Loading story…
Microsoft released its August 2026 security updates to address 420 newly disclosed vulnerabilities across its product portfolio, according to alerts published by CSIRT Italia and CERT-PY. The advisories highlight one zero-day and three Windows flaws drawing particular attention because they are either under active exploitation or have publicly available proof-of-concept code: CVE-2026-68820, CVE-2026-72971, and CVE-2026-62832.
CVE-2026-68820 affects the Windows Ancillary Function Driver for WinSock and is a use-after-free bug that could allow a locally authenticated attacker to win a race condition and obtain SYSTEM privileges. CVE-2026-72971, in the Windows Container Isolation FS Filter Driver, and CVE-2026-62832, in the Windows User Profile Service, are link-following issues that can enable unauthorized local actions; the latter could let an attacker access or modify another local user’s registry hive and potentially escalate to administrative privileges. The notices urge organizations to deploy the updates through Windows Update and review Microsoft’s MSRC Update Guide and release notes for affected products.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT Italia published alert AL04/260812/CSIRT-ITA covering Microsoft's August 2026 security updates and recommending that impacted products be updated through Windows Update. The alert reported a systemic impact score of 76.66 classified as Critico.
The August 2026 bulletin specifically highlighted CVE-2026-68820, CVE-2026-72971, and CVE-2026-62832 as vulnerabilities with either publicly available proof-of-concept code or active exploitation. The flaws affect the Windows Ancillary Function Driver for WinSock, Windows Container Isolation FS Filter Driver, and Windows User Profile Service, respectively.
Microsoft's August 2026 monthly security updates fixed 420 newly disclosed vulnerabilities across affected products, including one zero-day. The bulletin covered issues across categories such as elevation of privilege, remote code execution, spoofing, information disclosure, tampering, and denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft released a broad security update covering roughly **398 to 421 vulnerabilities** across Windows, Office, Exchange, SharePoint, Azure, .NET, Teams, and other enterprise products, with **42 rated Critical**. The most urgent issue is **`CVE-2026-68820`**, an actively exploited elevation-of-privilege flaw in the Windows **`afd.sys`** Ancillary Function Driver for WinSock that can let an attacker with code execution gain **SYSTEM** privileges; reporting linked observed exploitation to **Lazarus** activity. Microsoft also addressed publicly disclosed flaws including **`CVE-2026-62832`**, and researchers warned it could be chained with the afd.sys bug for full system compromise. The release also fixes multiple high-impact server-side and enterprise-facing vulnerabilities, including critical or high-severity remote code execution bugs in **Windows iSCSI Target Service** (**`CVE-2026-65791`**, **`CVE-2026-65679`**), **Windows GDI+** (**`CVE-2026-62822`**), **Windows DHCP Server** (**`CVE-2026-62823`**), **Remote Desktop Client** (**`CVE-2026-62824`**), **Windows SMBv3 Server** (**`CVE-2026-62790`**, **`CVE-2026-62800`**), and **Microsoft Office** (**`CVE-2026-70130`**), alongside spoofing and privilege-escalation issues in **Azure Entra ID** (**`CVE-2026-62869`**), **Windows NAT** (**`CVE-2026-56179`**), **Exchange Server** (**`CVE-2026-62911`**), **.NET Framework** (**`CVE-2026-62872`**), and **Windows DNS** (**`CVE-2026-62778`**). Microsoft also completed remediation of an on-premises **SharePoint** exploit chain by patching **`CVE-2026-63520`** after July’s fix for **`CVE-2026-55040`**, prompting defenders to prioritize the exploited kernel flaw, exposed network services, and fully update SharePoint farms.
Aug 13, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026
Microsoft released its October 2024 security updates with fixes for **118 vulnerabilities** across Windows and other products, including **3 critical flaws**, **5 zero-days**, and **2 vulnerabilities reported as actively exploited in the wild**. The zero-days highlighted in public reporting include `CVE-2024-43573` in **MSHTML**, `CVE-2024-43572` in **Microsoft Management Console** handling of `.msc` files, `CVE-2024-6197` in **libcurl**, `CVE-2024-20659` in **Hyper-V**, and `CVE-2024-43583` in **Winlogon**. Microsoft documented the release in its Security Update Guide release notes. The two exploited issues were identified as an **MSHTML spoofing vulnerability** and a **Microsoft Management Console remote code execution flaw** tied to malicious `.msc` files. Guidance accompanying the release urged organizations to prioritize rapid deployment of the October patches, with additional mitigation advice for `CVE-2024-43583`: administrators were advised to enable the official Microsoft IME to reduce exposure from vulnerable third-party input method editors affecting Winlogon.
Jul 24, 2026