Microsoft Patches 398 Windows Flaws Including Actively Exploited WinSock Zero-Day

Microsoft has released its August 2026 Patch Tuesday security updates, addressing 398 CVEs across Windows, Office, SharePoint Server, Azure services, .NET, PowerShell, Visual Studio Code, and other enterprise products.

The release includes three zero-day vulnerabilities, one of which is an elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock that is being actively exploited in the wild.

The actively exploited issue, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock (AFD.sys), a kernel-mode component responsible for handling socket operations.

Microsoft Patches 398 Windows Flaws

Microsoft rates the flaw as Important, but its confirmed exploitation and potential to provide SYSTEM-level privileges make it the highest-priority remediation target in this month’s cycle.

CVE-2026-68820 is a use-after-free vulnerability that an authenticated attacker can exploit locally.

Successful exploitation requires code execution on a vulnerable Windows device first; however, an attacker who triggers the flaw can elevate their privileges to SYSTEM, gaining near-complete control over the endpoint.

Such local privilege-escalation bugs are commonly chained with phishing, malicious documents, browser exploits, or remote-access compromises, converting an initial foothold into full administrative access.

However, observed activity involving the WinSock zero-day in the Lazarus Group’s Operation Dream Job campaign underscores the value of immediate patch deployment in organizations with exposed or high-value Windows endpoints.

In addition to CVE-2026-68820, Microsoft fixed two publicly disclosed vulnerabilities that were not known to be exploited at the time the patches were released.

CVE-2026-62832 affects the Windows User Profile Service and allows local privilege escalation. Microsoft lists it as Important, making it relevant to endpoint teams even though no active exploitation has been publicly confirmed.

The third zero-day, CVE-2026-72971, is an Important-rated tampering vulnerability in the Windows Container Isolation File System Filter Driver, unionfs.sys. The vulnerability stems from improper link resolution before file access, also known as link following or CWE-59.

A locally authenticated attacker could exploit it to tamper with files, potentially weakening the integrity boundaries expected in Windows containerized environments.

Microsoft assesses exploitation of CVE-2026-72971 as unlikely. Nevertheless, organizations operating Windows container workloads should prioritize updates for container hosts, particularly where low-privileged users, CI/CD agents, or multi-tenant development environments have local access.

The August release contains 42 Critical vulnerabilities, 355 Important vulnerabilities, and one Moderate issue, according to Tenable’s analysis. The wide product coverage means security teams should avoid treating this as a Windows-only maintenance event.

Notable fixes include a Critical remote code execution vulnerability in Windows Device Health Attestation, CVE-2026-71331, as well as Important flaws in SharePoint Server, .NET, PowerShell, Windows Installer, Windows Event Logging Service, Remote Desktop Client, NTFS, and Visual Studio Code.

Microsoft also published fixes for multiple cloud services, including Azure Active Directory, Azure SQL Database, Azure Kubernetes Service, Azure Service Bus, and Microsoft Entra Provisioning Service.

Administrators should give special attention to server-facing and developer-facing assets. SharePoint Server received both elevation-of-privilege and spoofing fixes, while Visual Studio Code and its Python extension received vulnerabilities involving remote code execution, information disclosure, and security-feature bypass.

These products are frequently embedded in high-trust development workflows, where compromise can create downstream supply-chain risk.

Organizations should immediately deploy the August cumulative updates, beginning with internet-facing systems, administrator workstations, developer endpoints, domain-connected servers, and devices where users have local execution capability.

Prioritize CVE-2026-68820 because active exploitation removes the usual margin for staged patching.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR