Microsoft’s August 2026 Patch Tuesday: 421 Fixes and a Zero-Day Already Under Attack

A Record-Sized Update With One Vulnerability Already Weaponized

Microsoft’s August 2026 Patch Tuesday, released August 11, 2026, fixed 421 vulnerabilities — one of the largest single-month totals Microsoft has published. Of those, 62 carry a Critical severity rating, according to Trend Micro’s Zero Day Initiative (ZDI) review of the update. The bulk of the load landed in Windows itself: 236 of the 421 fixes touch the Windows operating system, with another 98 in Office, 30 in SharePoint Server, 26 in Developer Tools, and 17 in Azure, per SecurityWeek’s breakdown of the release.

The headline risk is a single vulnerability that was not theoretical when Microsoft shipped the fix. CVE-2026-68820 is a use-after-free flaw in afd.sys, the Ancillary Function Driver for WinSock — a kernel-mode driver that underpins the Windows Sockets API and therefore sits in the execution path of nearly every network-facing Windows process. SecurityWeek reports that a locally authenticated attacker can trigger a race condition with a specially crafted application to elevate privileges to SYSTEM — full administrative control of the machine — without needing any further user interaction. Splashtop’s technical writeup confirms “confirmed active exploitation” of CVE-2026-68820 at the time of release, distinguishing it from the batch of “publicly known but not yet exploited” flaws that also shipped this month.

That distinction matters for triage. Security researcher Satnam Narang, cited by SecurityWeek, noted this is not afd.sys‘s first appearance in exploit chains — three previous zero-days in the same driver have surfaced since 2022, with one previously linked to exploitation by threat actors associated with North Korea’s Lazarus group. A kernel driver with a repeat history of privilege-escalation bugs, sitting underneath every socket connection on a Windows host, is exactly the kind of component attackers keep coming back to because a single working exploit chain can be reused across campaigns.

The Rest of the Critical Pile: DNS, QUIC, and a Pwn2Own Disclosure

CVE-2026-68820 is the fire alarm, but it is not the only flaw enterprise patch teams need to weigh this cycle. ZDI’s review flags several CVSS 9.8-rated remote code execution bugs that, while not yet observed in active attacks, are unauthenticated and remotely triggerable — the profile most likely to be weaponized quickly once technical details circulate:

• CVE-2026-62878 — a Windows DNS Server RCE that ZDI describes as remote, unauthenticated, and wormable, the same class of flaw that historically produces self-propagating worms when DNS servers are internet-facing.
• CVE-2026-62815 — a Microsoft QUIC RCE, also CVSS 9.8, affecting the transport protocol increasingly used for HTTP/3 traffic.
• CVE-2026-62893 — a Windows Deployment Services TFTP Server RCE, submitted to Microsoft through the ZDI bug-bounty program rather than found by Microsoft’s own research team.
• CVE-2026-62911 — an Exchange Server privilege-escalation bug that ZDI notes was originally demonstrated live at Pwn2Own Berlin, meaning working proof-of-concept exploitation techniques already exist in the security research community.

Separately, CVE-2026-62832 — a Windows User Profile Service elevation-of-privilege bug nicknamed “LegacyHive” in some vendor writeups — is marked as publicly disclosed, meaning technical details were available before Microsoft’s patch shipped, even though Splashtop’s analysis found no confirmed in-the-wild exploitation yet. Publicly disclosed vulnerabilities without a patch are a known precursor to opportunistic attacks, since defenders and attackers see the same technical writeup at the same time.

SharePoint Server also drew scrutiny this cycle. SecurityWeek’s count of 30 SharePoint-related fixes lands in the same product line that produced a chain of unauthenticated remote-code-execution bugs earlier in 2026 — ZDI’s review explicitly calls out a “newly completed unauthenticated SharePoint RCE chain” among the flaws most likely to attract attacker interest this month, since on-premises SharePoint servers are frequently internet-facing and slower to patch than cloud-hosted equivalents.

What This Means for Enterprise Security Teams

The scale of this month’s update — 421 individual fixes in a single release — is itself an operational problem before any single CVE is considered. Security and IT operations teams cannot meaningfully triage 421 items with the same rigor in the same patch window; the practical response is risk-tiering, not exhaustive review.

1. Patch CVE-2026-68820 as an emergency, not a routine cycle item

Because active exploitation was already confirmed at release, treat this as an out-of-band emergency patch on any Windows server or workstation exposed to untrusted local users or remote code execution vectors — not something that waits for the normal monthly patch window. Prioritize domain controllers, terminal servers, and any multi-user Windows host where a local-privilege-escalation bug converts a low-value foothold into full SYSTEM control.

2. Fast-track the CVSS 9.8 remote, unauthenticated bugs next

CVE-2026-62878 (DNS), CVE-2026-62815 (QUIC), and CVE-2026-62893 (TFTP/WDS) share the profile that produces fast weaponization: unauthenticated, remote, and rated 9.8. Any internet-facing DNS server or WDS deployment should be patched or isolated before the standard 30-day enterprise patch cycle completes.

3. Assume LegacyHive (CVE-2026-62832) technical details are already circulating

Public disclosure without active exploitation is a narrow window, not a safe one. Treat publicly known, unpatched elevation-of-privilege bugs on shared or multi-tenant Windows infrastructure as a same-week priority, since the barrier to a working exploit is lower once the technical writeup is public.

4. Re-audit SharePoint Server exposure specifically

Given the 30 SharePoint fixes and ZDI’s explicit callout of a completed unauthenticated RCE chain, any organization running on-premises SharePoint Server should confirm patch status this week and review whether the server needs to be internet-facing at all — migrating exposed workloads to SharePoint Online sidesteps the entire on-prem patch-lag problem.

The Volume Problem Behind the Headline Number

What August 2026 really illustrates is a structural shift in how Microsoft’s patch cadence functions. A 421-CVE month is not an anomaly anymore — it is one data point in a pattern of expanding monthly totals that has been building across 2026 as more of Microsoft’s stack (Azure services, Developer Tools, multiple parallel Office release channels) gets folded into the same monthly disclosure cycle. For security teams, that means the old model of “patch everything within 30 days” is no longer operationally realistic; the differentiator between organizations that get breached and those that don’t increasingly comes down to how well they can separate the one or two CVEs that matter this week from the hundreds that can safely wait. CVE-2026-68820 is this month’s answer to which one matters first — a kernel driver with a documented history of nation-state-linked exploitation, patched only after attackers were already using it.

Frequently Asked Questions

Sources & Further Reading

• August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day — SecurityWeek
• Zero Day Initiative — The August 2026 Security Update Review
• Patch Tuesday: Update Now to Fix 421 Flaws, Including Three Zero-Days — Malwarebytes
• August 2026 Patch Tuesday: 421 CVEs & Zero-Days — Splashtop