VulnerabilityPublished 11 Aug 2026

August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day

Source SecurityWeek

Mentioned vulnerabilities

Severity

High

Rated High by Threat Radar from the SecurityWeek text

Data as of 11 Aug 2026, 21:10 UTC

What to do

AI-suggested

Microsoft has released official patches addressing CVE-2026-68820 and other vulnerabilities as part of the August 2026 Patch Tuesday updates. Administrators and users should apply these security updates promptly to mitigate the risk of exploitation. Since the affected software is not a cloud service, remediation depends on applying these patches. There is no indication from Microsoft that any additional mitigation or workarounds are required beyond patching.

Description

A use-after-free in the afd.sys Windows kernel-mode driver has been exploited to gain SYSTEM privileges. The post August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day appeared first on SecurityWeek .

Impact

Successful exploitation of CVE-2026-68820 allows an attacker with local authentication to gain SYSTEM privileges, effectively full control over the affected Windows system. This elevates the attacker's capabilities to perform any action on the system, including installing programs, accessing or modifying data, and creating new accounts with full user rights. The vulnerability does not require user interaction, increasing its risk. Other patched vulnerabilities similarly enable privilege escalation or remote code execution, potentially allowing attackers to compromise systems or access sensitive data.

Summary

CVE-2026-68820 is a use-after-free vulnerability in the afd.sys Windows kernel-mode driver, which supports the Windows Sockets API. Exploitation allows a locally authenticated attacker to trigger a race condition that results in SYSTEM privilege escalation without requiring user interaction. Microsoft confirmed active exploitation of this zero-day. Historical context indicates that similar afd.sys vulnerabilities have been exploited by nation-state actors, including North Korean-linked Lazarus group. The August 2026 update also addresses other significant vulnerabilities such as CVE-2026-62832 (privilege escalation via improper link resolution in User Profile Service) and CVE-2026-72971 (local tampering via Windows Container Isolation FS Filter Driver). In total, Microsoft patched 236 Windows vulnerabilities and numerous others across Office, SharePoint, Azure, Exchange, and other products.

References

securityweek.com/august-2026-patch-tuesday-microsoft-fixes-421-cves-one-exploited-zero-day/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 11 Aug 2026, 18:56 UTC

References

Community reviews

Related threats