Microsoft Patches 400 Flaws, Lazarus Exploited One First

Microsoft’s August 2026 Patch Tuesday lands today with over 400 fixes — 42 rated Critical — including one zero-day that North Korea’s Lazarus group was already using before Microsoft knew it needed patching. Three zero-days total. Two CVSS 9.8 remote code execution vulnerabilities on exposed network services. The number is big; the priority list is short.

Here’s the triage stack.

Patch This Now: CVE-2026-68820

CVE-2026-68820 is a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys), CVSS 7.0 (High). A local attacker triggers a race condition to escalate to SYSTEM privileges. BleepingComputer reports that Lazarus deployed its FudModule rootkit through this flaw — meaning it was weaponized before disclosure, and the operational reliability has been proven against real targets.

“Local attacker” doesn’t mean low risk. Privilege escalation to SYSTEM is how initial access — a phishing email, a compromised service account, anything — becomes full domain compromise. If Lazarus trusts it enough to use against targets, expect it in commodity toolkits within weeks.

Apply today.

Two Publicly Disclosed Zero-Days

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege, CVSS 7.8 (High). A security researcher published details before the patch. Improper link resolution allows registry hive manipulation to gain administrator access. Not yet exploited in the wild, but publicly disclosed means the exploitation window is narrower than a normal patch cycle affords.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver tampering, CVSS 5.5 (Medium). A link-following flaw in unionfs.sys allows unauthorized file access with a potential path to elevated privileges. Medium severity, and it’s the lower-urgency of the three zero-days — but it’s disclosed and container-adjacent, which is enough reason to get it into your next maintenance window rather than the one after.

The 9.8s on Network Services

Two critical RCEs are worth separate attention if you run exposed Windows Server infrastructure:

CVE-2026-62815 — Microsoft QUIC Remote Code Execution, CVSS 9.8. Unauthenticated, zero user interaction required. Any Windows service exposing QUIC (HTTP/3) is potentially reachable from the network. SANS ISC flags this as a standout critical item this cycle.

CVE-2026-62878 — Windows DNS Server Remote Code Execution, CVSS 9.8. Stack-based buffer overflow, affects Windows Server 2012 through 2025. DNS servers are frequently network-reachable — if yours is internet-facing, this moves to the top of the list alongside the zero-day.

The Other 395

The counting varies by outlet: BleepingComputer lands at 400, SecurityWeek at 421, SANS at 418. The variance comes from differing methodologies for third-party and non-security patches — all three numbers are large.

The category split is notable: 176 elevation of privilege CVEs against 110 remote code execution. More EoP than RCE in a single cycle is a signal about where Microsoft’s kernel and driver attack surface is right now.

The remaining bulk rides normal patching cadence. The five CVEs named above don’t.

Your Priority Stack

1. CVE-2026-68820 — immediate. Active exploitation confirmed, Lazarus attribution.
2. CVE-2026-62815 — this week, if you run QUIC-exposed services.
3. CVE-2026-62878 — this week, if you run Windows DNS Server.
4. CVE-2026-62832 — this cycle. Publicly disclosed, High severity.
5. CVE-2026-72971 — next maintenance window. Disclosed, Medium severity.
6. Everything else — standard monthly cadence.

Windows Update handles desktops automatically. Server teams on WSUS or SCCM: pull the above items first, hold the rest for your normal maintenance window. The 400-flaw headline is real; the actual emergency list is five items long.

Also published today on related Patch Tuesday activity: Adobe patches critical ColdFusion and Campaign Classic flaws as part of the same release wave.