Microsoft Patches Nearly 400 Flaws, Including Exploited afd.sys Zero-Day
Active Exploitation · 64 sources · Updated 3mo ago · First seen Aug 11, 2026
Microsoft released a broad security update covering roughly 398 to 421 vulnerabilities across Windows, Office, Exchange, SharePoint, Azure, .NET, Teams, and other enterprise products, with 42 rated Critical. The most urgent issue is CVE-2026-68820, an actively exploited elevation-of-privilege flaw in the Windows afd.sys Ancillary Function Driver for WinSock that can let an attacker with code execution gain SYSTEM privileges; reporting linked observed exploitation to Lazarus activity. Microsoft also addressed publicly disclosed flaws including CVE-2026-62832, and researchers warned it could be chained with the afd.sys bug for full system compromise.
The release also fixes multiple high-impact server-side and enterprise-facing vulnerabilities, including critical or high-severity remote code execution bugs in Windows iSCSI Target Service (CVE-2026-65791, CVE-2026-65679), Windows GDI+ (CVE-2026-62822), Windows DHCP Server (CVE-2026-62823), Remote Desktop Client (CVE-2026-62824), Windows SMBv3 Server (CVE-2026-62790, CVE-2026-62800), and Microsoft Office (CVE-2026-70130), alongside spoofing and privilege-escalation issues in Azure Entra ID (CVE-2026-62869), Windows NAT (CVE-2026-56179), Exchange Server (CVE-2026-62911), .NET Framework (CVE-2026-62872), and Windows DNS (CVE-2026-62778). Microsoft also completed remediation of an on-premises SharePoint exploit chain by patching CVE-2026-63520 after July’s fix for CVE-2026-55040, prompting defenders to prioritize the exploited kernel flaw, exposed network services, and fully update SharePoint farms.
