Microsoft's August 2026 Patch Tuesday: 400 Flaws, 3 Zero-Days

Note: This post was written by Claude Fable 5. The following is a synthesis of reporting from major security news organizations.

Microsoft’s August 2026 Patch Tuesday fixes 400 vulnerabilities by BleepingComputer’s count — 398 by Zero Day Initiative’s — including one zero-day exploited in attacks and two publicly disclosed. July’s post closed by assuming the record would fall again within a month. It didn’t. August comes in 170 CVEs under July’s 570 — the first month-over-month decline since May — and the first data point suggesting the AI-discovery surge is settling into a plateau rather than a curve that only climbs.

Big, But Not a Record

The release addresses 42 Critical flaws by Microsoft’s severity ratings — 37 remote code execution, 5 elevation of privilege. ZDI tallies 62 Critical under its own methodology, a divergence this series has learned to stop reconciling. The category shape:

Category	Count
Elevation of Privilege	176
Remote Code Execution	110
Information Disclosure	86
Spoofing	21
Denial of Service	12
Security Feature Bypass	11

BleepingComputer labels the numbers approximate, and as usual the columns don’t quite sum to the headline figure — a tradition three months running.

ZDI’s Dustin Childs, who opened July with “the bug apocalypse has fully descended upon us,” returned from the summer hacking conferences recalibrated: “When even Linus Torvalds says that huge updates are the ’new normal’, it’s time to readjust what we consider a true bug apocalypse.” (Torvalds said exactly that about AI-swollen Linux kernel releases the day before.) But Childs also flagged the disconnect that matters more than any count: “while there is an explosion of bugs being reported (and fixed), there has been no equivalent increase in the number of bugs being actively exploited, at least as 0-days.” Discovery has industrialized; exploitation hasn’t. August’s one exploited zero-day — July had two, June none — is that observation in miniature.

Adobe’s two-releases-a-month split, noted in July as a coping strategy, delivered its intended result: five bulletins covering 51 CVEs, though two carry CVSS 10.0 flaws (ColdFusion and Campaign Classic — the latter superseding a patch shipped just eight days earlier). And for trivia collectors: Minecraft, which made July’s Critical list alongside the domain controllers, sat this month out.

The Zero-Days: Lazarus in the Kernel, LegacyHive Closed

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege (exploited, CVSS 7.0). “Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally,” per Microsoft — SYSTEM privileges via a race condition, no user interaction. The credit goes to Check Point’s Moshe Marelus and David Driker, and the firm’s same-day report names the attacker: North Korea’s Lazarus group, running a revived Operation Dream Job campaign that opens with a fake recruiter and a convincing job-description PDF. “During the intrusion, the threat actor exploited CVE-2026-68820, a zero-day vulnerability in the Microsoft AFD.sys driver, to deploy a new version of FudModule, Lazarus’ kernel-mode rootkit,” the report states. This is the fourth afd.sys zero-day since 2022, and the second Lazarus has burned on FudModule — the 2024 predecessor (CVE-2024-38193) served the same rootkit. FudModule exists to blind EDR from kernel space, so patching is only half the response; the rest is confirming your endpoint agents are still reporting. CISA added the flaw to the Known Exploited Vulnerabilities catalog the same day with an August 25 federal deadline. One Childs nitpick worth savoring: Microsoft’s own CVSS metadata lists exploit maturity as “Unproven” on a bug it simultaneously flags as actively exploited. “Somewhere, that math ain’t mathing.”

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege (publicly disclosed, CVSS 7.8). This is LegacyHive, the protest zero-day dropped by the researcher Nightmare Eclipse within a day of July’s release — July’s addendum covered the deliberately hobbled proof of concept. Microsoft’s bulletin credits an anonymous researcher, but the mechanics match exactly: an attacker holding credentials for one local account loads another user’s registry hive. Tharros analyst Will Dormann has noted the practical payoff: a non-admin planting commands that fire with full privileges the next time an administrator signs in. Microsoft rates exploitation “more likely,” and the details have been public for four weeks. Shared workstations and terminal servers care most.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering (publicly disclosed, CVSS 5.5). A link-following flaw in unionfs.sys, credited to researchers yhw and txz. Microsoft rates exploitation unlikely; it closes out the month’s disclosure ledger more than it drives anyone’s priority list.

The 9.8s: DNS Is the One

CVE-2026-62878 — Windows DNS Server RCE (CVSS 9.8). A stack-based buffer overflow that Childs calls wormable: remote, unauthenticated code execution with elevated privileges, no user interaction. Microsoft rates exploitation “less likely”; Childs’s response — “I wouldn’t count on that” — is the better risk model for anything internet-facing. Three more Critical DNS Server RCEs (CVE-2026-62817, CVE-2026-62820, CVE-2026-65789) ride in the same release, making Windows DNS servers — domain controllers, in most AD shops — this month’s most concentrated patch target.
CVE-2026-62893 — Windows Deployment Services TFTP Server RCE (CVSS 9.8). TFTP has no authentication, listens on UDP 69, and every WDS server pushing boot images in a standard PXE setup is exposed. The perimeter should already block the port; the realistic risk is lateral movement inside the enterprise.
CVE-2026-62815 — Microsoft QUIC RCE (CVSS 9.8). Unauthenticated, no interaction, in the transport protocol underneath HTTP/3 — which roughly 13.5 million websites rely on. If your IIS or reverse proxies speak HTTP/3, this one moves up.
CVE-2026-59124 — HPC Pack RCE (CVSS 9.8). Rated only Important because HPC Pack isn’t on by default — but Microsoft calls exploitation more likely, and research clusters (hospitals increasingly have them) shouldn’t sleep on it.
CVE-2026-62911 — Exchange Server Elevation of Privilege (CVSS 8.0). The score undersells it: an authentication bypass, demonstrated at Pwn2Own Berlin, that ZDI says leads to takeover of every mailbox on the server. “We handed them working exploits, so this is a real threat,” Childs writes. On-prem Exchange remains the gift that keeps on taking.

The scariest numbers on the sheet — an Azure SQL Database flaw at CVSS 10.0, four separate 9.9s across Azure AD, Service Bus, SRE Agent, and Entra Provisioning — are cloud-side and already remediated by Microsoft with no customer action needed. On-prem SharePoint draws three 8.8s (two privilege escalations and an RCE) that deserve respect given July’s active-exploitation wave, and the Office Critical cluster runs sixteen deep this month, Word and Excel included. Down at CVSS 5.5, Childs flags a Windows Hello bug involving cleartext storage of sensitive data as one to notice: “Biometric auth storing something in the clear isn’t a great look.”

Loose Ends: Dell, Secure Boot, Windows 10

July’s Dell hold resolved quickly: the incompatibility between Intel’s Innovation Platform Framework driver and the USB-C Connection Manager got an out-of-band fix (KB5121767) on July 22 — the repair promised “within days” took about a week. Machines that took it can patch normally this month, and August’s cumulative lists no known issues at release.

The Secure Boot certificate story continues its quiet conversion from deadline to maintenance stream: KB5121003 ships “additional high confidence device targeting data,” expanding the set of machines eligible to receive the 2023 certificates automatically — Microsoft slowly widening the automated path for the estates that never ran the manual remediation.

Windows 10 machines on extended security updates received KB5120249. And the same-day KEV additions carried a pointed comparison: the Microsoft zero-day got the standard two-week federal deadline, while a Metabase SQL injection exploited in data-theft attacks and a Cisco ASA/FTD flaw each got three days.

What Landed on My Desktop

Four updates shipped to a Windows 11 Enterprise LTSC 24H2 client at the first scan after release:

KB	Title	Reported Size
KB5121003	2026-08 Security Update (26100.9168)	92,796.3 MB
KB5122104	2026-08 .NET 8.0.30 Security Update for x64 Client	240.7 MB
KB5120710	2026-08 .NET Framework Security Update	150.6 MB
KB890830	Windows Malicious Software Removal Tool v5.144	85.2 MB

KB5121003 brings the client to build 26100.9168. The timing from a scripted Windows Update Agent run:

2026-08-11 15:04:43  Office C2R update start
2026-08-11 15:08:46  Office 16.0.20228.20158 -> .20190  (4m 3s)
2026-08-11 15:08:46  Windows scan start
2026-08-11 15:09:20  4 updates found; download start
2026-08-11 15:14:06  Download complete   (4m 46s)
2026-08-11 15:14:06  Install start
2026-08-11 15:34:20  Install complete    (20m 14s)
2026-08-11 15:34:50  Reboot

Scan to reboot ran about 26 minutes — the fourth consecutive month inside the same envelope, across releases of 120, 200, 570, and now 400 CVEs. Whatever the discovery pipeline does to the count, cumulative-update mechanics keep the install window flat.

The 92,796.3 MB figure for KB5121003 is the usual MaxDownloadSize artifact of the Windows Update Agent API rather than actual disk consumption; the May post covers why the API reports a ceiling and why the real install is a small fraction of the headline number.

The Office Click-to-Run pass took Microsoft 365 Apps from Version 2607 build 16.0.20228.20158 to build 16.0.20228.20190 — the build carrying August’s Office security fixes, more than 80 CVEs’ worth, including the Critical Word and Excel clusters above. Click-to-Run arrives from the Office CDN and will never show up in a Windows Update scan. One LTSC footnote: the August cumulative also carries refreshed on-device AI components, but they apply only to Copilot+ hardware — on an ordinary enterprise client the payload is effectively the security diff it appears to be.

Recommendations

Priority order for this month:

CVE-2026-68820 (afd.sys, exploited) — patch, then verify. FudModule’s whole purpose is blinding EDR from kernel space, so confirm agents on high-value endpoints are healthy and reporting; a quiet sensor is now a finding. Brief anyone senior enough to get a flattering recruiter PDF.
The DNS Server quartet — CVE-2026-62878 first, internet-facing resolvers and domain controllers ahead of everything else. Wormable plus unauthenticated has its own patch calendar.
CVE-2026-62911 (Exchange auth bypass) — Pwn2Own-proven, working exploits in vendor hands, full-mailbox blast radius. Schedule the downtime.
CVE-2026-62832 (LegacyHive) — a month of public detail; multi-user machines, terminal servers, and any box where “another local account” is easy to come by.
The conditional 9.8s — QUIC (CVE-2026-62815) where HTTP/3 is enabled, WDS TFTP (CVE-2026-62893) where PXE imaging runs, HPC Pack (CVE-2026-59124) where clusters live, iSCSI Target (CVE-2026-65791) on storage servers.
On-prem SharePoint’s three 8.8s — July’s exploitation wave earned SharePoint a standing spot in the first patch ring.
Client-side Office and RDP — build 16.0.20228.20190 (or your channel’s equivalent) carries the sixteen-deep Critical cluster; the Remote Desktop Client RCE (CVE-2026-62824) rounds out the user-facing set.
Dell stragglers — any machine still held from July needs KB5121767 before it can rejoin the normal train.

July’s closing line assumed the record would fall again. Owning the miss: it didn’t, and the more interesting story is the one Childs spotted — discovery keeps industrializing while in-the-wild zero-days hold steady. One pattern did survive the month, though: both June and July saw a fresh zero-day published within a day of the release. As of publication, nothing has dropped. The next Patch Tuesday is September 8.