Microsoft closes 400 security holes – three zero-days in August update

Microsoft has released the security updates for Patch Tuesday in August 2026. A total of 400 vulnerabilities are addressed, including 42 critical security flaws and three zero-day vulnerabilities. One of these has already been exploited in active attacks.

August's Patch Tuesday is one of the more comprehensive security updates of the year from Microsoft. The updates cover a wide range of products and components in the Microsoft ecosystem and contain fixes for security vulnerabilities that could be exploited for everything from privilege escalation and information leakage to remote code execution.

Of the 400 vulnerabilities addressed, 42 are classified as critical. Of these, 37 could allow remote code execution and five could be used to elevate an attacker's privileges.

For businesses and organizations, the scope means the August update should be given high priority, especially since one of the fixed zero-day vulnerabilities has already been exploited in real-world attacks.

Three zero-days are fixed

Three zero-day vulnerabilities are at the center of this month's security update. One of them has been actively exploited in attacks, while two others were disclosed before a security update was available.

The most urgent is CVE-2026-68820, a vulnerability in the Windows Ancillary Function Driver for WinSock, AFD.sys.

The vulnerability could be exploited locally by an authenticated attacker to elevate their privileges on a Windows system. A successful attack could allow the attacker to gain SYSTEM privileges, which would allow them to take very broad control over the affected device.

The vulnerability does not require any interaction from the user to be exploited.

CVE-2026-68820 has been linked to attacks where the North Korean threat actor Lazarus has used the vulnerability to distribute a new version of FudModule, an advanced rootkit that works at the Windows kernel level.

This makes the vulnerability particularly important to prioritize in organizations with Windows environments.

Vulnerability in Windows User Profile Service

The second zero-day vulnerability is CVE-2026-62832 and is located in the Windows User Profile Service.

An authenticated attacker who has access to credentials for another local account could, under certain circumstances, exploit the vulnerability to access or modify another user's data and elevate their privileges.

The vulnerability had been publicly disclosed before Microsoft's fix became available, but there is currently no evidence that it has been actively exploited in attacks.

Windows Container Isolation is affected

The third zero-day vulnerability is CVE-2026-72971 and affects the Windows Container Isolation FS Filter Driver, unionfs.sys.

This security flaw was also made public before a fix was available.

The vulnerability can be exploited locally by an authenticated attacker and is another example of why organizations need to include underlying Windows components in their ongoing patch management.

110 vulnerabilities could allow remote code execution

The zero-day vulnerabilities make up only a small part of August's comprehensive security package.

Among the 400 security issues fixed are approximately:

• 176 vulnerabilities which can be used for privilege escalation
• 110 vulnerabilities which can enable remote code execution
• 86 vulnerabilities which can lead to information leakage
• 21 spoofing vulnerabilities
• 12 vulnerabilities linked to denial of service attacks
• 11 vulnerabilities which can be used to bypass security features

Remote code execution, in particular, is an important category for security teams to review. Such vulnerabilities could, in some situations, allow an attacker to run malicious code on a system without first having complete control of the device.

Critical flaws in several Microsoft products

The security updates affect significantly more than just traditional Windows components.

Products and services covered include Microsoft Office, Azure, Windows DHCP Server, Windows DNS, Windows Deployment Services, and Windows Secure Socket Tunneling Protocol.

Several of the security flaws in these components are classified as critical and could allow remote code execution.

For organizations with larger Microsoft environments, it is therefore important to not only focus on client computers. Servers, identity services, network components and cloud-based systems also need to be included in the assessment.

Windows 10 also receives security updates

Microsoft has simultaneously distributed KB5120249 for Windows 10 version 22H2 and 21H2 within the Extended Security Updates, ESU, program.

The update contains the security fixes from August's Patch Tuesday and is mandatory for affected systems within the ESU program.

Windows 11 also receives cumulative updates that contain the month's security patches.

This is especially relevant for companies that still have Windows 10 systems in production and are using ESU to continue receiving security updates.

A continued high number of security vulnerabilities

August's 400 fixes come after an unusually extensive Patch Tuesday in July.

In July 2026, Microsoft corrected about 570 vulnerabilities, including three zero-days. Two of these had already been exploited in attacks.

This means that in just two months, Microsoft has handled nearly a thousand reported security issues.

The large number of fixes also underscores how important structured vulnerability management work has become for organizations with extensive Microsoft environments.

Just because an update is available doesn't automatically mean the risk is gone. Security teams also need to ensure that the update actually reaches affected systems and that the installation has been completed correctly.

Companies should prioritize the actively exploited vulnerability

For IT and security managers, CVE-2026-68820 be high on the priority list because the vulnerability has already been exploited in attacks.

Organizations should also map which systems are affected by the August update and prioritize fixes based on exposure, criticality, and risk of exploitation.

In larger environments, updates should first be validated against mission-critical systems before broad deployment. Once testing is complete, security updates should be deployed as quickly as the organization's patching process allows.

Systems that cannot be updated immediately should be subject to enhanced monitoring and other risk mitigation measures until the patches can be installed.

Patch Tuesday August 2026 in brief

400 security flaws fixed

42 vulnerabilities are classified as critical

37 critical vulnerabilities could allow remote code execution

176 vulnerabilities can be used for privilege escalation

110 vulnerabilities could allow remote code execution

86 vulnerabilities could lead to information leaks

Three zero-day vulnerabilities are patched

A zero-day has already been exploited in active attacks

CVE-2026-68820 is the highest priority vulnerability in this month's update