SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

The second Tuesday of August 2026 brought one of the largest Patch Tuesday releases in recent memory, with Microsoft shipping updates for 421 CVEs across Windows, Office, Azure, SharePoint, Exchange Server, and critical developer tools — including three zero-day vulnerabilities, one of which was actively exploited in the wild.

Aug 13, 2026By Bapanapalli Prem Sai Siddhik

Summary

Microsoft's August 2026 Patch Tuesday delivers security updates for 421 Microsoft CVEs, covering Windows, Microsoft Office, SharePoint Server, Azure services, Exchange Server, Developer Tools, and other enterprise products. This is one of the largest Patch Tuesday releases in recent years, with 62 vulnerabilities rated Critical.

The release addresses three zero-day vulnerabilities, one of which was actively exploited in the wild prior to the availability of patches. The actively exploited flaw (CVE-2026-68820) affects the Windows Ancillary Function Driver for WinSock and enables local privilege escalation to SYSTEM. The other two zero-days were publicly disclosed before the patch release.

Vulnerability Breakdown

Breakdown of the 421 vulnerabilities addressed:

Elevation of Privilege 176 (Critical: 18 · Important: 158)
Remote Code Execution 111 (Critical: 40 · Important: 71)
Information Disclosure 86 (Critical: 1 · Important: 85)
Spoofing 21 (Critical: 3 · Important: 17 · Moderate: 1)
Denial of Service 12 (Important: 12)
Security Feature Bypass 11 (Important: 11)
Tampering 4 (Important: 4)
Total: 421 Critical: 62 · Important: 358 · Moderate: 1

Zero-Day Vulnerabilities

Microsoft's August 2026 security release addresses three zero-day vulnerabilities. One was exploited in attacks before patches became available; the other two had been publicly disclosed.

Zero-Day Actively Exploited

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). A locally authenticated attacker can run a specially crafted application to trigger a race condition and potentially gain SYSTEM-level privileges.

Microsoft confirmed this vulnerability was exploited in the wild before the August update. Public reporting has attributed the activity to a known threat actor that used the flaw to deploy a kernel-mode rootkit.

Recommended Action: Prioritize patching this vulnerability immediately on all Windows systems. Treat as an emergency fix.

Zero-Day Publicly Disclosed

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege

CVE-2026-62832 is a link-following flaw in the Windows User Profile Service. An authenticated attacker can run a specially crafted application to load another user's registry hive, potentially leading to elevation to administrator privileges.

Public disclosure of this issue increases the risk of proof-of-concept development and subsequent exploitation attempts.

Zero-Day Publicly Disclosed

CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering

CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys). It is a link-following flaw that may allow an authenticated attacker to perform local tampering. This vulnerability is particularly relevant for organizations running Windows container workloads.

Critical Severity Vulnerabilities

The August update includes 62 Critical-rated vulnerabilities based on the CSV data. Three of these require no authentication and no user interaction:

Complete list of all 62 Critical-rated CVEs from the August 2026 update:

Affected Products

The August 2026 Patch Tuesday update covers a wide range of Microsoft products:

Windows All supported versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2025, 2022, 2019, 2016, 2012 R2, 2012), including Server Core installations.
Microsoft Office & Productivity Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise (32-bit and 64-bit), including Word, Excel, PowerPoint, Outlook, and Access.
Server and Cloud Products SharePoint Server 2016, 2019, and Subscription Edition; Exchange Server 2016, 2019, and Subscription Edition; Azure CycleCloud, Azure Storage Explorer, and Microsoft Entra Connect.
Developer Tools and Platforms .NET Core (8.0, 9.0, 10.0), .NET Framework 3.5 / 4.6.2–4.8.1; Visual Studio 2022 and 2026; Visual Studio Code and extensions; PowerShell 7.4, 7.5, and 7.6.
Other Enterprise & Productivity Software Microsoft Teams (iOS and Android), OneDrive for macOS, Power BI Report Server, Windows App Client, and Microsoft Dynamics 365 (on-premises) version 9.1.

Mitigation and Security Recommendations

  1. Deploy the August 2026 Microsoft security updates immediately.
    Use an accelerated deployment schedule for actively exploited vulnerabilities and exposed systems. Validate installation through centralized patch reporting and vulnerability scanning.
  2. Prioritize the actively exploited zero-day (CVE-2026-68820).
    This vulnerability should be patched immediately on all Windows systems. Treat this as an emergency fix.
  3. Address the three unauthenticated RCE flaws.
    Prioritize CVE-2026-62878 (Windows DNS), CVE-2026-62893 (Windows Deployment Services), and CVE-2026-62815 (Microsoft QUIC) for systems where these services are exposed or reachable.
  4. Restrict access to exposed services.
    Limit access to DNS, DHCP, RDP, and other critical network services to authorized subnets and users. Use network segmentation and firewalls to reduce attack surface.
  5. Monitor for exploitation indicators.
    Investigate unusual privilege changes, new administrator accounts, suspicious process execution, abnormal child processes, and unauthorized access to sensitive systems.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.

Featured Posts

Open Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws
Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

CVE Research

Cisco FMC Zero-Day Under Active Attack: UAT-12197, UAT-11823 and Qilin-Linked UAT-11988 Exploit Firewall Flaws

Sep 11, 2026

Open CVE-2026-87491: Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026
CVE-2026-87491: Google Fixes 7th Exploited Chrome Zero-Day of 2026

CVE Research

CVE-2026-87491: Google Patches Seventh Actively Exploited Chrome Zero-Day of 2026

Sep 10, 2026

Open Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release
Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release

CVE Research

Microsoft's September 2026 Patch Tuesday: 973 Vulnerabilities, Two Exploited Zero-Days and a Record Security Release

Microsoft's September 2026 Patch Tuesday addresses 973 vulnerabilities across Windows, Office, infrastructure services, virtualization components and other Microsoft products.

Sep 9, 2026

Open MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover
MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover

CVE Research

MikroTik RouterOS Under Attack: Critical SSH Vulnerabilities Enable Router Takeover

Sep 8, 2026