August Patch Tuesday: Microsoft Fixes 400 Vulnerabilities, Three Are Zero-Days

Three zero-days, one exploited by Lazarus

Microsoft released its August 11, 2026, Patch Tuesday security updates, addressing 400 vulnerabilities. Three are classified as zero-days: one has been actively exploited, while two had already been publicly disclosed.

The vulnerability exploited in attacks is CVE-2026-68820, found in AFD.sys, the Windows Ancillary Function Driver for WinSock. The use-after-free flaw allows a locally authenticated attacker to trigger a race condition through a specially crafted application and obtain SYSTEM privileges.

Check Point credited Moshe Marelus and David Driker with discovering the vulnerability. According to the company, the North Korean Lazarus group exploited the flaw to deploy a new variant of the FudModule kernel rootkit. Microsoft has not disclosed technical details about the exploit.

Windows vulnerabilities already disclosed publicly

CVE-2026-62832 affects the Windows User Profile Service. Improper link resolution before file access allows an attacker authenticated with another local account to load a user’s Registry hive, read or modify its data, and escalate privileges to administrator.

The flaw does not require user interaction. Microsoft credited an anonymous researcher with reporting it; the description matches the LegacyHive issue published by Nightmare Eclipse.

Will Dormann, principal vulnerability analyst at Tharros, said that a non-administrator can modify the Registry hive to plant commands that execute with administrative privileges when an administrator signs in to the device.

The third zero-day is CVE-2026-72971, affecting the Windows Container Isolation FS Filter Driver, file unionfs.sys. Microsoft describes it as a local tampering vulnerability caused by improper link resolution before file access.

The issue was publicly disclosed, but no further verifiable details are available about its operational impact or exploitation methods.

A release containing 42 critical vulnerabilities

Of the 400 vulnerabilities addressed, 42 are classified as Critical: 37 allow remote code execution and five enable privilege escalation.

The overall breakdown includes:

• 176 privilege escalation vulnerabilities;
• 110 remote code execution vulnerabilities;
• 86 information disclosure vulnerabilities;
• 21 spoofing vulnerabilities;
• 12 denial-of-service vulnerabilities;
• 11 security feature bypass vulnerabilities.

The documented impacts range from remote code execution to gaining SYSTEM or administrative privileges, as well as accessing and modifying data belonging to other users.

The count covers only fixes released in the August 11 Patch Tuesday update. It does not include issues previously addressed in Mariner, Microsoft Teams, Microsoft Azure, Microsoft Entra, Microsoft Office, and Power Apps. The previous month, Microsoft fixed 570 vulnerabilities.

Microsoft also expects the number of updates to increase as a result of using an AI-based vulnerability discovery system.

What administrators should do

Administrators should install the August 2026 security updates, prioritizing exposed Windows systems and devices with multiple local accounts. The fixes also affect environments using AFD.sys, the Windows User Profile Service, and unionfs.sys.

No workarounds, temporary mitigations, or indicators of compromise have been provided. Microsoft has not disclosed the exact Windows versions affected by the three vulnerabilities.

The following non-security updates are also referenced:

• Windows 11 KB5121003;
• Windows 11 KB5120240;
• Windows 10 KB5120249, an Extended Security Update.