Microsoft Fixes 398 Vulnerabilities as Exploited Windows Kernel Flaw Enters CISA KEV

Microsoft has released security updates for at least 398 vulnerabilities across Windows and other supported software, including 42 issues rated Critical. Those flaws could permit remote control of vulnerable systems with little or no assistance from users.

The most urgent issue is CVE-2026-68820, a privilege-escalation vulnerability in the Windows Ancillary Function Driver for WinSock. Microsoft has detected exploitation, while CISA has added the flaw to its Known Exploited Vulnerabilities catalog.

Two other notable vulnerabilities affect the Windows User Profile Service and the Windows Container Isolation file-system filter. Both require local access, but they present different risks involving administrator privileges and unauthorized system modifications.

An exploited use-after-free can deliver SYSTEM privileges

CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the kernel driver supporting ancillary Windows Sockets functions. Microsoft rates it Important, with a CVSS 3.1 base score of 7.0.

The attack is local rather than remote. An authenticated attacker with low-level privileges must execute a specially crafted application and successfully trigger a race condition. No further user interaction is necessary.

If exploitation succeeds, the attacker can obtain SYSTEM privileges, giving them extensive control over the compromised Windows machine. This makes the flaw particularly useful after an initial intrusion.

For example, an attacker could first establish a limited foothold through phishing or another access vector. They could then repeatedly attempt to win the race condition and elevate their privileges. Landon Miles of Automox attributed the relatively high attack-complexity rating to the difficulty of reliably triggering that race.

The official vector is:

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The condition is classified as CWE-416, use after free. Microsoft records the vulnerability as exploited but not publicly disclosed, suggesting that attacks were detected without the underlying flaw having been openly documented beforehand.

Moshe Marelus and David Driker of Check Point received credit for coordinated disclosure. Microsoft published advisory revision 1.0 on August 11, 2026.

Windows versions exposed to CVE-2026-68820

The vulnerability affects multiple client and server generations. Systems running builds below the following thresholds should be considered vulnerable:

Product	Vulnerable builds
Windows 10 1607	Below 10.0.14393.9418
Windows 10 1809	Below 10.0.17763.9115
Windows 10 21H2	Below 10.0.19044.7663
Windows 10 22H2	Below 10.0.19045.7663
Windows 11 23H2	Below 10.0.22631.7517
Windows 11 24H2	Below 10.0.26100.9106
Windows 11 25H2	Below 10.0.26200.9106
Windows 11 26H1	Below 10.0.28000.2704
Windows Server 2016	Below 10.0.14393.9418
Windows Server 2019	Below 10.0.17763.9115
Windows Server 2022	Below 10.0.20348.5440

NVD also identifies Windows Server 2012 as affected, but no build threshold is available for that product.

Administrators should verify installed build numbers rather than checking only Windows names and editions. Similar product labels can correspond to different servicing levels.

CISA ordered accelerated remediation

CISA added CVE-2026-68820 to the KEV catalog on August 11, 2026. The remediation deadline for U.S. federal agencies was August 25, 2026.

The required action is to apply vendor mitigations while complying with CISA BOD 26-04, “Prioritizing Security Updates Based on Risk,” and the agency’s forensic-triage requirements. Applicable BOD 26-04 provisions also cover cloud services. If effective mitigations are unavailable, CISA directs agencies to discontinue use of the affected product where required.

The KEV listing separates CVE-2026-68820 from vulnerabilities supported only by theoretical attack scenarios. Exploitation has been observed.

It also joins several other Microsoft vulnerabilities added to KEV during the last 90 days:

• CVE-2019-1068 on August 26, 2026
• CVE-2026-55040 and CVE-2026-33824 on August 18, 2026
• CVE-2026-50522 on July 22, 2026
• CVE-2026-58644 on July 16, 2026
• CVE-2026-45659 on July 1, 2026

CVE-2026-45659 is associated with ransomware activity.

Public User Profile Service flaw is considered more likely to be exploited

CVE-2026-62832 affects the Windows User Profile Service and carries a CVSS score of 7.8. It results from improper link resolution before file access, classified as CWE-59.

An authenticated attacker needs credentials for another local account and must run a crafted application that loads the other user’s registry hive. Successful exploitation can expose or alter that user’s data and elevate the attacker to administrator privileges.

The attack has low complexity and requires no user interaction:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microsoft describes CVE-2026-62832 as publicly disclosed and “more likely” to be exploited, but explicitly records no detected exploitation. Reports have suggested a possible connection to the publicly discussed “LegacyHive” issue associated with the researcher known as Nightmare Eclipse, although that relationship has not been confirmed.

Affected systems and minimum fixed build thresholds are:

• Windows 10 21H2: 10.0.19044.7663
• Windows 10 22H2: 10.0.19045.7663
• Windows 11 23H2: 10.0.22631.7517
• Windows 11 24H2: 10.0.26100.9168
• Windows 11 25H2: 10.0.26200.9168
• Windows 11 26H1: 10.0.28000.2704
• Windows Server 2022: 10.0.20348.5499
• Windows Server 2025: 10.0.26100.33296

Microsoft credited an anonymous reporter and published advisory revision 1.0 on August 11, 2026.

Container isolation bug enables local tampering

CVE-2026-72971 affects unionfs.sys, the Windows Container Isolation FS Filter Driver. It permits a low-privileged local attacker to tamper with data without user interaction.

The vulnerability has a CVSS score of 5.5 and the vector:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Its impact is limited to integrity: the scoring indicates no confidentiality or availability consequences. Microsoft reportedly considers exploitation unlikely, and no evidence of attacks is known.

NVD identifies Windows 11 26H1 builds below 10.0.28000.2704 as vulnerable. Exact Microsoft advisory details beyond that information are not available.

Defenders should patch by risk, then investigate exposed hosts

CVE-2026-68820 should lead deployment queues because it is actively exploited and can provide SYSTEM access. CVE-2026-62832 deserves accelerated treatment because it was publicly disclosed and Microsoft considers exploitation more likely.

No specific workaround has been disclosed for either vulnerability. Installing Microsoft’s official updates is the available remediation.

Organizations should test the large update bundle across endpoint configurations, server roles, security products and critical applications. Ring-based deployments can reduce disruption while allowing teams to identify failed installations, compatibility problems, unexpected reboots and service instability.

Defenders should also review potentially exposed systems for suspicious locally executed applications, unusual privilege-escalation events and anomalous activity involving afd.sys. There are no disclosed exploit-specific indicators, so investigation must rely on behavioral and endpoint telemetry.

For CVE-2026-62832, teams should examine unexpected registry-hive loading, access involving multiple local accounts and changes to another user’s data. Backups should be completed before broad deployment.

The volume of fixes adds operational pressure. AI-assisted vulnerability discovery is helping researchers identify defects more quickly, but automated remediation remains less dependable. Research by 1Password found that large-language-model patches failed to fix the original vulnerability, introduced another weakness, or did both in more than half of tested cases.

AI-generated patches therefore still require human review, repeated testing and independent verification. Speed in finding flaws does not yet translate into safe, one-shot fixes.