Microsoft August 2026 Patch Tuesday: 400+ Flaws Fixed, Including an Actively Exploited Lazarus Zero-Day

Zero-Day Details

Actively Exploited Zero-Day — CVE-2026-68820 (Linked to North Korean Hackers)

The single most urgent patch in this release is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys) . The bug has a CVSS score of 7.0 (Important severity) and allows a locally authenticated attacker to trigger a race condition and escalate privileges to SYSTEM level .

Attribution and campaign details: Check Point Research linked exploitation to North Korea's Lazarus Group as part of the Operation Dream Job campaign . The campaign distributed a modified PDF viewer called "SecurityPDF" to deploy a new backdoor named Troy, then exploited CVE-2026-68820 to install the FudModule kernel-mode rootkit . Lazarus had been exploiting this flaw since early June 2026, according to The Register . Microsoft released the patch on August 11 after Check Point's responsible disclosure .

Publicly Disclosed Zero-Days (Not Actively Exploited)

Two additional zero-days were publicly disclosed prior to Patch Tuesday but were not yet exploited in the wild:

• CVE-2026-62832 — Windows User Profile Service Elevation of Privilege Vulnerability (CVSS 7.8, Important) .
• CVE-2026-72971 — Windows Container Isolation FS Filter Driver Tampering Vulnerability (Important) .

Overall Scope by Product Area

The August 2026 update spanned the entire Microsoft ecosystem:

Wormable concerns: Four flaws in this release require no user interaction—affecting Windows DNS Server, Windows Deployment Services, Microsoft's QUIC transport implementation, and High Performance Computing (HPC) Pack. Each carries a CVSS score of 9.8, making them wormable priorities .

Windows 11 Cumulative Update Feature Updates

The August 2026 cumulative update for Windows 11 (KB5121003 for versions 25H2/24H2, KB5120240 for 23H2, KB5121000 for 26H1) bundles several new features alongside security fixes :

• Screen Tint accessibility feature — A new color filter option
• Quieter Widgets experience — Reduced notifications from the Widgets board
• Extended Windows Update pause — Ability to pause updates for up to 35 days
• Windows Hello Enhanced Sign-in Security (ESS) support for external fingerprint sensors
• Ability to uninstall AI models from Copilot+ PCs
• Touchpad gesture improvements
• Voice isolation for Voice Access
• Fluid Dictation for Voice Typing
• File size display improvements in File Explorer Details view (now shows KB, MB, GB instead of only KB)
• Improved Windows Search — Better at handling typos
• Performance fixes and bug fixes across the OS

Patch Prioritization Guidance

While the sheer volume of fixes can be overwhelming, security analysts emphasize that only one bug in this release—CVE-2026-68820—is confirmed under active exploitation . Tyler Reguly at Fortra advised organizations to prioritize the exploited WinSock flaw first, then move quickly on the wormable server-role vulnerabilities (CVSS 9.8) affecting DNS, Deployment Services, QUIC, and HPC Pack . The three publicly known zero-days, while important, have not yet been observed in attacks.

CrowdStrike's analysis confirms this approach: patch the actively exploited WinSock elevation-of-privilege flaw immediately, then address the critical server-side patches before moving to the remaining Important-severity fixes .