Microsoft's August 2026 Patch Tuesday Fixes About 400 Flaws and 3 Zero-Days

Microsoft's August 2026 Patch Tuesday addresses about 400 vulnerabilities across Windows and its wider product range. Of those, 42 are rated Critical and three are zero-days. Microsoft shipped the updates on August 11, 2026.

Exact totals depend on who's counting. Tenable tallies 398 CVEs, BleepingComputer reports 400 flaws, and SecurityWeek counts 421. These gaps are normal for Patch Tuesday: vendors differ on whether to include republished advisories, Chromium-based Edge issues, and third-party CVEs. The headline number is less useful than the risk ranking underneath it.

The two largest categories this month were elevation of privilege and remote code execution. Per Tenable, elevation of privilege made up about 41 percent of fixes and remote code execution about 27 percent.

CVE-2026-68820 is an elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock (afd.sys). It carries a CVSS score of 7.0 and is rated Important. Microsoft's assessment marks it as exploited in the wild.

The flaw is a local privilege escalation. An attacker who already has a foothold on a machine can use it to elevate to SYSTEM, the highest privilege level on Windows. Flaws like this rarely start an attack on their own. They are the second stage, turning limited access from phishing or a stolen credential into full control of the host.

Check Point researchers Moshe Marelus and David Driker are credited with reporting the flaw. Check Point has linked the observed exploitation to the North Korea-aligned Lazarus group. That attribution comes from a single research source, so treat it as reported rather than settled until more vendors corroborate it.

Two more zero-days were public before Microsoft shipped a fix. Neither is confirmed as exploited yet, but public disclosure narrows the gap between discovery and attack.

CVE-2026-62832 is an elevation-of-privilege flaw in the Windows User Profile Service, with a CVSS score of 7.8. A successful attacker could gain administrator privileges. Microsoft assessed it as more likely to be exploited, so it deserves attention alongside the actively attacked flaw.

CVE-2026-72971 is a tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), with a CVSS score of 5.5. Microsoft rated its exploitation as unlikely, which puts it lower in the queue but still worth patching in the same cycle.

The updates span Windows, Windows Server, Microsoft Office, SharePoint, and Exchange Server, so most Microsoft environments are in scope. The priority is any Windows endpoint or server where the exploited WinSock flaw applies.

Managed service providers and IT teams that run monthly patch cycles should confirm the August updates reached every managed device, not just the ones people log into daily. Neglected servers and dormant machines are where privilege-escalation flaws sit unpatched the longest.

U.S. federal civilian agencies have a firm deadline. Because CVE-2026-68820 is in CISA's KEV catalog, those agencies must remediate it within the timeframe CISA sets. Private organizations aren't bound by that deadline, but KEV listing is a strong signal to move fast.

Apply the August 2026 cumulative updates through your normal channel: Windows Update, WSUS, Microsoft Update Catalog, or your patch-management tool. If you stage patches, don't wait a full cycle on the exploited flaw.

Rank the work by risk, not by CVE number:

1. CVE-2026-68820 first: exploited in the wild, reaches SYSTEM, and listed in CISA KEV.
2. CVE-2026-62832 next: Microsoft assessed it as more likely to be exploited, and it grants administrator privileges.
3. The 42 Critical flaws: work through the remote code execution issues that apply to your environment.
4. The rest of the cumulative update, including CVE-2026-72971, on your normal cycle.

Watch for exploitation reports on the two publicly disclosed flaws, especially CVE-2026-62832, which Microsoft flagged as more likely to be exploited. Public disclosure without active attacks can change quickly once proof-of-concept code circulates.

Also watch for corroboration of the Lazarus attribution. Right now that link rests on Check Point's research. Independent confirmation from Microsoft Threat Intelligence or another vendor would firm it up. Until then, the safe read is that CVE-2026-68820 is exploited in the wild, with attribution still developing.

The August 2026 updates close about 400 flaws, one of which is already being used in attacks to gain SYSTEM-level control of Windows hosts.

Security: One zero-day is exploited in the wild; two more were public before a patch existed, shortening the window before broader attacks.

Microsoft's August 2026 Patch Tuesday fixed about 400 vulnerabilities, including 42 Critical and three zero-days. One, CVE-2026-68820, is exploited in the wild and now sits in CISA's KEV catalog.