Microsoft's August 2026 Patch Tuesday: 421 CVEs and an Actively Exploited afd.sys Zero-Day

Microsoft's August 2026 Patch Tuesday is one of the heaviest single releases the company has ever shipped, and buried in it is the part that actually changes your week: a Windows kernel driver flaw that attackers were already using before the patch existed.

Microsoft's August 2026 Patch Tuesday shipped 421 CVEs (per Rapid7 and SecurityWeek; SANS ISC counts 418 and Krebs counts 398), 62 of them rated critical, and exactly one — CVE-2026-68820, a use-after-free in the afd.sys kernel driver — is already being exploited to escalate to SYSTEM. That single vulnerability, not the headline total, sets your patch order.

The One That's Already Being Used

CVE-2026-68820 is an elevation-of-privilege flaw carrying a CVSS score of 7.0 — a middling number that undersells it. It lives in afd.sys, the Ancillary Function Driver for WinSock, which is the kernel-mode plumbing behind the Windows Sockets API. The bug is a use-after-free triggered during network socket operations: an attacker who already has code running on the machine can race the driver into reusing freed memory and, from there, elevate a normal process to SYSTEM.

The defender translation is simple. This is not an entry point. An attacker needs a foothold first — a phished credential, a malicious document, a compromised app. What the flaw provides is the second step, the one that turns a limited user session into full control of the host. That is precisely the step that lets transient access become persistent, kernel-level access. Microsoft's advisory confirms in-the-wild exploitation, which is the only signal that should matter for sequencing your rollout this month.

afd.sys has a history here. It is a recurring target for privilege-escalation exploits precisely because it is loaded, network-adjacent, and reachable from low-privileged code. Treating a fresh afd.sys zero-day as urgent is a pattern worth keeping.

The Nation-State Angle

The Register tied the exploited zero-day to DPRK-linked activity — "the Norks," in its phrasing. The brief for this piece flagged the specific North Korean cluster as unconfirmed, but the live reporting has since firmed up: in a report published alongside the patches, Check Point attributes the exploitation of CVE-2026-68820 to the Lazarus group and says the actors used it to deploy a new version of FudModule, Lazarus's kernel-mode rootkit, after luring a target with a fake job offer.

Two caveats belong on that attribution. It comes from one vendor's incident reporting, not from Microsoft, which has not named a threat actor. And no victims have been publicly identified. The through-line that survives the uncertainty is the tradecraft: a nation-state actor pairing a social-engineering foothold with a kernel EoP to install a rootkit is a well-worn playbook, and it is the reason a 7.0 gets treated like a far higher number.

Two Publicly Disclosed, Not Yet Exploited

Alongside the exploited flaw, Microsoft fixed two elevation-of-privilege issues that were publicly disclosed before a patch shipped — meaning the details were already circulating, which shortens the runway to weaponization even though no exploitation has been observed yet.

CVE-2026-62832 is an elevation-of-privilege flaw in the Windows User Profile Service that yields administrator rights on the local machine; The Hacker News notes the disclosed details line up with a researcher-published issue circulating last month. CVE-2026-72971 is a tampering flaw in the Windows Container Isolation FS Filter Driver, unionfs.sys. Neither has been seen in attacks, but public disclosure is exactly the condition that lets a proof-of-concept mature into a working exploit quickly.

The Rest of the Release

Set the three zero-days aside and this is still a very large month. Talos and SANS ISC both count 62 vulnerabilities marked critical, and Rapid7 puts 236 of the fixes in Windows itself. The spread in the top-line total — 421 versus 418 versus 398 — is not a contradiction; it comes from how each outlet counts bundled browser (Chromium/Edge) and dependency CVEs, so pick one methodology and stay consistent rather than chasing the biggest number.

The critical-rated bucket is where remote code execution tends to concentrate, and those are the flaws to rank by exposure: internet-facing services first, then widely deployed internal software, then everything else. But none of the 62 critical flaws has known exploitation, and one 7.0 does — which is why severity score alone is the wrong sort order this month.

Patch Priority, in Order

My read: the 421 headline is the wrong thing to react to. The number that should drive action is one: a CVSS 7.0 that a nation-state actor was already using to install a rootkit. Severity scores describe worst-case theory; a confirmed in-the-wild flag describes what is happening now, and this month those two signals point at different CVEs. Sort by the second one. The publicly disclosed pair is the near-term watch list — disclosure without a patch is the exact window where researchers and criminals build the exploit that did not exist yesterday. Everything else is a volume problem, and volume problems get solved by exposure-based ranking, not by starting at the top of an alphabetical list.

What to Verify

Confirm your rollout against Microsoft's Security Update Guide rather than any single summary, since the counts differ by source. As of publication, CVE-2026-68820 had not yet appeared in CISA's Known Exploited Vulnerabilities catalog — but given Microsoft's confirmation of active exploitation, a KEV listing (and the federal remediation deadline that comes with it) is a reasonable expectation in the days ahead. Watch that catalog and treat the afd.sys fix as already past due regardless.

This release lands in a run of high-severity, exploited-in-the-wild flaws we have tracked recently — from Cisco's dozen Catalyst SD-WAN and IOS XE flaws rated up to CVSS 9.9 to the Progress Kemp LoadMaster flaw that CISA added to KEV after nearly 800 exploit attempts. The common thread is the same each time: the vendor's severity label and the exploitation reality are two different inputs, and defenders who patch by the second one stay ahead.

Primary Documents

• Microsoft Security Response Center — CVE-2026-68820 advisory (afd.sys)
• Microsoft Security Response Center — CVE-2026-62832 (Windows User Profile Service)
• Microsoft Security Response Center — CVE-2026-72971 (unionfs.sys)
• Check Point Research — exploitation of CVE-2026-68820 by Lazarus
• Rapid7 — Patch Tuesday, August 2026
• Cisco Talos — Microsoft Patch Tuesday for August 2026
• SANS Internet Storm Center — Microsoft Patch Tuesday August 2026
• SecurityWeek — Microsoft Fixes 421 CVEs, One Exploited Zero-Day
• Krebs on Security — Microsoft Plugs Nearly 400 Security Holes
• CISA — Known Exploited Vulnerabilities Catalog