Microsoft has released its August 2026 Patch Tuesday security updates, addressing roughly 400 security vulnerabilities across Windows and other Microsoft products. The release includes three zero-day vulnerabilities, with one already being actively exploited in attacks.
The August update addresses at least 398 vulnerabilities, according to security researchers tracking Microsoft’s release. Microsoft classified dozens of the vulnerabilities as critical, including flaws that could allow remote code execution and elevation of privileges.
One Windows Zero-Day Already Exploited
The most serious issue in the update is CVE-2026-68820, a vulnerability in the Windows Ancillary Function Driver for WinSock, also known as AFD.sys.
The flaw can allow a low-privileged local attacker to elevate their privileges to SYSTEM level, giving them extensive control over an affected Windows machine. Security researchers reported that the vulnerability was already being exploited before Microsoft released its fix.
Researchers have linked exploitation of the vulnerability to a campaign attributed to North Korean attackers. The attacks reportedly used the vulnerability to deploy a kernel-level rootkit.
Two Other Zero-Days Were Publicly Disclosed
Microsoft’s August security release also addresses two other vulnerabilities that had been publicly disclosed before the patches became available.
One of them, CVE-2026-62832, affects the Windows User Profile Service and could allow an authenticated attacker to obtain elevated privileges through a specially crafted application.
Another vulnerability, CVE-2026-72971, affects the Windows Container Isolation FS Filter Driver and can allow authenticated attackers to tamper with affected systems.
Critical Remote Code Execution Flaws Also Patched
The August release includes several high-severity remote code execution vulnerabilities.
Among them is CVE-2026-62815, a Microsoft QUIC vulnerability that could allow an unauthenticated attacker to execute code remotely by sending a specially crafted network packet.
Microsoft also patched CVE-2026-62878, a Windows DNS Server vulnerability involving a stack-based buffer overflow. The flaw can potentially be exploited remotely without authentication.
Windows Users Should Install the Update
Microsoft’s latest security release is available through the company’s normal update channels. Windows users should check Windows Update and install the available August security updates, particularly because one of the patched vulnerabilities is already being exploited.
For businesses and IT administrators, security researchers recommend prioritizing actively exploited vulnerabilities and critical flaws affecting internet-facing systems before completing wider deployment.
The August release continues a recent trend of unusually large Microsoft security updates. While the total number of vulnerabilities can vary depending on how researchers count Microsoft’s advisories and affected products, the scale of this month’s release makes patch management a significant priority for organizations running Microsoft infrastructure.
Microsoft’s August 2026 security update is now available, and users should avoid delaying installation, especially on systems that may be exposed to network-based attacks.
