Microsoft turned up the heat on sysadmins for the second month in a row on August 11 with a Patch Tuesday comprising 400 CVEs, including one actively exploited zero-day vulnerability.
The figure is not quite as high as the record 570 issued in July’s Patch Tuesday but it will be a challenge to process for organizations without automated, risk-based patching programs.
The actively exploited zero day (CVE-2026-68820) is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker with low privileges could run a specially crafted application and trigger a race condition to gain system privileges and extensive control over a targeted Windows system.
“Confidentiality, integrity, and availability impacts are all rated high,” explained Action1 co-founder, Mike Walters. “Exploitation has been detected in the wild, so deployment should be prioritized even though the vulnerability is rated important rather than critical.”
Read more on Patch Tuesday: Microsoft Patches 570 CVEs in Record Patch Tuesday
Elsewhere, there were two publicly disclosed but as-yet-unexploited zero days published this month.
CVE-2026-62832 is an Elevation of Privilege (EoP) vulnerability in the Windows User Profile Service which could allow an authenticated local attacker to elevate privileges.
“An attacker with credentials for another local account could run a specially crafted application to load another user's registry hive, potentially accessing or modifying that user's data and gaining administrator privileges. No user interaction is required,” explained Action1 director of vulnerability research, Jack Bicer.
“Although active exploitation is not reported, organizations should prioritize deployment because successful exploitation could provide administrator privileges and compromise sensitive user data.”
The second publicly disclosed zero day which has yet to be exploited in the wild is CVE-2026-72971: a Windows Container Isolation FS Filter Driver (unionfs.sys) tampering vulnerability.
Microsoft explained that authorized attackers could perform tampering locally due to “improper link resolution before file access” in the product.
"An authenticated attacker who has credentials for another local account could run a specially crafted application to load another user's registry hive,” it added. “Successful exploitation could allow the attacker to access or modify another user's data and gain administrator privileges. User interaction is not required.”
The majority of CVEs addressed this month were elevation of privilege (EoP) and remote code execution (RCE) flaws. Some 37 of RCE bugs were rated “critical” out of a total of 42 critical vulnerabilities this month.