Microsoft unveiled its August 2026 Patch Tuesday on August 11, fixing no less than 400 vulnerabilities, including 42 deemed critical (37 of which are remote code executions and 5 privilege escalations). This month, three zero-days are on the agenda: one is actively exploited in the wild, and two others were publicly disclosed before the availability of a fix.

Distribution of the 400 vulnerabilities

The breakdown by category, as reported by BleepingComputer, is as follows:

  • 176 privilege escalations
  • 110 remote code executions (RCE)
  • 86 information disclosures
  • 21 spoofing
  • 12 denial of service
  • 11 security feature bypasses

This volume, although impressive, remains lower than that of the previous month: the July 2026 Patch Tuesday set a record with 570 vulnerabilities fixed and 3 zero-days. Microsoft had warned that this significant volume was due to the deployment of an AI-assisted vulnerability discovery system, which identifies more flaws in its codebase before attackers can exploit them.

The three fixed zero-days

CVE-2026-68820 — Windows Ancillary Function Driver (AFD.sys) — actively exploited

This is the most concerning vulnerability of the month. It is a use-after-free flaw in the Windows AFD (Ancillary Function Driver) driver for WinSock, allowing a locally authenticated attacker to gain SYSTEM privileges. No user interaction is required.

According to a report published on the same day by Check Point, the vulnerability has been exploited in zero-day by the North Korean group Lazarus to deploy a new version of FudModule, its kernel-mode rootkit. The discovery is credited to Moshe Marelus and David Driker of Check Point. However, Microsoft did not provide details on the specific conditions of the downstream exploitation.

CVE-2026-62832 — Windows User Profile Service — publicly disclosed

This privilege escalation, due to improper link resolution before file access (“link following”) in the Windows User Profile Service, allows an authenticated attacker with the credentials of another local account to load another user's registry hive and gain administrative privileges.

The details of this flaw correspond to LegacyHive, a zero-day disclosed on July 14, 2026, by the security researcher known by the pseudonym Nightmare Eclipse, along with a proof-of-concept. At the time, Will Dormann, a senior analyst at Tharros, explained that non-administrator users could exploit LegacyHive to modify the classes registry hive and trigger the execution of commands with administrative privileges upon the next login of the administrator. Unofficial patches were in fact published by 0Patch (ACROS Security) as early as July 21, pending Microsoft’s acknowledgment and fix for the flaw.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver (unionfs.sys) — publicly disclosed

This third flaw, a tampering vulnerability in the Windows container isolation file system filter driver (unionfs.sys), presents a similar “link following” mechanism. It allows a locally authenticated attacker to access or modify another user's data and gain administrative privileges. The discovery is credited to researchers yhw and txz. Microsoft did not specify where or how the flaw had been disclosed.

Context: increasing pressure on SharePoint

Alongside the Patch Tuesday, the CISA (Cybersecurity and Infrastructure Security Agency) confirmed on August 11 that the vulnerability CVE-2026-45659 — a remote code execution flaw in Microsoft SharePoint due to untrusted data serialization, fixed in May 2026 — is now actively exploited by ransomware groups. According to Shadowserver, over 8,500 SharePoint servers are exposed on the internet, of which more than 200 remain unpatched against this vulnerability.

Since November 2021, CISA has tracked 14 actively exploited SharePoint vulnerabilities, of which 8 have been used in ransomware attacks. This reminder highlights the importance for administrators to promptly apply SharePoint patches and actively monitor for indicators of compromise.

On Windows 11 and Windows 10

Cumulative updates KB5121003 (Windows 11 25H2/24H2) and KB5120240 (Windows 11 23H2) have also been released. They include the 40 security patches from this Patch Tuesday as well as several functional improvements:

  • Windows Search: improved typo tolerance and partial application names
  • Voice Access: added voice isolation to filter ambient noise and support for Korean
  • Windows Hello: support for peripheral fingerprint sensors with Enhanced Sign-in Security (ESS)
  • File Explorer: now displays file sizes with appropriate units (KB, MB, GB)
  • Widgets: notification badges now use Windows accent color instead of red

For Windows 10, the extended security update KB5120249 has been published for versions 22H2 and 21H2.

Other vendors releasing patches in August 2026

Several other vendors have released notable security updates this month:

  • Adobe: patches for ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Campaign Classic
  • Cisco: updates for Catalyst SD-WAN, IOS, IOS XE, and ClamAV (including flaws with public exploits)
  • Metabase: fix for a critical SQLi vulnerability exploited in data theft attacks
  • N-able: patch for an actively exploited authentication bypass vulnerability CVE-2026-18577, affecting both hosted and on-premise N-central servers
  • SAP: August update includes a 10.0 severity incorrect authorization flaw in SAP Commerce Cloud (Data Hub Adapter)
  • TP-Link: 15 vulnerabilities fixed in the ZTP mechanism of its Omada devices, potentially leading to RCE
  • VMware: updates for Avi Load Balancer, including authentication bypasses and RCEs

The context of Nightmare Eclipse

The researcher Nightmare Eclipse, already behind the disclosure of LegacyHive (CVE-2026-62832), has ramped up zero-day disclosures for Windows in recent months: RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. Microsoft has fixed several of these flaws during the June and July 2026 Patch Tuesdays, but others remain awaiting fixes. This public disclosure practice without prior official patches creates a prolonged exposure window for businesses, hence the importance of alternative patching solutions like 0Patch while awaiting official updates.

Recommendations

System administrators are encouraged to:

  1. Immediately apply the August 2026 updates, prioritizing systems exposed to the internet
  2. Check for exploitation of CVE-2026-68820 (AFD.sys) in sensitive environments, notably via audit logs and EDR solutions
  3. Ensure all SharePoint servers are up-to-date, especially against CVE-2026-45659 exploited by ransomware groups
  4. Consult Microsoft's Security Update Guide for the complete list of 400 vulnerabilities and determine priorities based on the environment

In summary

The August 2026 Patch Tuesday confirms a significant trend: Microsoft is now fixing record volumes of vulnerabilities, a direct consequence of its AI-assisted discovery system. While this approach allows for quicker remediation of flaws, it also imposes a demanding update pace on security teams. The existence of a zero-day exploited by Lazarus to deploy a kernel-mode rootkit serves as a reminder that the most sophisticated state-sponsored groups continue to actively target low-level Windows system components.