms .NET Core (8.0, 9.0, 10.0), .NET Framework 3.5 / 4.6.2–4.8.1; Visual Studio 2022 and 2026; Visual Studio Code and extensions; PowerShell 7.4, 7.5, and 7.6.
Other Enterprise & Productivity Software Microsoft Teams (iOS and Android), OneDrive for macOS, Power BI Report Server, Windows App Client, and Microsoft Dynamics 365 (on-premises) version 9.1.

Mitigation and Security Recommendations

  1. Deploy the August 2026 Microsoft security updates immediately.
    Use an accelerated deployment schedule for actively exploited vulnerabilities and exposed systems. Validate installation through centralized patch reporting and vulnerability scanning.
  2. Prioritize the actively exploited zero-day (CVE-2026-68820).
    This vulnerability should be patched immediately on all Windows systems. Treat this as an emergency fix.
  3. Address the three unauthenticated RCE flaws.
    Prioritize CVE-2026-62878 (Windows DNS), CVE-2026-62893 (Windows Deployment Services), and CVE-2026-62815 (Microsoft QUIC) for systems where these services are exposed or reachable.
  4. Restrict access to exposed services.
    Limit access to DNS, DHCP, RDP, and other critical network services to authorized subnets and users. Use network segmentation and firewalls to reduce attack surface.
  5. Monitor for exploitation indicators.
    Investigate unusual privilege changes, new administrator accounts, suspicious process execution, abnormal child processes, and unauthorized access to sensitive systems.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.

Featured Posts

Open F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws
vulnerability researchF5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

CVE Research

F5 Strengthens NGINX Security with Fixes for Critical Code Execution Flaws

Oct 19, 2026

Open Silent Lynx Hits CIS Governments With WinRAR Flaw
threat intelligenceSilent Lynx Hits CIS Governments With WinRAR Flaw

CVE Research

Silent Lynx Hits CIS Governments With WinRAR Flaw

Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.

Oct 16, 2026

Open Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution
Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

CVE Research

Drupal Fixes Critical Field UI Flaw Linked to Remote Code Execution

A critical vulnerability in Drupal core's Field UI module could allow attackers to execute arbitrary code on vulnerable websites through exposed contributed modules or custom code. Tracked as CVE-2026-108097, the flaw stems from improper validation of PHP callbacks during table rendering. At least one known exploitation path does not require authentication, potentially putting affected websites at risk of server compromise.

Oct 16, 2026

Open Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution
vulnerability researchPalo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

CVE Research

Palo Alto PAN-OS Vulnerability CVE-2026-0322 Could Allow Root-Level Code Execution

Oct 15, 2026