Microsoft's August Patch Tuesday: 400 fixes, three zero-days, and Lazarus back in the frame
Microsoft ships fixes for 400 flaws, including one AFD.sys hole North Korean hackers were already using to plant a kernel rootkit.
Key points
- Microsoft released fixes for 400 security flaws on 11 August 2026, including 42 rated Critical.
- One flaw, CVE-2026-68820 in the Windows AFD.sys driver, was already being used in real attacks by the North Korean group Lazarus.
- Two other zero-days were publicly disclosed before a patch existed, both letting a local user gain administrator rights.
- The Critical bucket is dominated by 37 remote code execution bugs, meaning flaws that let an attacker run their own code on a target machine.
- Microsoft says the higher count reflects an AI-powered bug-finding system it now runs across its own products.
Microsoft has pushed one of its heavier updates of the year. The August 2026 Patch Tuesday, the monthly bundle of security fixes Microsoft ships on the second Tuesday of each month, addresses 400 vulnerabilities across Windows, .NET, Azure and Office-adjacent products.
Three of those flaws are zero-days, meaning bugs that were either already being exploited or publicly described before Microsoft had a fix ready. One is confirmed as being used in live attacks.
The count is down from July's 570 but still well above Microsoft's historical average. The company has said openly that an internal AI-powered vulnerability discovery system is now surfacing more bugs across its codebase, which is pushing monthly totals up.
Which flaw is being actively exploited?
The live-exploited bug is CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), a low-level networking component built into every Windows machine.
In plain terms: an attacker who already has a foothold on a Windows PC can run a small program that trips a timing bug in that driver and hands them SYSTEM privileges, the highest level of access on the machine. No clicks from the user required.
Check Point researchers Moshe Marelus and David Driker reported the flaw. According to their writeup, the North Korean group Lazarus used it as a zero-day to install a new build of FudModule, a kernel-mode rootkit, meaning malware that lives inside the core of the operating system and is very hard to detect or remove. Microsoft has not published details of the intrusions.
What are the two publicly disclosed zero-days?
Both are local privilege escalation bugs. Both need an attacker to already have valid credentials on the machine. Neither is currently known to be under attack.
The first sits in the Windows User Profile Service. A user with credentials for a second local account can load another user's registry hive and end up running commands as an administrator when that admin next signs in. The details line up with a bug that a researcher using the handle Nightmare Eclipse published last month under the name "LegacyHive". Tharros principal vulnerability analyst Will Dormann previously flagged the same technique.
The second is a similar link-following bug in the Windows Container Isolation FS Filter Driver (unionfs.sys), credited to researchers yhw and txz. First reported by BleepingComputer, both flaws let a low-privileged user tamper with another account's data and eventually gain administrator rights.
The three zero-days at a glance
| CVE | Component | Status | Impact |
|---|---|---|---|
| CVE-2026-68820 | AFD.sys (WinSock driver) | Exploited by Lazarus | SYSTEM privileges |
| User Profile Service flaw | Windows User Profile Service | Publicly disclosed ("LegacyHive") | Administrator privileges |
| unionfs.sys flaw | Container Isolation FS Filter Driver | Publicly disclosed | Administrator privileges |
What should users and admins do?
Install the August updates now, not next weekend. The AFD.sys flaw is being used in the wild, and it is the kind of bug that pairs neatly with a phishing email or a malicious download to turn a small break-in into full control of the machine.
Home users on Windows 10 or Windows 11 should check Windows Update and reboot. Business admins should prioritise the AFD.sys patch on any machine where users log in interactively, then work through the two disclosed privilege escalation bugs and the 42 Critical items, starting with the 37 remote code execution flaws.
One practical note for anyone running Active Directory Certificate Services: CVE-2026-62818 is a Critical remote code execution bug in AD CS and deserves a fast look. It is exactly the sort of flaw ransomware crews queue up once a patch drops.
