Microsoft patches 421 flaws as attackers exploit Windows zero-day

Microsoft has released one of its largest monthly security updates, fixing 421 vulnerabilities across Windows, Office, SharePoint, Exchange, Azure and other products as part of its August 2026 Patch Tuesday rollout.

The update, released on 11 August, addresses 236 vulnerabilities affecting Windows alone. It also fixes three zero-day flaws, including one vulnerability that attackers were already exploiting before a patch became available. The other two had been publicly disclosed but had not been linked to confirmed attacks.

Windows users and organisations responsible for Microsoft environments are being urged to install the available updates promptly, particularly because the actively exploited vulnerability can allow an attacker with limited access to obtain the highest level of control over a compromised computer.

The most urgent flaw is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, commonly known as AFD. The driver is a kernel-level component supporting the networking functions used by Windows applications.

An attacker cannot exploit the vulnerability remotely against a completely untouched computer. They must first gain authenticated, low-privilege access through another intrusion, a compromised account, malicious software or a similar foothold.

Once inside, however, the attacker could exploit the flaw without requiring further interaction from the victim. Successful exploitation could elevate the attacker to SYSTEM privileges, giving them extensive control over the affected Windows installation.

SYSTEM access could allow an intruder to install additional malware, disable security controls, access or alter files, create new accounts and establish persistent access that survives a restart or password change. It can also turn a relatively limited initial intrusion into a complete compromise of the device.

Microsoft has rated the flaw Important rather than Critical, partly because exploitation requires an existing local foothold and involves higher technical complexity. The fact that attacks have already been detected means organisations should not interpret that rating as a reason to delay deployment.

The United States Cybersecurity and Infrastructure Security Agency added CVE-2026-68820 to its Known Exploited Vulnerabilities catalogue on the day the patch was released, confirming that there is evidence of real-world exploitation. US federal agencies have been directed to address the vulnerability by 25 August 2026.

The flaw affects a broad selection of Microsoft operating systems, including supported editions of Windows 10, Windows 11 versions 23H2, 24H2, 25H2 and 26H1, as well as multiple Windows Server releases. The affected server products extend from older editions covered by security programmes through to Windows Server 2025.

August’s release also addresses two publicly disclosed zero-days.

CVE-2026-62832 is an elevation of privilege vulnerability in the Windows User Profile Service. An authenticated attacker could use a specially prepared application to gain administrator privileges on the local computer. Microsoft considers exploitation more likely, although no attacks had been confirmed when the update was published.

The third zero-day, CVE-2026-72971, affects the Windows Container Isolation File System Filter Driver. It could allow an authenticated local attacker to tamper with protected files or resources. Microsoft has classified exploitation as unlikely, but its public disclosure before a fix was available gave attackers information that could potentially assist further research.

While those vulnerabilities are less urgent than the flaw already being exploited, they strengthen the case for treating the August update as a priority rather than waiting for the next routine maintenance window.

The 421 vulnerabilities span several potential impacts, including remote code execution, elevation of privilege, information disclosure, denial of service, spoofing and security feature bypasses. The release includes dozens of Critical vulnerabilities and fixes affecting Microsoft Office, SharePoint Server, Exchange Server, Azure services, Windows networking components and developer tools.

For Windows 11 versions 24H2 and 25H2, the primary cumulative update is KB5121003. It moves version 25H2 to build 26200.9168 and version 24H2 to build 26100.9168. Microsoft says it is not currently aware of any issues with the update, which is being delivered automatically through Windows Update and Microsoft Update.

Windows 10 users face an additional consideration. Standard consumer support for Windows 10 has ended, meaning most remaining devices must be enrolled in the Extended Security Updates programme to continue receiving monthly security protection. Supported Windows 10 ESU and LTSC systems receive the August fixes through KB5120249, which moves versions 22H2 and 21H2 to builds 19045.7663 and 19044.7663 respectively.

Alongside the security fixes, the Windows 11 update incorporates improvements previously released through Microsoft’s July preview update.

File Explorer can now display large file sizes using more appropriate units such as MB and GB instead of presenting everything in KB. Users can also middle-click folders in the address bar or Home page to open them in new tabs, while thumbnails in the Recommended section should appear clearer.

Windows Hello Enhanced Sign-in Security is also gaining support for compatible external fingerprint readers, allowing desktop users and others without built-in biometric sensors to register a fingerprint for secure sign-in.

Voice Access receives a Voice Isolation option designed to filter out background noise and other speakers, improving recognition when a user controls their computer by voice. Precision touchpads gain controls for scroll and zoom speed, together with an accelerated scrolling option for navigating lengthy documents more quickly. Some of these features may be introduced gradually and might not appear immediately on every eligible device.

Although 421 fixes would once have represented an extraordinary Patch Tuesday release, exceptionally large updates have become increasingly common during 2026.

Microsoft says the rising volume partly reflects expanded use of artificial intelligence to examine Windows code and validate potential security defects. Its multi-model agentic scanning system, known as MDASH, uses multiple AI models and more than 100 specialised agents to identify vulnerabilities, test whether findings are genuine and reduce false positives before sending confirmed issues to engineers.

The company has warned that customers should expect higher volumes of security fixes as AI helps defenders identify weaknesses earlier and at greater scale. Microsoft argues that larger update numbers do not necessarily mean Windows is becoming less secure, but rather that more vulnerabilities are being found and addressed before attackers can exploit them.

That distinction will offer little comfort to users who leave their devices unpatched. Once an update is released, attackers can study the changes, compare patched and unpatched code and attempt to develop working exploits for systems that have not yet been protected.

Windows 11 users can install the August update by opening Settings, selecting Windows Update and choosing Check for updates. The computer should be restarted when prompted to complete installation.

Eligible Windows 10 users can open Settings, select Update & Security, choose Windows Update and check for available updates. Anyone remaining on Windows 10 should also confirm that their device is properly enrolled in Extended Security Updates or covered by a supported enterprise edition.

For businesses, the actively exploited AFD vulnerability should receive particular attention. Security teams should identify affected devices, test the update against essential applications and accelerate deployment to administrator workstations, servers, high-value systems and computers that may already have experienced suspicious activity.

The August Patch Tuesday release is smaller than Microsoft’s record-breaking July rollout, but the presence of an exploited Windows zero-day makes it no less urgent. Users who postpone the update are leaving attackers with a documented route from limited access to near-complete control of the affected computer.