August 2026 Patch Tuesday: Microsoft Patches 421 Flaws, Including Exploited afd.sys Zero-Day
Microsoft released its August 2026 Patch Tuesday updates on Tuesday, addressing a staggering 421 CVEs across its product portfolio, including a high-severity use-after-free vulnerability in the Ancillary Function Driver for WinSock (afd.sys) that has already been exploited in the wild as a zero-day. Tracked as CVE-2026-68820, the kernel-mode driver flaw enables a locally authenticated attacker to execute a specially crafted application, triggering a race condition that escalates privileges to SYSTEM without requiring user interaction. According to Tenable senior staff research engineer Satnam Narang, historical tradecraft targeting afd.sys suggests nation-state involvement, noting that three other afd.sys zero-days have been exploited in the wild since 2022, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193, the latter reportedly linked to North Korean Lazarus Group actors.
The release also spotlights CVE-2026-62832, an improper link resolution vulnerability in Windows User Profile Service that Microsoft flagged as publicly disclosed and likely to be weaponized imminently. The flaw allows an authenticated attacker with credentials for another local account to load that user's registry hive, granting access to sensitive data and administrator privileges. A second publicly disclosed bug, CVE-2026-72971, involves a link-following issue in the Windows Container Isolation FS Filter Driver (unionfs.sys), though Microsoft assesses exploitation as unlikely. Defenders are urged to prioritize four additional remote code execution vulnerabilities: CVE-2026-62878 in Windows DNS Server, CVE-2026-62893 in Windows Deployment Services TFTP Server, CVE-2026-62815 in Microsoft QUIC, and CVE-2026-59124 in Microsoft HPC Pack, along with CVE-2026-62911, an elevation-of-privilege flaw in Exchange Server flagged by ZDI's Dustin Childs.
In total, the August updates resolve 236 flaws in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, and 1 in Defender, plus fixes for two non-Microsoft CVEs. Administrators managing network-facing infrastructure should verify exposed services immediately using a port scanner to identify any publicly reachable DNS or TFTP servers, while security teams should run a DNS leak test to confirm resolver integrity on patched systems. Given the credential-based attack vector demonstrated by CVE-2026-62832, organizations should also enforce strong credential hygiene with a password checker to ensure local account passwords resist brute-force attempts targeting these newly disclosed privilege escalation paths.