Microsoft's August release landed on the 11th with somewhere between 398 and 421 CVEs, depending on whose counting rules you accept and whether you fold in the Entra, Office, and Teams fixes that shipped earlier in the month. We spent last month's post on that arithmetic. This month the count is the least interesting number in the release.
The number that matters is 7.0.
CVE-2026-68820 is a use-after-free in afd.sys, the Ancillary Function Driver for WinSock that sits underneath the Windows Sockets API. A locally authenticated attacker runs a crafted application, wins a race condition, and gets SYSTEM. No user interaction required. Microsoft rated it Important and it scored 7.0 on CVSSv3, which put it below all 42 of this month's Critical items and below a great many things nobody is going to touch until September.
It is also the only vulnerability in the release confirmed exploited in the wild. Check Point, who reported it, observed it being used by North Korean operators to deploy a new build of FudModule, the Lazarus kernel-mode rootkit, as part of a fresh wave of the Operation Dream Job campaign.
Why the rating is defensible and useless
CVSS did its job. Local access rather than network, and a race condition that makes a stable exploit genuinely hard to build, both push the base score down. Microsoft's severity label followed the score. Nothing here is a scoring error.
It is a modeling error. Privilege escalation is almost never the first stage of an intrusion, so scoring it as though the attacker has to earn local access on their own merits misses how the flaw actually gets used. The attacker already has code execution from the phishing payload. This is the hop that turns a user-context foothold into kernel-mode persistence, and once you are loading a rootkit the question of how hard the race was to win stops being interesting.
The targeting pattern makes the case better than the theory does. Since 2022 there have been three other exploited afd.sys zero-days: CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193, the last of which was also attributed to Lazarus. That is four in four years, in one driver, with overlapping attribution. A driver with that history should carry a standing priority in your model regardless of what this month's score says.
The practical version: if your prioritization pipeline sorts by CVSS and cuts at 8.0, or filters on vendor severity and starts with Critical, the only thing being exploited this month fell below your line.
The two disclosed ahead of the patch
CVE-2026-62832 is a link-following flaw in the Windows User Profile Service, 7.8, publicly disclosed before a fix existed. An attacker holding credentials for another local account can load that user's registry hive and reach administrator rights on the asset. Rapid7 matched the advisory language to a previously described technique from the same pseudonymous researcher who has been dropping Windows privilege escalation bugs on Patch Tuesday for several months running.
CrowdStrike flagged a third, CVE-2026-62737, an elevation of privilege bug in the Windows kernel. Microsoft has not formally acknowledged it as publicly disclosed, but a Chinese-language proof of concept describing a system crash was published on August 9, two days ahead of the release.
The criticals are scoped by role, not by OS
Of the 42 Critical entries, 37 are remote code execution, and the cluster is not in the general OS surface. It is in network services. Four Critical DNS Server RCEs, the standout being CVE-2026-62878, which an unauthenticated attacker can reach over the network with low complexity and no user interaction. Microsoft QUIC took CVE-2026-62815, also unauthenticated network RCE. DHCP, RRAS, SSTP, the WDS TFTP Server, and the iSCSI Target Service all carry Critical entries as well.
That distribution changes the verification question. A dashboard reporting 98 percent patch compliance across your server estate is answering "did the OS take the cumulative update." The question this month is "did every machine running the DNS Server role take the applicable update," and those are not the same query. Most compliance reporting is built on OS version and update state because that data is easy to get. Installed roles are the actual unit of exposure here, and an environment that cannot slice patch state by role is reporting a number that does not describe its risk.
On the cloud side, CVE-2026-59115 is a 9.9 path traversal in the Microsoft Entra Provisioning Service allowing a low-privileged authorized attacker to escalate across an enterprise tenant. Nothing to deploy, but worth knowing it happened.
ESU stopped being a footnote
CrowdStrike's product breakdown is the quiet story of the month: Windows took 233 patches, Extended Security Updates took 192, and Office took 125. Nearly two hundred CVEs landing on machines an organization has already formally decided are past their supported life is not a rounding error, and ESU cohorts are typically the ones with the weakest deployment tooling and the least test coverage.
Two dates make that worse before October. Windows Server 2022 drops to extended support on October 13, 2026. Windows 11 version 24H2 Home and Pro reach end of updates the same day, with enterprise and education editions carrying on to October 2027. That is two Patch Tuesdays out. If your 24H2 upgrade rings are not planned by the September release, October becomes a deadline problem rather than a deployment problem.
Deployment and testing notes
KB5121003 covers Windows 11 25H2 and 24H2, producing builds 26200.9168 and 26100.9168. KB5121000 covers 26H1 and includes a fix to TPM maintenance reporting so that endorsement key certificate status is reported accurately, along with wider device targeting for the new Secure Boot certificate rollout. Hotpatch-eligible devices can take this month's fixes without a reboot, which is worth confirming before you schedule a maintenance window you may not need.
Microsoft published 109 test guidance entries with four flagged High Risk, down from 14 in July. Three of those four sit on win32kfull.sys, which is also the most-patched binary this month at seven entries, and they cover 32-bit printing on 64-bit Windows plus font rendering. The Remote Desktop client carries the fourth. Printing and font handling have a long history of producing regressions that only appear on real hardware with real drivers, so if you have a limited test budget this month, spend it there.
Two of the CVEs in circulation, CVE-2026-6726 and CVE-2026-6727, are Trusted Computing Group TPM 2.0 reference code bugs assigned by MITRE rather than Microsoft. Several vendors exclude them, which accounts for part of the spread between published totals.
Everything else that shipped the same week
Adobe went first, with an out-of-band fix earlier in August for CVE-2026-48449, a maximum-severity improper authorization flaw that executes code with no user interaction. Adobe shares code broadly across its product line, so this is a "whatever you have installed" situation rather than a single-product one. On the 11th they followed with five advisories covering 51 CVEs, 33 of them critical, across ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Campaign Classic.
SAP shipped a 10.0 improper authorization flaw in the SAP Commerce Cloud Data Hub Adapter. Metabase patched a critical SQL injection already being used in data theft attacks. Cisco covered Catalyst SD-WAN, IOS, IOS XE, and ClamAV flaws with public exploits available. TP-Link fixed 15 issues in its zero-touch provisioning mechanism. Updates also landed from SonicWall, Mozilla, WordPress, Bitwarden Server, VMware, BeyondTrust, Oracle, and Chrome.
The one to read carefully is N-able. CVE-2026-18577 is an actively exploited authentication bypass in N-central, affecting both hosted and on-premises servers. That is the same shape of problem we wrote about after July's WSUS elevation of privilege bug: the management plane is a higher-value target than the endpoints it manages, it has authenticated reach into every machine it touches, and it is almost always the last thing in the environment to get patched because patching it interrupts the tool you patch everything else with.
What August actually says
Three months of headline numbers, roughly 200 in June, north of 570 in July, and around 400 now, invite a conclusion about volume and shrinking remediation windows. Both of those are real. Neither is the useful lesson from this release.
The useful lesson is that August contained exactly one flaw known to be under attack, it was rated Important, it scored 7.0, and while it sat below every Critical item in the same release a nation-state crew was using it to load a kernel rootkit. Patching faster does not fix that. Ranking on something other than the vendor's severity label does: exploitation status first, then exposure, then role, then how far the privilege actually reaches. And then proving that the specific machines that needed a specific update took it, which is the part that quietly fails in most environments, not because nobody deployed, but because compliance was measured against a denominator that never included the role in question.