Microsoft has released its August 2026 Patch Tuesday security updates, addressing over 400 vulnerabilities across Windows and other supported products, including three zero-day flaws that were exploited or publicly disclosed before fixes became available.
The 400-flaw estimate covers the vulnerabilities Microsoft released as part of the August 11 Patch Tuesday cycle.
It does not include certain flaws in services and products such as Microsoft Azure, Microsoft Entra, Microsoft Teams, Microsoft Office, Power Apps and Microsoft’s Mariner Linux distribution that were corrected or disclosed separately earlier in August.
LegacyHive targeted the way the Windows User Profile Service handles registry hive files, symbolic links and timing-sensitive file operations.
In a separate Microsoft Security Response Center statement, the company said the increase was not the result of a lowered threshold for issuing security fixes.
Microsoft has released its August 2026 Patch Tuesday security updates, addressing over 400 vulnerabilities across Windows and other supported products, including three zero-day flaws that were exploited or publicly disclosed before fixes became available.
The most urgent vulnerability is an elevation-of-privilege flaw in the Windows Ancillary Function Driver for WinSock, tracked as CVE-2026-68820. Microsoft confirmed that attackers had exploited the vulnerability in the wild, while Check Point attributed the observed attacks to the North Korean state-sponsored group widely known as Lazarus.
According to Check Point, Lazarus used the vulnerability to install a new version of FudModule, a sophisticated kernel-mode rootkit previously associated with North Korean espionage operations. The exploitation formed part of a campaign in which targets were approached with fraudulent employment opportunities before malicious software was delivered to their systems.
The August release also fixes two vulnerabilities that were publicly known before patches became available: a Windows User Profile Service flaw matching the previously disclosed “LegacyHive” technique and a tampering vulnerability in the Windows Container Isolation file-system filter driver.
Although the total is lower than the unusually large July Patch Tuesday release, which various counting methodologies placed 600+ vulnerabilities, August remains one of Microsoft’s largest monthly security updates. The continuing volume underlines the growing operational pressure on enterprise patch-management teams, particularly as Microsoft expands its use of artificial intelligence to identify weaknesses across Windows and other complex codebases.
More Than 100 Remote-Code-Execution Vulnerabilities
Microsoft’s August security release includes 42 vulnerabilities classified as Critical. Of those, 37 could lead to remote code execution, while five could allow an attacker to elevate privileges.
The approximately 400 vulnerabilities include :
176 elevation-of-privilege flaws
110 remote-code-execution vulnerabilities
86 information-disclosure issues
21 spoofing vulnerabilities
12 denial-of-service flaws
11 security-feature bypasses
4 Tampering flaws
These category figures should not necessarily be treated as a simple mathematical total. Patch Tuesday counts can differ depending on whether researchers include vulnerabilities published earlier in the month, browser issues inherited from Chromium, cloud-service fixes and vulnerabilities that fall into more than one technical category.
The 400-flaw estimate covers the vulnerabilities Microsoft released as part of the August 11 Patch Tuesday cycle. It does not include certain flaws in services and products such as Microsoft Azure, Microsoft Entra, Microsoft Teams, Microsoft Office, Power Apps and Microsoft’s Mariner Linux distribution that were corrected or disclosed separately earlier in August.
This distinction has become increasingly important as Microsoft’s portfolio has expanded beyond traditional Windows and Office software. Many cloud vulnerabilities are fixed automatically by Microsoft and require no direct customer action, while vulnerabilities in self-hosted products and Windows endpoints generally depend on organisations testing and deploying the relevant updates.
For security teams, the headline number is consequently less important than the location, exploitability and exposure of the affected components. An actively exploited privilege-escalation flaw on employee workstations, for example, may represent a more immediate danger than a higher-scoring remote-code-execution flaw affecting a component that is disabled or isolated in a particular environment.
Lazarus Exploited Windows Kernel Flaw
The highest-priority vulnerability in the August release is CVE-2026-68820, an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock, commonly represented by the afd.sys kernel driver.
The driver provides kernel-level support for Windows networking operations and acts as an interface between user-mode Winsock applications and the underlying Windows networking stack. Because it operates in kernel mode, a successful memory-corruption exploit can allow an attacker to cross a critical security boundary and obtain the highest level of privileges on a Windows device.
Microsoft described the vulnerability as a use-after-free condition. These flaws occur when software continues to reference a region of memory after it has been released, potentially allowing an attacker to manipulate the reused memory and alter program execution.
Exploitation requires the attacker to be locally authenticated and able to run a specially constructed application. The application triggers a race condition in the vulnerable driver, after which successful exploitation can grant SYSTEM privileges. No user interaction is required once the attacker is in a position to execute the malicious program.
The local nature of the vulnerability does not make it a low-priority issue. Privilege-escalation bugs are commonly used as the second stage of an intrusion. An attacker may initially obtain limited access through phishing, malicious documents, stolen credentials, browser exploitation or compromised software. A kernel vulnerability can then be used to escape the restrictions of the compromised account, disable security controls, access protected credentials and establish durable persistence.
Microsoft credited Check Point researchers Moshe Marelus and David Driker with discovering and reporting CVE-2026-68820.
Fake Job Offer Led to Zero-Day Deployment
In its investigation, Check Point connected CVE-2026-68820 to a Lazarus campaign built around fraudulent employment opportunities. The use of fake recruitment approaches is a well-established feature of North Korean cyber operations, particularly campaigns targeting software developers, cryptocurrency companies, defence organisations and technology employees with access to valuable systems.
According to Check Point’s technical investigation, the attackers exploited CVE-2026-68820 to deploy a newly observed version of FudModule, a kernel-mode rootkit linked to Lazarus.
The attack chain is significant because it combines social engineering with a previously unknown kernel vulnerability. The initial job-themed contact gives the attackers a route to persuade a target to open a file, run a project or install software. Once code is running with ordinary user privileges, the Windows flaw provides the escalation needed to seize deeper control of the endpoint.
FudModule is designed to operate at a level where it can interfere with security products and conceal malicious activity. Kernel-mode implants are particularly dangerous because they run within one of the most trusted layers of the operating system. Depending on their capabilities, rootkits operating at this level may manipulate system structures, hide processes, block telemetry, alter security-tool behaviour or protect other malware components from removal.
The use of CVE-2026-68820 therefore appears to have served a specific operational purpose: turning an initial, lower-privileged compromise into a highly privileged and more difficult-to-detect intrusion.
Microsoft’s advisory confirms that exploitation was detected but does not provide details about the affected organisations, the scale of the campaign or the complete delivery chain. The company’s limited disclosure is typical when an investigation remains active or when publishing additional information could expose victims and defensive techniques.
CVE-2026-68820 should receive immediate attention across Windows workstations, developer systems and other devices on which users can execute downloaded applications. Organisations in sectors historically targeted by Lazarus should also investigate for evidence of compromise rather than assuming that installing the patch will remove an existing infection.
A security update closes the vulnerability, but it does not automatically evict an attacker who exploited the flaw before the update was installed.
FudModule Adds to Lazarus’ Kernel-Level Arsenal
Lazarus is an umbrella name used for several North Korean cyber units and operational clusters. The broader ecosystem has been linked to intelligence collection, destructive attacks, cryptocurrency theft and financially motivated operations intended to generate revenue for the North Korean state.
The group’s interest in kernel-level capabilities is not new. Previous FudModule campaigns have demonstrated a willingness to exploit Windows drivers and other privileged components to weaken endpoint protections. The deployment of an updated rootkit through a genuine Windows zero-day shows that these operators continue to invest in techniques that provide stealth and resilience after initial access.
Fake recruitment campaigns are especially effective against technical professionals because the malicious material can be disguised as a coding assessment, software project, salary document or video-interview application. The victim may expect to download files or execute code as part of a legitimate hiring process, reducing the likelihood that the activity will initially appear suspicious.
Defenders should consequently look beyond conventional email attachments. Recruitment-themed attacks may begin through professional networking services, messaging platforms or developer communities before moving to email or attacker-controlled websites.
Security teams should examine unusual child processes launched by development tools, archive utilities, document readers and messaging applications. They should also monitor for unexpected driver activity, attempts to tamper with endpoint-security services and anomalous SYSTEM-level processes appearing shortly after a user runs recruitment-related material.
LegacyHive Public Disclosure Addressed
The second zero-day fixed in August is CVE-2026-62832, an elevation-of-privilege vulnerability in the Windows User Profile Service.
Microsoft said the weakness results from improper link resolution before file access, a class of vulnerability often referred to as link following. An attacker with local access and credentials for another account can use a specially constructed application to cause the User Profile Service to load another user’s registry hive.
Successful exploitation could allow the attacker to access or modify data belonging to the targeted account and ultimately obtain administrator privileges. The attack does not require interaction from the targeted user while the exploit is running, although some forms of the technique may depend on subsequent account activity.
The technical description closely matches the Windows vulnerability publicly disclosed in July under the name LegacyHive. Microsoft credited CVE-2026-62832 to an anonymous researcher, while the public LegacyHive proof of concept was released by a researcher using the name Nightmare Eclipse.
LegacyHive targeted the way the Windows User Profile Service handles registry hive files, symbolic links and timing-sensitive file operations. The registry contains extensive configuration information for Windows, installed applications and individual user accounts. A registry hive such as UsrClass.dat can contain application data, Explorer history, shell configuration and other user-specific information.
Analysis by Cyderes found that the publicly demonstrated technique used symbolic-link manipulation and an opportunistic file lock to influence profile loading at a precise point in the operation. The proof of concept caused the service to load a target user’s registry hive into a namespace accessible to the lower-privileged account.
ThreatLocker’s analysis reported that the original public demonstration exposed another user’s registry data and that modifications to the technique could potentially target other hive files. Security researcher Will Dormann also warned that manipulating a privileged user’s hive could create a path to executing commands with administrative rights when that user subsequently signed in.
The August patch closes the gap that remained after LegacyHive was publicly demonstrated against systems carrying the July security updates.
Because working technical information had already been released, CVE-2026-62832 deserves accelerated treatment even though Microsoft had not reported active exploitation at the time of publication. Public proof-of-concept code significantly reduces the research required for other threat actors to reproduce or adapt an attack.
Shared workstations, jump servers, multi-user systems and machines where administrators regularly sign in alongside lower-privileged users may face greater exposure. The vulnerability also reinforces the importance of keeping privileged administrative activity separate from ordinary user computing.
Container Isolation Driver Vulnerability Also Publicly Known
Microsoft also fixed CVE-2026-72971, a publicly disclosed tampering vulnerability in the Windows Container Isolation file-system filter driver, unionfs.sys.
The driver is involved in presenting and managing layered file-system views used by Windows container-isolation features. Microsoft attributed the vulnerability to researchers identified as yhw and txz.
As with the User Profile Service flaw, Microsoft described the underlying weakness as improper link resolution before file access. This means an authenticated local attacker may be able to manipulate file-system links so that a privileged component accesses or changes a location other than the one it intended to process.
The original report appears to repeat some text associated with CVE-2026-62832, including references to loading another user’s registry hive and gaining administrator privileges. That description belongs to the User Profile Service vulnerability and should not be treated as the definitive exploitation path for the container driver flaw.
The reliable elements of Microsoft’s disclosure are that CVE-2026-72971 affects unionfs.sys, requires an authorised local attacker and can enable file-system tampering. Microsoft had not publicly described the exact disclosure route, demonstrated attack chain or evidence of in-the-wild exploitation when the August updates were released.
The lack of reported exploitation should not be confused with an absence of risk. Container-isolation mechanisms exist to enforce boundaries between applications, files and host resources. A weakness in the supporting file-system layer could become more serious if combined with another vulnerability that provides code execution inside a restricted environment.
Organisations using Windows containers or container-based application-isolation technologies should test and deploy the relevant updates promptly. They should also review host telemetry for suspicious symbolic-link creation, unexpected modification of protected files and unusual activity involving container storage paths.
Patch Tuesday Volumes Continue to Rise
August’s 400-flaw release follows an exceptionally large July update that addressed approximately 570 vulnerabilities under the counting methodology used by several security firms. Other organisations reported different totals because Microsoft’s Security Update Guide included additional entries, while some analyses excluded Chromium, cloud-only issues or vulnerabilities published outside the main release window.
The disagreement illustrates why raw Patch Tuesday totals require context. Different reports may all be internally accurate while measuring different sets of vulnerabilities.
What is clear is that Microsoft security releases are becoming larger. The company warned in May that customers should expect the trend to continue as vulnerability reporting, automation and AI-assisted code analysis expand.
Microsoft has developed a multi-model vulnerability-discovery platform known as MDASH, which coordinates more than 100 specialised AI agents to analyse software and validate potential weaknesses. The company said the system found all 21 deliberately introduced vulnerabilities in a private test driver without producing a false positive during that test. It also reported strong results against historical Microsoft vulnerabilities and the CyberGym security benchmark.
Microsoft said MDASH had already contributed to the discovery of 16 vulnerabilities released in May, including flaws in the Windows networking and authentication stack. The company later expanded its use across Windows, Azure, Hyper-V, Active Directory, identity services and other security-sensitive components. Microsoft’s research suggests that AI-assisted analysis is allowing engineers to examine code paths at a depth and scale that would be difficult to achieve manually.
In a separate Microsoft Security Response Center statement, the company said the increase was not the result of a lowered threshold for issuing security fixes. Instead, Microsoft attributed the growth to more researcher participation, improved automation, expanded validation and greater use of AI by both internal teams and external researchers.
Larger Patch Tuesday releases do not necessarily mean that Microsoft software has suddenly become less secure. They may instead reflect a greater ability to discover and remediate latent vulnerabilities. However, the result for customers is the same: more updates must be assessed, tested and deployed within increasingly compressed timeframes.
Enterprises Should Prioritise Exploitation, Exposure and Impact
Organisations should place CVE-2026-68820 at the top of the August deployment queue because exploitation has already been confirmed. High-risk employee groups, including developers, cryptocurrency personnel, defence contractors, researchers and executives, warrant particular attention because of Lazarus’ documented use of targeted job-offer lures.
Affected devices should be patched as quickly as operationally possible and reviewed for evidence of earlier compromise. Endpoint detection tools should be checked to ensure that their sensors are running normally and have not been disabled or tampered with. Where suspicious activity is identified, organisations should isolate the device, preserve forensic evidence and investigate credentials used on the system.
CVE-2026-62832 should follow closely because technical details and proof-of-concept material for LegacyHive have been public since July. Systems shared by multiple users or used for privileged administration deserve priority.
CVE-2026-72971 should be prioritised on Windows systems supporting containers or application-isolation workloads, particularly where untrusted or lower-trust code can execute on the same host.
Administrators must also identify the 42 Critical vulnerabilities relevant to their environments, especially the 37 remote-code-execution issues. Internet-facing services, domain infrastructure, remote-access systems, developer endpoints and machines processing files from external sources should receive heightened scrutiny.
The August release once again shows that CVSS severity alone is not an adequate patching strategy. The most urgent flaw in the release is important not simply because of its technical characteristics, but because a capable state-backed group has already incorporated it into a working attack chain.
As Microsoft and independent researchers use AI to find vulnerabilities faster, attackers are gaining access to increasingly capable tools for analysing updates and developing exploits. The interval between patch publication and widespread exploitation is therefore likely to contract further.
For defenders, the central lesson from August Patch Tuesday is not merely that 400 flaws have been corrected. It is that one of those flaws had already become part of a real North Korean intrusion operation, two others were publicly documented, and delayed patching now gives attackers an increasingly narrow but highly valuable window of opportunity.
