Microsoft August 2026 Patch Tuesday Fixes 398 Flaws, Exploited WinSock Zero-Day

Microsoft’s August 2026 Patch Tuesday security release addresses 398 CVEs, including three zero-day vulnerabilities and one Windows privilege-escalation flaw that has been exploited in the wild.

Tenable categorized the release as containing 42 Critical, 355 Important, and one Moderate vulnerability, although CVE totals vary between vendors depending on methodology and republished advisories.

The most urgent issue is CVE-2026-68820, an Important-rated elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for Winsock (AFD.sys).

The kernel-mode driver underpins Windows socket operations, making its compromise especially consequential for affected endpoints.

Microsoft August 2026 Patch Tuesday Fixes 398 Flaws

Microsoft confirmed exploitation of CVE-2026-68820. The flaw is a use-after-free vulnerability that a locally authenticated attacker can trigger after first obtaining code execution on a vulnerable system. Successful exploitation allows elevation to SYSTEM privileges, providing an attacker near-total control of the device.

While the flaw is not a remote code execution issue by itself, its operational impact is significant. Threat actors frequently chain local privilege-escalation vulnerabilities with phishing payloads, malicious documents, browser exploits, compromised remote-access credentials, or malware droppers.

In these attack chains, an initial low-privilege foothold can rapidly escalate to full administrative control, allowing attackers to disable security tools, steal credentials, deploy persistence mechanisms, or move laterally within a Windows domain.

Microsoft also resolved two publicly disclosed, but not actively exploited, vulnerabilities. CVE-2026-62832 affects the Windows User Profile Service and enables local privilege escalation. Microsoft rates the issue as Important, and Rapid7 assigns it a CVSS score of 7.8, with exploitation assessed as more likely.

The third zero-day, CVE-2026-72971, is an Important-rated tampering flaw in the Windows Container Isolation File System Filter Driver, unionfs.sys.

The defect results from improper link resolution before file access, a weakness categorized as CWE-59, or link following. A locally authenticated attacker could potentially tamper with files and weaken integrity protections expected in containerized Windows environments.

Microsoft assesses exploitation of CVE-2026-72971 as unlikely. However, organizations operating Windows container hosts should still prioritize remediation, especially where CI/CD agents, developer accounts, shared build infrastructure, or lower-privileged users have local access. Rapid7 lists the issue with a CVSS score of 5.5.

The August release extends well beyond Windows desktop and server systems. Notable fixes include CVE-2026-71331, a Critical remote code execution vulnerability affecting Windows Device Health Attestation, as well as Important flaws in SharePoint Server, .NET, PowerShell, Windows Installer, Windows Event Logging Service, Remote Desktop Client, NTFS, and Visual Studio Code.

Cloud and identity services also received updates, including Azure Active Directory, Azure SQL Database, Azure Kubernetes Service, Azure Service Bus, Microsoft Entra Provisioning Service, Azure Logic Apps, and Application Insights Profiler.

Several of these issues are rated Critical, raising the priority for organizations with hybrid Microsoft estates. Developer-facing systems warrant particular attention. Visual Studio Code and its Python extension received fixes for vulnerabilities related to remote code execution, information disclosure, and security-feature bypass.

In high-trust software-development environments, compromise of an IDE, extension, build agent, or source-management workstation can introduce downstream supply-chain risk.

Security teams should immediately deploy the August cumulative updates, beginning with internet-facing systems, administrator workstations, developer endpoints, domain-connected servers, and Windows devices where users can execute local code.

CVE-2026-68820 should be treated as the first remediation target because exploitation is already confirmed. Organizations should also review endpoint telemetry for anomalous privilege changes, suspicious driver interactions, unexpected SYSTEM-level processes, and post-exploitation activity, such as tampering with security controls or credential theft.