SecPod

Learn Search

Search across all Learn content

← Back to Security Research
Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

Three Zero-Days, 421 Flaws Fixed: Microsoft's August 2026 Patch Tuesday Delivers a Massive Update

The second Tuesday of August 2026 brought one of the largest Patch Tuesday releases in recent memory, with Microsoft shipping updates for 421 CVEs across Windows, Office, Azure, SharePoint, Exchange Server, and critical developer tools — including three zero-day vulnerabilities, one of which was actively exploited in the wild.

Oct 27, 2026By Bapanapalli Prem Sai Siddhik

Summary

Microsoft's August 2026 Patch Tuesday delivers security updates for 421 Microsoft CVEs, covering Windows, Microsoft Office, SharePoint Server, Azure services, Exchange Server, Developer Tools, and other enterprise products. This is one of the largest Patch Tuesday releases in recent years, with 62 vulnerabilities rated Critical.

The release addresses three zero-day vulnerabilities, one of which was actively exploited in the wild prior to the availability of patches. The actively exploited flaw (CVE-2026-68820) affects the Windows Ancillary Function Driver for WinSock and enables local privilege escalation to SYSTEM. The other two zero-days were publicly disclosed before the patch release.

Vulnerability Breakdown

Breakdown of the 421 vulnerabilities addressed:

Elevation of Privilege 176 (Critical: 18 · Important: 158)
Remote Code Execution 111 (Critical: 40 · Important: 71)
Information Disclosure 86 (Critical: 1 · Important: 85)
Spoofing 21 (Critical: 3 · Important: 17 · Moderate: 1)
Denial of Service 12 (Important: 12)
Security Feature Bypass 11 (Important: 11)
Tampering 4 (Important: 4)
Total: 421 Critical: 62 · Important: 358 · Moderate: 1

Zero-Day Vulnerabilities

Microsoft's August 2026 security release addresses three zero-day vulnerabilities. One was exploited in attacks before patches became available; the other two had been publicly disclosed.

Zero-Day Actively Exploited

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). A locally authenticated attacker can run a specially crafted application to trigger a race condition and potentially gain SYSTEM-level privileges.

Microsoft confirmed this vulnerability was exploited in the wild before the August update. Public reporting has attributed the activity to a known threat actor that used the flaw to deploy a kernel-mode rootkit.

Recommended Action: Prioritize patching this vulnerability immediately on all Windows systems. Treat as an emergency fix.

Zero-Day Publicly Disclosed

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege

CVE-2026-62832 is a link-following flaw in the Windows User Profile Service. An authenticated attacker can run a specially crafted application to load another user's registry hive, potentially leading to elevation to administrator privileges.

Public disclosure of this issue increases the risk of proof-of-concept development and subsequent exploitation attempts.

Zero-Day Publicly Disclosed

CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering

CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys). It is a link-following flaw that may allow an authenticated attacker to perform local tampering. This vulnerability is particularly relevant for organizations running Windows container workloads.

Critical Severity Vulnerabilities

The August update includes 62 Critical-rated vulnerabilities based on the CSV data. Three of these require no authentication and no user interaction:

Complete list of all 62 Critical-rated CVEs from the August 2026 update:

Affected Products

The August 2026 Patch Tuesday update covers a wide range of Microsoft products:

Windows All supported versions of Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1), and Windows Server (2025, 2022, 2019, 2016, 2012 R2, 2012), including Server Core installations.
Microsoft Office & Productivity Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft 365 Apps for Enterprise (32-bit and 64-bit), including Word, Excel, PowerPoint, Outlook, and Access.
Server and Cloud Products SharePoint Server 2016, 2019, and Subscription Edition; Exchange Server 2016, 2019, and Subscription Edition; Azure CycleCloud, Azure Storage Explorer, and Microsoft Entra Connect.
Developer Tools and Platforms .NET Core (8.0, 9.0, 10.0), .NET Framework 3.5 / 4.6.2–4.8.1; Visual Studio 2022 and 2026; Visual Studio Code and extensions; PowerShell 7.4, 7.5, and 7.6.
Other Enterprise & Productivity Software Microsoft Teams (iOS and Android), OneDrive for macOS, Power BI Report Server, Windows App Client, and Microsoft Dynamics 365 (on-premises) version 9.1.

Mitigation and Security Recommendations

  1. Deploy the August 2026 Microsoft security updates immediately.
    Use an accelerated deployment schedule for actively exploited vulnerabilities and exposed systems. Validate installation through centralized patch reporting and vulnerability scanning.
  2. Prioritize the actively exploited zero-day (CVE-2026-68820).
    This vulnerability should be patched immediately on all Windows systems. Treat this as an emergency fix.
  3. Address the three unauthenticated RCE flaws.
    Prioritize CVE-2026-62878 (Windows DNS), CVE-2026-62893 (Windows Deployment Services), and CVE-2026-62815 (Microsoft QUIC) for systems where these services are exposed or reachable.
  4. Restrict access to exposed services.
    Limit access to DNS, DHCP, RDP, and other critical network services to authorized subnets and users. Use network segmentation and firewalls to reduce attack surface.
  5. Monitor for exploitation indicators.
    Investigate unusual privilege changes, new administrator accounts, suspicious process execution, abnormal child processes, and unauthorized access to sensitive systems.

Instantly Fix Risks with Saner Patch Management

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.

Featured Posts

Open Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management
Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management

CVE Research

Agentic AI in the Wild: How AI-Driven Attacks Are Changing Vulnerability Management

Oct 30, 2026

Open WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility
WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility

CVE Research

WARP PANDA Weaponizes VMware ESXi Zero-Day Logging Gap to Evade Audit Visibility

China-nexus threat actor Warp Panda exploited an insufficient logging zero-day in VMware ESX (CVE-2026-41709) to blind audit visibility, deploying BRICKSTORM malware and hijacking Microsoft 365 accounts across targeted U.S. legal networks

Oct 30, 2026

Open Cisco Firewall Zero-Day Under Attack: Hackers Exploit SSL VPN Flaw to Crash ASA and FTD Devices
vulnerability researchCisco Firewall Zero-Day Under Attack: Hackers Exploit SSL VPN Flaw to Crash ASA and FTD Devices

CVE Research

Cisco Firewall Zero-Day Under Attack: Hackers Exploit SSL VPN Flaw to Crash ASA and FTD Devices

Oct 30, 2026

Open PolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026
vulnerability researchPolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026

CVE Research

PolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026

CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento Open Source. Unauthenticated attackers can submit polyglot files through guest-cart REST item routes and write them under pub/media/custom_options/. When the web server executes or serves that path as PHP, the result can be remote code execution or stored XSS. Mass exploitation has been observed since March 2026, including links to CMS-block loaders on hundreds of stores. The issue is listed in the CISA KEV catalog. This article covers how the flaw works, campaign activity, indicators of compromise, affected and fixed versions under APSB26-73, and practical remediation steps.

Oct 29, 2026