Microsoft Patch Tuesday August 2026 Explained: What to Patch First

Microsoft's Patch Tuesday August 2026 release landed yesterday with a Windows kernel-level zero-day already being exploited in the wild. The Microsoft Patch Tuesday August 2026 zero-day drawing the most attention is CVE-2026-68820, a use-after-free flaw in the WinSock driver, confirmed under active attack and the clear must-patch item in a release that touches Azure, Exchange, SharePoint, and GitHub Copilot alongside the usual Windows and Office components (Security Affairs).

Counting the Microsoft August 2026 vulnerabilities depends on who's doing the counting. Security Affairs, CSO Online, and ZDI put the total at 398 new CVEs, while SecurityWeek counts 421, apparently using a broader accounting method; Critical-rated bugs land somewhere between 42 and 62 depending on the source (Security Affairs; CSO Online; ZDI; SecurityWeek). Anyone reconciling exact figures for a compliance report should treat that range as directional rather than exact.

Two more zero-days were publicly disclosed before Microsoft shipped fixes, and researchers demonstrated a working exploit against Exchange Server at Pwn2Own Berlin earlier this year. That combination matters: not-yet-exploited doesn't mean safe to wait, particularly once technical detail is already public (BleepingComputer; ZDI). What follows is a look at which vulnerabilities deserve the fastest response, why a "local access only" label undersells the exploited flaw, and how to make sense of a patch load ZDI's Dustin Childs describes simply as "the new normal" (ZDI).

CVE-2026-68820: the actively exploited Windows WinSock vulnerability

The CVE-2026-68820 Windows WinSock vulnerability lives in afd.sys, the Ancillary Function Driver for WinSock, a kernel-mode component that underlies nearly all Windows network socket activity. Winning a race condition against this driver lets a locally authenticated attacker gain SYSTEM privileges, the highest level of access on a Windows machine (Security Affairs; SecurityWeek).

Microsoft's own paperwork contains a wrinkle worth flagging. The company confirms active exploitation but lists exploit-code maturity as "Unproven" in its CVSS metadata, a mismatch ZDI's Dustin Childs called out directly (ZDI).

Check Point has reportedly tied the exploitation to North Korea's Lazarus group, saying attackers used the bug to deploy an updated version of the FudModule kernel rootkit, according to BleepingComputer. That's Check Point's attribution as reported, not yet independently verified. It fits a pattern Tenable has tracked: senior staff research engineer Satnam Narang notes this is the fourth afd.sys zero-day exploited in the wild since 2022, following CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193, the last of which was also linked to Lazarus (SecurityWeek). Tenable adds that this kind of tradecraft is typically the work of APT groups running limited, targeted campaigns rather than broad criminal sweeps (CSO Online).

Local privilege escalation sounds like a lesser threat than remote code execution, but it's the tool nation-state actors reach for once they've already gained a foothold on a machine. Action1's Jack Bicer calls it "the highest priority vulnerability in this month's release" (CSO Online).

CVE-2026-62878 and the unauthenticated network RCEs

If the WinSock bug is about attackers who already have a foothold, this next cluster is about keeping them from getting one in the first place. The CVE-2026-62878 Windows DNS Server vulnerability lets a remote, unauthenticated attacker execute code with elevated privileges, no user interaction required. Security Affairs describes the underlying stack-based buffer overflow as potentially wormable (Security Affairs).

Three more flaws round out this tier. CVE-2026-62893 hits the TFTP server in Windows Deployment Services; TFTP has no authentication mechanism and runs over UDP port 69, so while blocking that port at the perimeter helps, ZDI warns it remains a usable path for lateral movement once an attacker is already inside a network (ZDI). CVE-2026-62815, an unauthenticated RCE in Microsoft's QUIC implementation, matters because QUIC is the transport layer underneath HTTP/3, a protocol ZDI estimates roughly 13.5 million websites depend on (ZDI).

Action1's Bicer groups DNS Server, QUIC, the iSCSI Target Service (CVE-2026-65791), and WDS TFTP together as CVSS 9.8 vulnerabilities, warning that "a malicious network request or packet could potentially lead directly to code execution" (CSO Online). None of the four is confirmed exploited yet. But Bicer says a significant portion of this month's risk comes precisely from critical bugs reachable remotely without authentication or user interaction, which is why this group sits near the top of most triage lists (CSO Online).

Public disclosure and Pwn2Own exploits

A vulnerability doesn't need confirmed in-the-wild exploitation to deserve fast action. Public technical detail or a demonstrated exploit compresses the patch-to-attack timeline just as effectively. CVE-2026-62832, an elevation-of-privilege bug in Windows User Profile Service, matches a proof-of-concept called "LegacyHive" that researcher Nightmare-Eclipse released just hours after last month's Patch Tuesday. Microsoft assesses exploitation as more likely, and the flaw could let a standard user coerce the system into loading another user's registry hive, potentially gaining administrator access (CSO Online; BleepingComputer).

CVE-2026-72971, a tampering flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys), was also disclosed publicly. Microsoft rates exploitation as less likely here, but Ivanti recommends prioritizing the fix anyway for any organization running Windows containers, build agents, or CI infrastructure, since public disclosure ahead of a patch means exploit code could follow quickly (SecurityWeek; CSO Online).

The most consequential case in this tier is CVE-2026-62911, an Exchange Server elevation-of-privilege and authentication-bypass bug demonstrated with working exploit code at Pwn2Own Berlin. ZDI's advice is blunt: ignore Microsoft's exploitability rating on this one, "we handed them working exploits." Successful exploitation could let an attacker take over every mailbox on the server, reading, sending, and downloading attachments across every user account (ZDI).

Microsoft Patch Tuesday August 2026: which updates to prioritize

Logically's Zack Finstad puts the volume problem in perspective. "Volume alone is not the same as risk," he said. "The practical move is to triage by exploitation status and internet exposure first, then work outward. A CVE that is already being exploited in the wild against internet-facing systems deserves a very different response than a theoretical local privilege escalation on an isolated workstation" (CSO Online).

Based on the analyst guidance gathered this week, a practical rollout order looks like this:

• CVE-2026-68820 immediately: exploitation is already confirmed (CSO Online).
• CVE-2026-62832 next: publicly disclosed, with Microsoft assessing exploitation as more likely (CSO Online; SecurityWeek).
• Unauthenticated, low-complexity RCEs after that: DNS Server, QUIC, iSCSI, and WDS TFTP, especially on internet-facing or PXE-enabled systems (CSO Online).
• Exchange and other high-exposure services rounding out the list: the demonstrated Pwn2Own exploit against Exchange Server, plus container infrastructure and any other publicly disclosed flaw touching business-critical systems (ZDI; SecurityWeek).

No documented workaround exists for any of these vulnerabilities, so Action1's Bicer says patch deployment is the primary risk-reduction measure available. For systems that can't be patched on schedule, he recommends segmentation, exposure reduction, monitoring, and documented risk acceptance in the interim (CSO Online).

The scale of the release breaks down more manageably than the headline number suggests. Fortra's Tyler Reguly notes that 236 CVEs affect Windows and ship in a single cumulative update, while roughly 98 land in Office and get resolved through separate Office cumulative updates. Most of the "nearly 400" figure making headlines is resolved through a handful of routine installs, not hundreds of individual decisions (CSO Online).

Conclusion

One actively exploited zero-day, a publicly disclosed flaw already assessed as a likely target, a cluster of unauthenticated network RCEs, and a wide tail of routine fixes resolved by standard cumulative updates: that's the shape of this release once the volume is triaged rather than tallied (Security Affairs; CSO Online).

ZDI's Dustin Childs offers a data point worth remembering past this month's patch cycle: bug counts keep climbing, but the number of zero-days under active attack each month hasn't risen at the same pace (ZDI).

The next Patch Tuesday lands September 8, right after Labor Day in the US. Organizations that build asset-inventory-driven triage now, rather than reacting fresh to whatever raw CVE count shows up next month, will be better positioned when that release arrives (ZDI).