Microsoft's August Patch Tuesday: 400 fixes, three zero-days, and Lazarus back in the frame

Key points

• Microsoft released fixes for 400 security flaws on 11 August 2026, including 42 rated Critical.
• One flaw, CVE-2026-68820 in the Windows AFD.sys driver, was already being used in real attacks by the North Korean group Lazarus.
• Two other zero-days were publicly disclosed before a patch existed, both letting a local user gain administrator rights.
• The Critical bucket is dominated by 37 remote code execution bugs, meaning flaws that let an attacker run their own code on a target machine.
• Microsoft says the higher count reflects an AI-powered bug-finding system it now runs across its own products.

Microsoft has pushed one of its heavier updates of the year. The August 2026 Patch Tuesday, the monthly bundle of security fixes Microsoft ships on the second Tuesday of each month, addresses 400 vulnerabilities across Windows, .NET, Azure, Office-adjacent products and more. The count doesn't include flaws fixed earlier in August in products such as Microsoft Teams, Entra and Power Apps.

Three of those flaws are zero-days. One is confirmed as being used in live attacks. The total is down from July's 570 but still well above Microsoft's historical average, and the company has said openly that an internal AI-powered vulnerability discovery system is now surfacing more bugs, pushing monthly totals up.

Which flaw is being actively exploited?

The live-exploited bug is CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), a low-level networking component built into every Windows machine.

An attacker who already has a foothold on a Windows PC can run a small program that trips a timing bug in that driver and hands them SYSTEM privileges, the highest level of access on the machine. No user clicks required.

Check Point researchers Moshe Marelus and David Driker reported the flaw. According to their writeup, the North Korean group Lazarus used it as a zero-day to install a new build of FudModule, a kernel-mode rootkit, meaning malware that lives inside the core of the operating system and is very hard to detect or remove. Microsoft hasn't published details of the intrusions. Lazarus's appetite for this kind of Windows kernel access isn't new: we reported on a separate North Korea-linked campaign targeting Korean websites on 30 July.

What are the two publicly disclosed zero-days?

Neither is currently known to be under attack, though both are already public knowledge.

The first sits in the Windows User Profile Service. An authenticated user with credentials for a second local account can load another user's registry hive and end up running commands as an administrator when that admin next signs in. The details match a bug a researcher using the handle Nightmare Eclipse published last month under the name "LegacyHive". Tharros principal vulnerability analyst Will Dormann previously flagged the same technique.

The second is a similar link-following bug in the Windows Container Isolation FS Filter Driver (unionfs.sys), credited to researchers yhw and txz. Both flaws let a low-privileged user tamper with another account's data and eventually gain administrator rights.

The three zero-days at a glance

Should you worry about the other flaws?

Of the 42 Critical items, 37 are remote code execution bugs. That ratio matters: RCE flaws are the ones attackers weaponise first, because they don't require a victim to hand over credentials.

One deserves a separate flag. CVE-2026-62818 is a Critical remote code execution bug in Active Directory Certificate Services, the Windows component organisations use to issue internal security certificates. It's exactly the sort of flaw ransomware crews queue up to exploit once a patch drops and the diff becomes public.

What should users and admins do?

Install the August updates now. The AFD.sys flaw is being used in the wild, and it pairs neatly with a phishing email or a malicious download to turn a small break-in into full machine control.

Home users on Windows 10 or Windows 11 should check Windows Update and reboot. Business admins should prioritise the AFD.sys patch on machines where users log in interactively, then work through the two disclosed privilege escalation bugs and the 37 Critical remote code execution items.

The patch-speed argument cuts both ways here. We reported on 23 July that Microsoft wants admins applying fixes within 72 hours. An actively exploited kernel rootkit is one of the stronger arguments for their side.