Microsoft Plugs Nearly 400 Security Holes in August 2026 Patch Tuesday

Microsoft's August 2026 Patch Tuesday is one of the largest in recent memory, addressing 398 security vulnerabilities across Windows operating systems and supported software. The update includes a patch for one actively exploited zero-day — a Windows socket driver flaw already being used in real-world attack chains — and fixes for two vulnerabilities that were publicly detailed before today's patches.

By the Numbers

The 398-CVE count is a significant surge from June's approximately 200 fixes, though it falls below July's record-setting 570 patches.

The Actively Exploited Zero-Day: CVE-2026-68820

The headline vulnerability is CVE-2026-68820, a use-after-free flaw in afd.sys — the Windows Ancillary Function Driver for WinSock, the kernel-mode socket driver underpinning Windows networking.

The CVSS score of 7.0 reflects high attack complexity — the flaw involves a race condition that requires precise timing to trigger. In practice, researchers describe CVE-2026-68820 as "step two in a chain": an attacker phishes their way to a low-privilege foothold, then uses the driver flaw to escalate to SYSTEM, effectively compromising the endpoint entirely.

The vulnerability affects virtually every supported Windows endpoint — from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 R2 through 2025.

CISA has set a remediation deadline of August 25, 2026 for federal agencies under BOD 22-01.

Publicly Disclosed Vulnerabilities

Two additional flaws were publicly detailed before Microsoft shipped fixes:

• CVE-2026-62832 — Windows User Profile Service privilege escalation, likely related to the previously disclosed "LegacyHive" research
• CVE-2026-72971 — A low-impact local tampering vulnerability; Microsoft rates exploitation as unlikely

Public disclosure before patching gives attackers a potential window, though neither appears to have been weaponized in active campaigns as of patch release.

The Bigger Picture: AI-Accelerated Patch Volume

The surge in patch volume — from ~200 CVEs in June to nearly 400 in August — reflects a trend researchers have noted across major vendors: AI-assisted vulnerability discovery is surfacing flaws faster than traditional research. Microsoft and third-party researchers are using large language models and static analysis tools to audit code at scale.

However, the accelerated discovery comes with a caveat. Research from 1Password found that LLM-generated patches failed to fix flaws or introduced new weaknesses in over 50% of cases, underscoring that human review remains essential in the fix pipeline.

What to Prioritize

For security teams, the August 2026 patch cycle priority list is straightforward:

1. CVE-2026-68820 (WinSock UAF) — patch immediately; CISA KEV, actively exploited, affects all Windows endpoints
2. CVE-2026-62832 (User Profile Service) — patch promptly; publicly disclosed
3. The 42 critical-rated flaws — assess for network-facing or unauthenticated attack vectors
4. CVE-2026-72971 — low priority; local-only, unlikely exploitation

How to Apply Updates

# Check for and install updates via PowerShell
Install-WindowsUpdate -AcceptAll -AutoReboot
 
# Or via Windows Update Settings
# Settings > Windows Update > Check for updates

For enterprise environments, deploy via Windows Server Update Services (WSUS), Microsoft Endpoint Configuration Manager, or equivalent patch management tooling. Prioritize endpoints with internet-facing exposure and those in high-risk segments.

References

• KrebsOnSecurity — Microsoft Plugs Nearly 400 Security Holes
• CISA — Known Exploited Vulnerabilities Catalog
• NVD — CVE-2026-68820

Related Reading

• CVE-2026-68820: Windows WinSock Use-After-Free Privilege Escalation