August 2026 Patch Tuesday: 421 CVEs and One Exploited Zero-Day

Two towering stacks of labelled paper files with handwritten date tabs on their edges — illustrative of a monthly patch load large enough to be counted three different ways. Photo by myrfa on Pixabay

CYBERSECURITY · 12 Aug 2026 —

REDMOND, 11 AUG 2026 — Microsoft's August update fixes 421 flaws, or 400, or 394, depending on which report you read. All three numbers are defensible. Only one of the bugs is being exploited, and North Korea got there first.

The exploited flaw is CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock — afd.sys, the driver that sits under every socket the operating system opens.

Why the totals disagree

This is worth settling first, because a reader comparing two headlines will conclude one of them is wrong. Neither is.

421Bugs in Microsoft's own products, the count The Register and SecurityWeek use.

400BleepingComputer's figure, which excludes flaws in Mariner, Teams, Azure, Entra, Office and Power Apps fixed earlier in the month.

394A third count in circulation, narrower again.

622July's total. August is roughly 200 fewer, and still historically enormous.

The counts differ because "a Patch Tuesday CVE" is not one thing. Cloud services get patched continuously and are folded in or left out depending on the tallier; browser flaws are sometimes counted with Edge's own cadence; and products shipped outside the monthly cycle can be attributed to the month they landed or the month they were bundled.

The upshot: month-on-month comparisons are only meaningful if you stick to one publication's counting rule. Take the trend from a single source and ignore the absolute number.

The one that matters

Volume is a distraction. Of 421 flaws, exactly one is known to have been used against anybody.

CVE-2026-68820 is a race condition: the exploit turns on how afd.sys handles a socket created while several threads reach it at once. Winning that race gives code execution with SYSTEM privileges and, in Microsoft's description, no user interaction required.

North Korea's Lazarus Group was exploiting it as a zero-day from June. For roughly two months, the flaw was live, unknown, and unpatched. Anyone hit during that window was compromised by a bug with no public name or number.

It is a local privilege escalation, not remote code execution, so it is not a worm. It is the second half of an intrusion: something else gets a foothold, this turns that foothold into SYSTEM.

The other two zero-days

Both were publicly disclosed before the patch, and neither is known to be exploited.

CVE-2026-62832 is an elevation-of-privilege flaw in the Windows User Profile Service. An attacker with credentials for another local account can run a crafted application that loads a different user's registry hive, potentially reaching administrator. It matches the publicly known "LegacyHive" issue.

CVE-2026-72971 is a link-following flaw in the Windows Container Isolation FS Filter Driver, also elevation of privilege.

These three zero-days reflect the pattern of the whole release. Elevation of privilege is the single largest category, accounting for 176 of the flaws. Attackers are not mostly hunting for ways in. They are hunting for ways up.

Why the numbers got so large

The Register attributes the volume to AI-assisted vulnerability discovery and fixing becoming standard practice, and calls the elevated count "the new norm".

Plausible, but with a caveat: a rising CVE count is not the same as rising risk. It can mean more bugs are being found in code that already had them, which is the system working. It can also mean disclosure is outpacing the ability of anyone downstream to act.

For a defender, 421 CVEs a month is not a threat measurement. It is a workload measurement, and the workload has roughly doubled against historical norms without anyone's patching capacity doubling.

What to do with this

Triage by exploitation, not by count or by severity rating.

One flaw here is being used in the wild. That is the one with a deadline attached, and under the three-day federal remediation regime we wrote about earlier today it is also the shape of bug that arrives with a compromise-assessment obligation for US agencies.

The next tier down is the "critical" list: 42 flaws, including 37 for remote code execution and 5 for elevation of privilege, by BleepingComputer's tally. Worth checking against what you actually expose. Most of the rest are elevation of privilege on systems an attacker has to reach first. We have not subtracted one count from another here, because the critical figure and the 421 headline come from different counting rules, and mixing them produces a number that means nothing.

Zero Day Initiative flagged five further bugs as notable beyond the two Microsoft itself highlighted, which is a useful second opinion when a vendor's own "notable" list runs to two entries out of 421.

What to watch

Whether CVE-2026-68820 shows up in commodity tooling. Once a patch reveals the underlying bug, a state-actor's exploit often gets copied into commodity malware.

Whether the monthly count keeps falling. August is down about 200 from July's 622, and two months is not a trend — but if AI-assisted discovery is the cause, the interesting question is whether the backlog is being drained or the rate is simply settling higher than it used to be.

Priya Nair’s Verdict Cybersecurity

Ignore the headline number and read the exploitation column. Of 421 flaws exactly one is being used against anybody, and Lazarus had it as a zero-day from June — which means the two months before this patch were the dangerous period, not the two weeks after it. CVE-2026-68820 is a local privilege escalation, so it is not a worm; it is the second half of an intrusion, the step that turns a foothold into SYSTEM. The count disagreement is worth understanding rather than resolving. 421, 400 and 394 are all defensible because a Patch Tuesday CVE is not one thing: cloud services get folded in or left out, browser flaws follow their own cadence, and out-of-band fixes are attributed to whichever month suits the tallier. The practical rule is that month-on-month comparisons only mean something within a single publication's counting rule. What I would take to a planning meeting is the shape, not the size: 176 of these are elevation of privilege, the largest single category. Attackers are mostly not hunting for ways in any more. They are hunting for ways up.

Sources & cross-checks

Primary: The Register, 11 August 2026 — for Microsoft addressing 421 bugs in its own products, “about 200 fewer CVEs than last month” against July's 622, attributed to AI-assisted vulnerability disclosures becoming the norm; CVE-2026-68820 being a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) exploited as a zero-day by North Korea's Lazarus Group from June, allowing an attacker to “execute code with SYSTEM-level privileges, and with no user interaction required” by exploiting “how afd.sys handles a socket is created when it is accessed concurrently by several threads at once”; CVE-2026-62832 letting an authenticated attacker with another local account's credentials load another user's registry hive; and Trend Micro's Zero Day Initiative flagging five further notable bugs beyond the two Microsoft itself highlighted.
Also primary: BleepingComputer — for a total of 400 flaws on its counting rule, which it states “does not include some flaws in Mariner, Microsoft Teams, Microsoft Azure, Microsoft Entra, Microsoft Office, and Power Apps that were fixed by Microsoft earlier this month”; three zero-days of which one is actively exploited and two publicly disclosed; 42 critical flaws (37 remote code execution, 5 elevation of privilege); the type breakdown of 176 elevation of privilege, 110 remote code execution, 86 information disclosure, 21 spoofing, 12 denial of service and 11 security feature bypass; and CVE-2026-72971 as a link-following elevation-of-privilege flaw in the Windows Container Isolation FS Filter Driver.
The discrepancy: ⚠ A third figure, 394, is also in circulation. We have not adopted a single total: the article reports all three and explains why they differ, because a reader comparing headlines would otherwise conclude one outlet is wrong. We also deliberately do not subtract the 42 critical flaws from the 421 headline, since those two numbers come from different counting rules and the difference would be meaningless. Note that BleepingComputer's own type breakdown sums to 416 rather than 400, which is consistent with categories being drawn from a slightly wider set than the headline total.
What could not be established: ⚠ We did not read Microsoft's own Security Update Guide, so every count here is a publication's tally rather than the vendor's. We could not establish how many organisations were affected by the exploited flaw during the June–August window, which of the five ZDI-flagged bugs they are, whether any of the three zero-days affect supported server editions specifically, or the absolute severity distribution behind the critical count. We sought comment from Microsoft.
Method and limits: Compiled 11 August 2026. The explanation of why the totals diverge, the argument that month-on-month comparisons are only valid within one counting rule, the reading of a local privilege escalation as the second half of an intrusion rather than a worm, the observation that a rising CVE count measures workload rather than risk, and the triage advice are RECATOOLS analysis rather than claims by any source. This is defensive reporting: no exploit detail or reproduction step appears here beyond the published description.

Tags: #Cybersecurity #Microsoft #Patch-Management #Vulnerabilities

Cyber Team

Cybersecurity Desk

Cyber Team is RECATOOLS’ cybersecurity desk, covering vulnerabilities, breaches, threat intelligence, and practical security guidance.

View author profile → · Editorial policy

About this byline Cyber Team is a specialist RECATOOLS editorial desk focused on cybersecurity coverage. Articles are produced and reviewed under RECATOOLS editorial supervision.

Corrections policy