Microsoft Patches 400 Vulnerabilities in August Update, Three of Them Zero-Days

Microsoft has released its August security update package, patching a full 400 vulnerabilities at once. That's fewer than in July, when a record 570 flaws were closed, but still noticeably more than the usual figures. Microsoft itself attributes the increase to bringing an AI-based vulnerability-hunting system online — and warns that the number of findings will only grow.

Among the fixes are 42 vulnerabilities rated critical; 37 of them allow remote code execution, and another five allow privilege escalation. By type, the flaws break down as follows: 176 involve privilege escalation, 110 remote code execution, 86 information disclosure, and the rest fall under security feature bypass, denial of service, and spoofing. The count does not include vulnerabilities in Teams, Azure, Office, and a number of other products that were closed earlier in the month.

Three Zero-Days

One of the three zero-days has already been exploited in real-world attacks. This is the flaw CVE-2026-68820 in the AFD.sys driver (Ancillary Function Driver for WinSock): because of a use-after-free, a local attacker can trigger a race condition and gain SYSTEM privileges without any user interaction. According to Check Point, which discovered the vulnerability, the flaw was used by the North Korean group Lazarus — it was the vehicle for deploying a new version of the FudModule kernel-mode rootkit.

The other two zero-days were disclosed publicly but have not yet been spotted in attacks. CVE-2026-62832 in the user profile service allows an authenticated attacker holding the credentials of another local account to load someone else's registry hive and gain administrative rights. Although Microsoft credited the finding to an anonymous researcher, the description matches the LegacyHive vulnerability that a specialist under the pseudonym Nightmare Eclipse had described a month earlier. The third flaw, CVE-2026-72971, concerns the container isolation driver unionfs.sys and permits local data spoofing.

Not Just Microsoft

In August, other vendors released patches and bulletins as well. Adobe closed flaws in ColdFusion, Commerce, Lightroom Classic, and other products. Cisco updated Catalyst SD-WAN, IOS, IOS XE, and ClamAV. Metabase fixed a critical SQL injection that had already been used to steal data, and N-able fixed an actively exploited authentication bypass in N-central. SAP released a fix for a vulnerability with a maximum score of 10.0 in Commerce Cloud, TP-Link closed 15 flaws in the Omada device auto-configuration mechanism, and VMware updated its Avi Load Balancer.

Source: Bleeping Computer