Microsoft Fixes 421 Vulnerabilities, Including an Exploited Zero-Day in `afd.sys`

August Patch Tuesday: a Kernel Flaw Already Under Attack

On August 11, 2026, Microsoft released security updates addressing 421 vulnerabilities. One of them is CVE-2026-68820, a high-severity flaw actively exploited as a zero-day.

The issue affects the Ancillary Function Driver for WinSock kernel driver, identified by the afd.sys file and used by the Windows Sockets API. The vulnerability is a use-after-free caused by a race condition.

Exploitation requires the attacker to authenticate locally and run a specially crafted application. No user interaction is required. However, a successful attack could enable privilege escalation to SYSTEM, the highest authorization level in Windows.

Microsoft has observed activity by threat actors capable of obtaining these privileges but has not disclosed details about their methods, targets, or tools.

Interest in afd.sys has also grown because of similar incidents. Since 2022, three other zero-days exploited in the same driver have been identified: CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. The latter has been linked to North Korean operators associated with the Lazarus Group. According to Tenable, the repeated targeting of this component suggests that nation-state groups may be interested in it.

Other Vulnerabilities Requiring Urgent Attention

The second priority is CVE-2026-62832, affecting the Windows User Profile Service. The flaw enables a link-following attack before file access is granted.

An authenticated user with the credentials of another local account can load the victim’s registry hive, read or modify its data, and potentially obtain administrative privileges. The vulnerability has been publicly disclosed, and Microsoft considers exploitation likely, although it is not listed as being exploited in the wild.

CVE-2026-72971, affecting the Windows Container Isolation FS Filter Driver (unionfs.sys), has also been publicly disclosed. It may allow local manipulation through link following, but Microsoft considers real-world exploitation unlikely.

Vulnerabilities that may enable remote code execution include:

• CVE-2026-62878, in Windows DNS Server;
• CVE-2026-62893, in Windows Deployment Services TFTP Server;
• CVE-2026-62815, in Microsoft QUIC;
• CVE-2026-59124, in Microsoft HPC Pack.

The release also includes CVE-2026-62911, a local privilege escalation flaw in Exchange Server, along with two vulnerabilities in the TPM 2.0 reference implementation:

• CVE-2026-6726, classified as spoofing;
• CVE-2026-6727, involving information disclosure.

Affected Products and Update Deployment

The updates affect numerous Microsoft products:

• 236 vulnerabilities in Windows;
• 98 in Office;
• 98 in Office 2016;
• 30 in SharePoint Server;
• 26 in Developer Tools;
• 17 in Azure;
• 7 in Exchange Server;
• 1 in Defender;
• 6 in other products.

The total also includes the two CVEs affecting the TPM 2.0 reference implementation, which is not directly part of a Microsoft product.

The exact affected and fixed versions have not been disclosed. Patch applicability should therefore be assessed using Microsoft’s standard update management tools and the organization’s asset inventory.

What Administrators and Organizations Should Do

The August 2026 security updates should be deployed as a priority, starting with CVE-2026-68820 and the publicly disclosed vulnerabilities.

Operational priority should also be given to systems running or exposing:

• Windows DNS Server;
• Windows Deployment Services TFTP Server;
• Microsoft QUIC;
• Microsoft HPC Pack;
• Exchange Server;
• Windows Container Isolation.

The first step is to verify that the patches have been installed on Windows systems and affected servers. Organizations should also look for signs of anomalous local execution, attempts to escalate privileges to SYSTEM, unexpected registry hive loading, and suspicious activity involving network services.

No specific workarounds or additional technical mitigations have been provided. Without alternative fixes, deploying the updates remains the primary measure for reducing risk.