cyber.hendryadrian.com
Security News · securityweek.com

Microsoft Fixes 421 CVEs in August 2026 Patch Tuesday, Including Exploited Zero-Day

· Original article ↗

Summary

Microsoft’s August 2026 updates fix 421 CVEs, including an exploited Windows afd.sys zero-day that enables local privilege escalation. The release also addresses publicly disclosed Windows flaws and vulnerabilities across Microsoft products.

Key points

  • Microsoft’s August 2026 security updates address 421 CVEs across Windows, Office, SharePoint Server, Developer Tools, Azure, Exchange Server and other products.
  • CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys). Microsoft says it is being exploited in the wild for local privilege escalation to SYSTEM; it provided no details about the observed attacks.
  • Tenable researcher Satnam Narang said historical exploitation of afd.sys flaws could indicate nation-state actors, but this is speculation, not confirmed attribution.
  • CVE-2026-62832, a Windows User Profile Service link-following flaw allowing local privilege escalation and access to another user’s data, was publicly disclosed; Microsoft expects exploitation may begin.
  • CVE-2026-72971, a publicly disclosed link-following flaw in the Windows Container Isolation FS Filter Driver, could enable local tampering; Microsoft considers in-the-wild exploitation unlikely.
  • The roundup also highlights remote-code-execution flaws in Windows DNS Server, Windows Deployment Services TFTP Server, Microsoft QUIC and Microsoft HPC Pack, plus an Exchange Server privilege-escalation flaw.
  • The updates include fixes for two CVEs in the TPM 2.0 reference implementation.

Article Details

Event Type
Microsoft August 2026 Patch Tuesday security update
Impact
Microsoft released fixes for 421 CVEs, including CVE-2026-68820, a high-severity afd.sys use-after-free vulnerability reported as exploited in the wild to elevate privileges to SYSTEM. Other highlighted flaws could enable local privilege escalation, access or modification of another user's data, local tampering, or remote code execution. The release also fixes two vulnerabilities in the TPM 2.0 reference implementation.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationCVE-2026-68820 was reportedly exploited to elevate privileges to SYSTEM; the article also describes other local privilege-escalation vulnerabilities.

CVE

CVE-2024-38193three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group,” NarangCVE-2025-214182022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to theCVE-2025-32709“Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked toCVE-2026-59124that defenders should pay attention to include CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows Deployment Services TFTPCVE-2026-62815Other flaws that defenders should pay attention to include CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows DeploymentCVE-2026-62832As part of the August 2026 Patch Tuesday release, Microsoft also drew attention to CVE-2026-62832, an improper link resolution before file access (link following) bug in Windows’s User Profile Service, which could allowCVE-2026-62878Other flaws that defenders should pay attention to include CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows DeploymentCVE-2026-62893Other flaws that defenders should pay attention to include CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows DeploymentCVE-2026-62911server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin Childs notes.CVE-2026-6726The updates also include fixes for two non-Microsoft CVEs, namely a spoofing bug (CVE-2026-6726) and an information disclosure issue (CVE-2026-6727) in the TPM 2.0 reference implementation.CVE-2026-6727The updates also include fixes for two non-Microsoft CVEs, namely a spoofing bug (CVE-2026-6726) and an information disclosure issue (CVE-2026-6727) in the TPM 2.0 reference implementation.CVE-2026-68820The exploited flaw, tracked as CVE-2026-68820, is described as a use-after-free issue in Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver functioning as the backbone for the Windows Sockets API.CVE-2026-72971CVE-2026-72971, a link following in the Windows Container Isolation FS Filter Driver (unionfs.sys) that could lead to local tampering, was also flagged as publicly disclosed, but Microsoft believes it is unlikely to be

People

Dustin ChildsZDI representative cited for noting additional vulnerabilities in the August 2026 updates.Satnam NarangTenable senior staff research engineer who discussed the possibility that CVE-2026-68820 was exploited by nation-state threat actors, based on historical tradecraft targeting afd.sys.

Threat Actors

Lazarus GroupThe article says CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group; this is reported attribution, not confirmed involvement.

Vendors

MicrosoftMicrosoft on Tuesday announced patches for 421 CVEs, including a high-severity vulnerability that has been exploited in the wild as a zero-day.

Products

Azurein Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products.Defenderin Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products.Microsoft Exchange ServerServices TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin Childs notes.Microsoft HPC Pack(RCE) bugs in Windows DNS server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin Childs notes.Microsoft QUICare remote code execution (RCE) bugs in Windows DNS server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in Exchange Server, ZDI’s Dustin ChildsMicrosoft WindowsThe exploited flaw, tracked as CVE-2026-68820, is described as a use-after-free issue in Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver functioning as the backbone for the Windows Sockets API.OfficeIn total, Microsoft’s August 2026 security updates resolve 236 vulnerabilities in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 inOffice 2016Microsoft’s August 2026 security updates resolve 236 vulnerabilities in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, andSharePoint Serversecurity updates resolve 236 vulnerabilities in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products.TPM 2.0 reference implementationThe updates also include fixes for two non-Microsoft CVEs, namely a spoofing bug (CVE-2026-6726) and an information disclosure issue (CVE-2026-6727) in the TPM 2.0 reference implementation.Windows Deployment Services TFTP serverand CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as CVE-2026-62911, an EoP in ExchangeWindows DNS ServerCVE-2026-62893, CVE-2026-62815, and CVE-2026-59124, which are remote code execution (RCE) bugs in Windows DNS server, Windows Deployment Services TFTP server, Microsoft QUIC, and Microsoft HPC Pack, as well as

Related Articles