Microsoft August 2026 Patch Tuesday Fixes WinSock Zero-Day Exploited in the Wild

TL;DR

Microsoft August 2026 Patch Tuesday fixes 421 vulnerabilities, with 62 rated critical. One flaw, CVE-2026-68820, is already exploited in the wild. Microsoft also patched two other zero-days that researchers publicly disclosed before a fix shipped.

Why This Patch Tuesday Matters

Microsoft shipped an unusually large update this month. The count reached 421 CVEs, including 62 critical bugs. Most notably, attackers exploited one zero-day before the patch arrived.

The exploited flaw stands out most. Multiple vendors, including Checkpoint, confirmed active abuse of CVE-2026-68820. Security teams should treat it as an emergency fix.

How the Attack Works

CVE-2026-68820 is a use-after-free bug in the Ancillary Function Driver for WinSock, or afd.sys. That kernel driver underpins the Windows Sockets API.

A local, low-privileged attacker runs a crafted application to trigger a race condition. As a result, they escalate to SYSTEM privileges. Researchers link the attacks to North Korea’s Lazarus Group, which used the flaw to deploy its FudModule rootkit.

The Two Publicly Disclosed Zero-Days

Two more zero-days were publicly disclosed before this Patch Tuesday. CVE-2026-62832 is an elevation of privilege flaw in the Windows User Profile Service. CVE-2026-72971 is a link-following bug in the Container Isolation driver. Microsoft has not confirmed exploitation of either one.

Affected Products

This month’s fixes span Windows, Office, Exchange Server, SharePoint, and Azure. Other notable RCE bugs affect the Windows DNS Server, Microsoft QUIC, and Deployment Services. The WinSock zero-day affects supported Windows client and server versions.

Patch and Mitigation Steps

Deploy this month’s updates now, starting with the exploited WinSock flaw. Windows 11 users should install the latest cumulative update. You can confirm each fix through the official Microsoft Security Update Guide.

Prioritize the actively exploited bug first. Then patch the two publicly disclosed zero-days and the remaining critical CVEs across your fleet.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.