Microsoft Just Patched 398 Security Flaws, Including a Windows Zero-Day Under Active Attack
Microsoft has released its August 2026 Patch Tuesday security update, fixing 398 vulnerabilities, including an actively exploited Windows zero-day that can elevate attackers to SYSTEM privileges.
The 398 number grabs the eye, but the real tension is hiding in a much smaller group of bugs that need no login, password, or click.
➜ The real story: The monster patch count is noisy, but the practical fix list is mercifully short: patch the exploited Windows driver first, then get exposed server services and on-premises SharePoint squared away.
For everyday Windows users, this is a very good month to let the update happen instead of clicking “remind me later” for the fifth time. For IT teams, the job is more surgical because the biggest CVSS score is not automatically the biggest immediate risk.
Microsoft August 2026 Patch Tuesday Fixes 398 Vulnerabilities and One Exploited Windows Zero-Day
The top priority is CVE-2026-68820, a Windows Ancillary Function Driver for WinSock flaw in afd.sys that is already being exploited in the wild. It has a CVSS score of 7.0 and requires an attacker to already have code running on the machine, but successful exploitation can elevate that access to SYSTEM, which is basically the keys to the building. The bug involves a race condition that can trigger a use-after-free memory flaw, and it has been tied to the Lazarus group in the Operation Dream Job campaign targeting defense, aerospace, and aviation organizations. Microsoft patched it on August 11, so the useful part here is refreshingly uncomplicated: install the update.
Four Critical Microsoft RCE Flaws Need No Login or User Click
Four other bugs deserve fast attention because they can enable remote code execution without authentication or user interaction, and each carries a CVSS score of 9.8. They affect Windows DNS Server through CVE-2026-62878, Windows Deployment Services through CVE-2026-62893, Microsoft QUIC through CVE-2026-62815, and HPC Pack through CVE-2026-59124. That does not mean every Windows PC is sitting on four instant takeover buttons, because the vulnerable services have to be installed, exposed, and reachable. Still, internet-facing servers running any of those components should move near the front of the patch queue.
Microsoft SharePoint Patch Closes the Second Half of a Remote Attack Chain
August also finishes a two-part fix for an on-premises SharePoint attack chain that stretched across two Patch Tuesday releases. A July update fixed CVE-2026-55040, an authentication bypass that could let a remote attacker impersonate a SharePoint user or administrator under the right conditions, while August fixes CVE-2026-63520, the remote code execution half of the chain. Installing the July patch already broke the demonstrated unauthenticated attack path, but the August update closes the separate code execution bug too. If you run SharePoint on-premises, this is the moment to confirm both updates are actually installed rather than assuming last month handled the whole story.
FAQs
What Is CVE-2026-68820?
CVE-2026-68820 is an actively exploited Windows privilege-escalation vulnerability in the afd.sys networking driver. An attacker who already has code running on a PC can use it to gain SYSTEM-level privileges.
How Many Vulnerabilities Did Microsoft Patch in August 2026?
The August 2026 security release includes 398 new CVEs, with 62 rated Critical, one rated Moderate, and the rest rated Important.
Should I Install the August 2026 Windows Security Update Now?
Yes. Windows users should install the update as soon as practical, while organizations should give extra priority to internet-facing systems and servers running DNS Server, Windows Deployment Services, QUIC, HPC Pack, or on-premises SharePoint.
