Microsoft shipped fixes for 421 CVEs in its August 2026 Patch Tuesday release, including CVE-2026-68820, a high-severity elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock (afd.sys) that is already being exploited in the wild as a zero-day.
CVE-2026-68820: use-after-free in afd.sys elevates to SYSTEM
Microsoft describes CVE-2026-68820 as a use-after-free issue in afd.sys, the kernel-mode driver that backs the Windows Sockets API. A locally authenticated attacker running a crafted application can trigger a race condition and gain SYSTEM privileges without any user interaction. Tenable's Satnam Narang notes it is the fourth exploited afd.sys zero-day since 2022, following CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193 — a class of bugs previously linked to North Korea's Lazarus group.
CISA adds bug to KEV catalog, mandates patch by August 25
The Cybersecurity and Infrastructure Security Agency added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog and directed federal agencies to remediate before August 25, 2026. Beyond the exploited zero-day, three additional flaws were publicly disclosed pre-patch: CVE-2026-62832 in User Profile Service, CVE-2026-72971 in Container Isolation FS Filter Driver, and issues in the TPM 2.0 reference implementation.
62 critical bugs across Windows, Office, SharePoint and Exchange
August's release resolves 236 Windows vulnerabilities, 98 in Office and Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, and 6 across other products. Notable remote-code-execution flaws include CVE-2026-62878 (Windows DNS Server), CVE-2026-62893 (Windows Deployment Services TFTP), CVE-2026-62815 (Microsoft QUIC), CVE-2026-59124 (HPC Pack), and CVE-2026-62911, an EoP in Exchange Server.
Related: Microsoft Copilot one-click CVE disclosure, Universal Robots PolyScope 5 critical CVE, and CISA's Ray KEV addition.
Reporting based on coverage from SecurityWeek, Microsoft Security Response Center, and Tenable.