Microsoft patches 400+ vulnerabilities, one zero-day under attack (CVE-2026-68820)
Microsoft’s August 2026 Patch Tuesday delivered security fixes for 400+ vulnerabilities, including one that has been exploited in zero-day attacks (CVE-2026-68820) and three that were publicly disclosed prior to the release of the patches.
Vulnerabilities of note
CVE-2026-68820 is a use-after-free flaw that affects the Windows Ancillary Function Driver for WinSock (AFD.sys) and allows a low-privileged local attacker to elevate privileges to SYSTEM.
“A locally authenticated attacker could run a specially crafted application on an affected system to trigger a race condition,” Microsoft explained. “User interaction is not required.”
Check Point researchers reported that the vulnerability has been exploited by North Korean attackers to deploy a kernel-mode rootkit in a new wave of the Operation Dream Job campaign.
The three publicly disclosed vulnerabilities are:
CVE-2026-62832, a vulnerability in the Windows User Profile Service that may allow an authenticated attacker to achieve Admin privileges by running a specially crafted application.
“This is the flaw behind ‘LegacyHive,’ the unpatched proof-of-concept released by researcher Nightmare-Eclipse just hours after July’s Patch Tuesday,” commented Chris Goettl, VP of Product Management for security products at Ivanti.
“This vulnerability lets a standard user coerce the User Profile Service into loading another user’s registry hive – including an administrator’s – to gain unauthorized access to that user’s Classes registry data.”
CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys), which may allow authenticated attackers to tamper with a vulnerable system. (This one only affectes Windows 11 versions for ARM64-based Systems.)
Crowdstrike flagged a third vulnerability that was publicly disclosed before the patch was made available: CVE-2026-62737, a elevation of privilege vulnerability affecting the Windows kernel
“While not officially recognized by Microsoft as publicly disclosed, a Chinese-language blog was published on August 9, 2026, describing a proof-of-concept exploit that can cause a system crash,” the company noted.
Other vulnerabilities of note fixed this month include:
CVE-2026-62815, a critical Microsoft QUIC vulnerability that can be exploited by unauthenticated attackers by sending a specially crafted packet to an affected service over the network. “Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required,” Microsoft says.
CVE-2026-62878, a stack-based buffer overflow vulnerability in Windows DNS that can lead to remote code execution. This one can also be easily, reliably and remotely exploited by unauthenticated attackers.
CVE-2026-63520, in Microsoft Sharepoint, discovered by Rapid7 researchers. It can be used in conjunction with CVE-2026-55040, a previously patched Sharepoint flaw, to achieve unauthenticated remote code execution against a vulnerable server.
A Microsoft Defender patch-bypass
In related news, the security researcher who goes by “Nightmare Eclipse” released a proof-of-concept (PoC) exploit that ostensibly bypasses the patch for CVE-2026-50656, the “RoguePlanet” Microsoft Defender vulnerability the company pushed out in July 2026.
Dubbed “ShieldBreak” by the researcher, the vulnerability professedly affects Windows 11, 10 and Windows Server 2025. Vulnerability analyst Will Dormann confirmed that the PoC exploit works if Defender is enabled.
Don’t rush and test patches
“This volume of updates indeed seems to be the new normal – at least for now. What is interesting is that, while there is an explosion of bugs being reported (and fixed), there has been no equivalent increase in the number of bugs being actively exploited, at least as 0-days,” says Dustin Childs, head of threat awareness at TrendAI’s Zero Day Initiative.
He also pointed out that Microsoft listing actively exploited bugs as “Unproven” or downplaying working Pwn2Own exploits may force security teams to perform independent risk triage.
Ivanti’s Goettl says that the patches need to be triaged to identify CVEs that require immediate attention and that organizations need to remember that CVEs with high CVSS scores but which are not exploited or are not in internet-facing systems can be handled in a second round of patching.
Tyler Reguly, Associate Director, Security R&D at Fortra, says that despite the latest mega-updates, IT admins and security teams should keep calm and not rush updates: “You need to make sure that you are rolling out safe updates that will not negatively impact your systems.”
His advice for CISOs is to talk to their teams about how they are shifting or modifying their workflows to better accommodate this patching shift, and support them by enabling the changes they want to see made.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!