Microsoft's August Patch Tuesday fixes 398 flaws including an exploited Windows driver bug
A record-sized patch bundle shows how privilege escalation chains work and why testing before deploying still matters.
Microsoft released its August 2026 security updates on 11 August, addressing at least 398 vulnerabilities across Windows and its supported software, according to Krebs on Security. Forty-two of the fixes carry Microsoft's most severe critical rating, meaning they could be exploited to run malicious code with little or no user interaction.
One of the flaws was already being used in attacks before the patch shipped. CVE-2026-68820 is a privilege escalation bug in afd.sys, the Windows driver that handles socket communication. Landon Miles of Automox characterised it as the second step in an attack chain: an attacker first gains a low-privilege foothold, typically through phishing, then uses the driver flaw to take full control of the machine.
Two further vulnerabilities were publicly disclosed before Microsoft's fix was available. CVE-2026-62832 is a privilege escalation issue in the Windows User Profile Service, which Krebs suggested may be connected to research published under the name LegacyHive by a researcher known as Nightmare Eclipse. CVE-2026-72971 is a lower-impact local tampering weakness.
The size of the release prompted comment on how vendors are coping with vulnerability discovery. Ed Skoudis of the SANS Technology Institute observed that AI systems are becoming very effective at finding bugs while fixing them remains a distinct and harder problem, and Krebs pointed to research from 1Password finding that patches generated by large language models failed to resolve the flaw or introduced new weaknesses more than half the time. Tyler Reguly of Fortra noted that only one of the nearly 400 bugs is known to be exploited and cautioned against deploying such a large bundle without testing.
Krebs also noted that Adobe now issues security bulletins twice a month and that Cisco, Google, Mozilla and Oracle have increased patch frequency and volume. His advice to readers was to back up systems before applying the updates and to wait a few days so that any problematic patches surface first.
Why it matters
The headline count matters less than the shape of the release: hundreds of fixes, one confirmed exploit and a driver-level escalation that turns an ordinary phishing click into full system compromise. Vendors across the industry are shipping more patches more often, which shifts the burden onto the people who must test and deploy them. Automated vulnerability discovery is accelerating faster than automated repair, so the volume is unlikely to fall. For learners, the practical skills are triage and staged deployment rather than reacting to every CVE equally.
Phishing lands a low-privilege foothold
The attacker runs code as an ordinary user after a malicious attachment or link.
Trigger the afd.sys flaw
CVE-2026-68820 in the Windows socket driver is used to escalate from user to system level.
Kernel-level control gained
With system privileges the attacker can disable defences, steal credentials and persist.
Move laterally
Stolen credentials open other machines; the patch removes step two of the chain.
What you can learn from this
- Privilege escalation in an attack chain. Most intrusions begin with low privileges, because phishing and browser exploits land in the context of an ordinary user account. A privilege escalation flaw lets that account gain administrator or system rights, which unlocks credential theft, persistence and lateral movement. Attackers therefore pair an initial access technique with an escalation technique, and a reliable escalation bug is valuable precisely because it is reusable across many initial footholds. Defenders who block only the first step leave the second step waiting for the next successful phish.
- Why kernel drivers are high-value targets. A driver such as afd.sys runs in kernel mode, the most privileged level of the operating system, where it can touch any memory and bypass user-level protections. A bug there does not merely crash one program; it hands the attacker the same authority the kernel has. Socket drivers are especially attractive because every networked application calls into them, giving attackers many ways to reach the vulnerable code. This is why operating system vendors invest in driver signing, memory-safe rewrites and moving components out of the kernel.
- Zero-day, publicly disclosed and exploited. These three labels are often confused. Publicly disclosed means details were released before a patch existed, which gives attackers a head start even if no attacks have been seen. Exploited means real attacks have been observed. Zero-day loosely covers a flaw attacked before a fix was available. An advisory that says both disclosed and exploited deserves the fastest response, while a critical-rated flaw with no known exploitation can wait for a normal testing cycle.
- Severity ratings and what they leave out. Microsoft's critical and important labels, like CVSS scores, describe the worst case of what a flaw could allow, not the probability that it will be used. A critical remote code execution bug that requires an unusual configuration may pose less real risk than an important-rated local escalation that is being exploited today. Good triage combines severity with exploitation evidence and with how exposed a given system is. Patch tools that sort purely by score will misorder the queue.
- Staged deployment and rollback. Large cumulative updates occasionally break drivers, printing, authentication or line-of-business applications, which is why experienced administrators deploy in rings: a small test group first, then a broader pilot, then everything. A short soak period lets problems surface where they are cheap to fix, and a tested backup or restore point makes rollback possible. The trade-off is that the exploited flaw remains open on the later rings for a few more days, so rings should be shorter when an active exploit is present.
We teach this
How to use this in practice
- Check what is installed on your own Windows machine. Open PowerShell and run
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 5, then compare the result with the Windows Update history page in Settings. If the update is missing, note whether it is pending, blocked by a failed install or simply not offered yet, since each has a different fix. Done looks like an August 2026 cumulative update visible in both places, or a pending restart that you have completed. - Create a restore point before the next patch. Run
Checkpoint-Computer -Description "Pre-August-patch"from an elevated PowerShell session, or take a full disk image with your preferred tool. Verify it exists withGet-ComputerRestorePoint. Restore points do not protect personal files, so pair one with a file backup. Done looks like a restore point or image dated today that you have confirmed you know how to restore from, not merely one that exists. - Write a one-page patch ring plan for the devices you manage. Even for a household or a small lab, name a test device that patches on day one, a second ring that follows after two or three days if nothing broke, and a final ring for everything else. Add a rule for shortening the delay when a patch fixes an actively exploited flaw, and include the rollback step for each ring so nobody has to invent it under pressure. Done looks like a document with device names in each ring and a calendar reminder for the next cycle.
- Read one advisory properly. Open Microsoft's Security Update Guide entry for CVE-2026-68820 and record its CVSS vector, the attack vector, the privileges required and the user interaction needed. Then write two sentences explaining how a local privilege escalation fits after a phishing email in a realistic attack. Repeat the exercise for CVE-2026-62832 and note what differs. Done looks like a short note that a non-specialist could follow, and a habit you can repeat for the next exploited CVE.
Sources
- Microsoft Plugs Nearly 400 Security Holes — Krebs on Security
Our reporting is an original summary; full coverage is at the links above.
Don't just read about it — build it.
Square 1 teaches the skills behind the headlines, with every line of your work graded by AI. Find your starting point in 3 minutes.
Get your free skill report