Microsoft's August Patch Tuesday Includes Over 400 Bugs to Fix

Microsoft released its August Patch Tuesday update, addressing 421 security vulnerabilities. The software giant aims to fix various bugs, including potential bypasses by threat actors. The patches are available to users as part of Microsoft's ongoing security efforts. Despite these efforts, one vulnerability has reportedly already been exploited by the North Korean state-sponsored actor 'Lazarus Group'.

MSFT shipped its August 2026 Patch Tuesday update fixing 421 CVEs across Windows and its broader product line, including 62 rated Critical and three actively exploited zero-days. The most urgent of the three, CVE-2026-68820, is a use-after-free flaw in the Windows Ancillary Function Driver for WinSock that can grant an authenticated local attacker SYSTEM privileges without user interaction, and it was already being exploited before the patch shipped.

Check Point researchers linked exploitation of that flaw to North Korea's state-sponsored Lazarus Group, which used it to deploy the FudModule rootkit in live attacks. The scale of this release, more than 400 fixes in a single cycle, is among the largest Patch Tuesday batches Microsoft has shipped, and the presence of a pre-patch zero-day exploited by a sophisticated nation-state actor underscores the gap between vulnerability disclosure and real-world patch adoption.

For enterprise IT and security teams, the immediate priority is verifying that endpoint patching pipelines have applied CVE-2026-68820 given its SYSTEM-level privilege escalation and confirmed in-the-wild use. The broader pattern, large monthly patch volumes paired with pre-disclosure exploitation by groups like Lazarus, could keep pressure on organizations' patch-management cadence and may factor into how enterprises evaluate Microsoft's security posture relative to peers over time.

Related Stocks

MSFT