On August 11, 2026, Microsoft released its monthly Patch Tuesday security updates, addressing a massive 421 vulnerabilities across Windows operating systems, Azure services, and enterprise software suites. The August release includes 42 critical-severity vulnerabilities and highlights an actively exploited zero-day privilege escalation flaw in the Windows kernel.
Active Zero-Day Exploitation: CVE-2026-68820 in WinSock Driver
The centerpiece of this month’s release is CVE-2026-68820, a high-severity Use-After-Free (UAF) vulnerability in the Ancillary Function Driver for WinSock (afd.sys)—the core kernel-mode driver responsible for handling Windows Sockets API communications.
According to Microsoft threat intelligence advisories, attackers are actively exploiting this race condition in the wild. A locally authenticated threat actor can execute a specially crafted binary to trigger the race condition and elevate their permissions to SYSTEM privileges without requiring any user interaction.
Cybersecurity researchers note that afd.sys has historically been a high-value target for state-sponsored threat groups (such as North Korea’s Lazarus Group) to achieve local privilege escalation following initial network access.
Publicly Disclosed Vulnerabilities
In addition to the actively exploited afd.sys flaw, Microsoft flagged two publicly disclosed zero-days:
- CVE-2026-62832 (Windows User Profile Service): A local privilege escalation flaw involving improper link resolution during user registry hive loading, allowing authenticated local users to gain administrator access.
- CVE-2026-72971 (Windows Container Isolation FS Filter Driver): A link-following vulnerability in
unionfs.systhat could enable local file tampering inside containerized environments.
Key Guidance for Enterprise IT and System Administrators
With 42 vulnerabilities rated Critical (including 37 Remote Code Execution bugs), enterprise security teams should prioritize the following actions:
- Deploy KB5121003 & Monthly Rollups Immediately: Prioritize patching domain controllers, active directory hosts, and Windows 11 endpoints (KB5121003 for versions 24H2 and 25H2).
- Audit Local Privilege Escalation Vectors: Review endpoint telemetry for unexpected process spawns originating from WinSock driver calls or registry hive manipulations.
- Isolate High-Risk Workloads: Enforce Endpoint Detection and Response (EDR) monitoring on multi-tenant workstations and terminal servers where local users could attempt privilege escalation.