SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

The second Tuesday of August 2026 brought one of the largest Patch Tuesday releases in recent memory, with Microsoft shipping updates for 421 CVEs across Windows, Office, Azure, SharePoint, Exchange Server, and critical developer tools — including three zero-day vulnerabilities, one of which was actively exploited in the wild.

Aug 13, 2026By Bapanapalli Prem Sai Siddhik

Summary

Microsoft's August 2026 Patch Tuesday delivers security updates for 421 Microsoft CVEs, covering Windows, Microsoft Office, SharePoint Server, Azure services, Exchange Server, Developer Tools, and other enterprise products. This is one of the largest Patch Tuesday releases in recent years, with 62 vulnerabilities rated Critical.

The release addresses three zero-day vulnerabilities, one of which was actively exploited in the wild prior to the availability of patches. The actively exploited flaw (CVE-2026-68820) affects the Windows Ancillary Function Driver for WinSock and enables local privilege escalation to SYSTEM. The other two zero-days were publicly disclosed before the patch release.

Vulnerability Breakdown

Breakdown of the 421 vulnerabilities addressed:

Elevation of Privilege 176 (Critical: 18 · Important: 158)
Remote Code Execution 111 (Critical: 40 · Important: 71)
Information Disclosure 86 (Critical: 1 · Important: 85)
Spoofing 21 (Critical: 3 · Important: 17 · Moderate: 1)
Denial of Service 12 (Important: 12)
Security Feature Bypass 11 (Important: 11)
Tampering 4 (Important: 4)
Total: 421 Critical: 62 · Important: 358 · Moderate: 1

Zero-Day Vulnerabilities

Microsoft's August 2026 security release addresses three zero-day vulnerabilities. One was exploited in attacks before patches became available; the other two had been publicly disclosed.

Zero-Day Actively Exploited

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). A locally authenticated attacker can run a specially crafted application to trigger a race condition and potentially gain SYSTEM-level privileges.

Microsoft confirmed this vulnerability was exploited in the wild before the August update. Public reporting has attributed the activity to a known threat actor that used the flaw to deploy a kernel-mode rootkit.

Recommended Action: Prioritize patching this vulnerability immediately on all Windows systems. Treat as an emergency fix.

Zero-Day Publicly Disclosed

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege

CVE-2026-62832 is a link-following flaw in the Windows User Profile Service. An authenticated attacker can run a specially crafted application to load another user's registry hive, potentially leading to elevation to administrator privileges.

Public disclosure of this issue increases the risk of proof-of-concept development and subsequent exploitation attempts.

Zero-Day Publicly Disclosed

CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering

CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys). It is a link-following flaw that may allow an authenticated attacker to perform local tampering. This vulnerability is particularly relevant for organizations running Windows container workloads.

Critical Severity Vulnerabilities

The August update includes 62 Critical-rated vulnerabilities based on the CSV data. Three of these require no authentication and no user interaction:

Complete list of all 62 Critical-rated CVEs from the August 2026 update:

Affected Products

The August 2026 Patch Tuesday update covers a wide range of Microsoft products:

Windows All supported versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2025, 2022, 2019, 2016, 2012 R2, 2012), including Server Core installations.
Microsoft Office & Productivity Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise (32-bit and 64-bit), including Word, Excel, PowerPoint, Outlook, and Access.
Server and Cloud Products SharePoint Server 2016, 2019, and Subscription Edition; Exchange Server 2016, 2019, and Subscription Edition; Azure CycleCloud, Azure Storage Explorer, and Microsoft Entra Connect.
Developer Tools and Platforms .NET Core (8.0, 9.0, 10.0), .NET Framework 3.5 / 4.6.2–4.8.1; Visual Studio 2022 and 2026; Visual Studio Code and extensions; PowerShell 7.4, 7.5, and 7.6.
Other Enterprise & Productivity Software Microsoft Teams (iOS and Android), OneDrive for macOS, Power BI Report Server, Windows App Client, and Microsoft Dynamics 365 (on-premises) version 9.1.

Mitigation and Security Recommendations

  1. Deploy the August 2026 Microsoft security updates immediately.
    Use an accelerated deployment schedule for actively exploited vulnerabilities and exposed systems. Validate installation through centralized patch reporting and vulnerability scanning.
  2. Prioritize the actively exploited zero-day (CVE-2026-68820).
    This vulnerability should be patched immediately on all Windows systems. Treat this as an emergency fix.
  3. Address the three unauthenticated RCE flaws.
    Prioritize CVE-2026-62878 (Windows DNS), CVE-2026-62893 (Windows Deployment Services), and CVE-2026-62815 (Microsoft QUIC) for systems where these services are exposed or reachable.
  4. Restrict access to exposed services.
    Limit access to DNS, DHCP, RDP, and other critical network services to authorized subnets and users. Use network segmentation and firewalls to reduce attack surface.
  5. Monitor for exploitation indicators.
    Investigate unusual privilege changes, new administrator accounts, suspicious process execution, abnormal child processes, and unauthorized access to sensitive systems.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.

Featured Posts

Open Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras
Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras

CVE Research

Operation CameraSwarm: Inside the Toolkit Behind 14,530 Compromised Dahua Cameras

A single operator compromised 14,530+ Dahua cameras across Ukraine and Russia in 35 days, chaining credential brute-force, a CVE-2021-33044/33045 authentication bypass, and P2P relay abuse to plant a persistent backdoor and harvest transferable admin access.

Aug 21, 2026

Open Critical GitLab Flaw Exposes Public Projects to Deletion — Two CVEs Patched, Including High-Severity CSRF
Critical GitLab Flaw Exposes Public Projects to Deletion — Two CVEs Patched, Including High-Severity CSRF

CVE Research

Critical GitLab Flaw Exposes Public Projects to Deletion — Two CVEs Patched, Including High-Severity CSRF

CVE-2026-19478 is a critical code injection vulnerability in GitLab CE/EE that allows an unauthenticated attacker to modify or delete public projects and user data by abusing a GraphQL directive. A second high-severity issue, CVE-2026-19650, involves cross-site request forgery in the GraphQL multiplex query handler. This article examines how the critical vulnerability works, the availability of a public proof-of-concept, the potential impact on self-managed instances, the affected versions, and the security updates released to remediate both issues.

Aug 19, 2026

Open No Password Needed: macOS Screen Sharing Flaw (CVE-2026-65400) Used to Deploy Monero Miners
No Password Needed: macOS Screen Sharing Flaw (CVE-2026-65400) Used to Deploy Monero Miners

CVE Research

No Password Needed: macOS Screen Sharing Flaw (CVE-2026-65400) Used to Deploy Monero Miners

Aug 19, 2026

Open Evooo1Bot: Mirai-Based Linux Botnet Turns Edge Devices Into SOCKS5 Proxies
Evooo1Bot: Mirai-Based Linux Botnet Turns Edge Devices Into SOCKS5 Proxies

CVE Research

Evooo1Bot: Mirai-Based Linux Botnet Turns Edge Devices Into SOCKS5 Proxies

Aug 19, 2026