Microsoft Patches 398 Windows Flaws, One Actively Exploited

Microsoft's August 2026 Patch Tuesday release fixes at least 398 security vulnerabilities in Windows and supported software, including one weakness already being actively exploited and two others that were publicly detailed before the update. The August 11, 2026 bundle is smaller than last month's record of more than 570 security updates, but it is double June's then-record batch of nearly 200 fixes. Microsoft attributes the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree Windows users should get used to Patch Tuesday, the second Tuesday of each month, covering hundreds of newly discovered security flaws.

Of the 398 flaws, 42 earned Microsoft's most severe critical rating, meaning they are serious enough that malware or attackers could exploit them to gain remote control over a Windows computer with little to no help from the user. The sole known zero-day fixed this month is CVE-2026-68820, a privilege escalation weakness in a core Windows component called afd.sys. Afd.sys is the driver behind Windows socket connections, the underlying mechanism that programs use to send and receive data over a network, and it runs on effectively every endpoint. Privilege escalation means a flaw that lets someone who already has limited access gain higher privileges, such as administrator control. Automox's Landon Miles described this as not a front-door bug but step two in an attack chain: an attacker first uses phishing to get a low-privilege foothold, then uses the driver flaw to take over the machine. The 7.0 severity score reflects the high attack complexity, because race conditions, flaws that depend on precise timing, are fiddly. The exploit has to be thrown over and over until the timing lands, and someone is clearly landing it anyway.

Microsoft also patched CVE-2026-62832, another privilege escalation flaw that the company has labelled likely to be exploited. This weakness lies in the Windows User Profile Service, which manages user settings and accounts, and it may be related to a recent public disclosure called LegacyHive from the prolific bug hunter known as Nightmare Eclipse. The other publicly disclosed flaw is CVE-2026-72971, a low-impact local tampering vulnerability that Microsoft reckons is unlikely to be exploited.

Other major software makers are likewise increasing their patch volumes and cadence thanks to AI. Adobe has moved to twice-monthly security bulletins published on the second and fourth Tuesday of each month. Cisco, Google, Mozilla and the database vendor are also shipping updates far more frequently and abundantly. By all accounts, AI is quite good at finding security holes in software. But for now at least, patching the resulting bugpocalypse remains a heavily human-centric endeavor, and the jury is still out on whether AI technologies will turn out to be as good at fixing vulnerabilities as they are at finding and exploiting them. That question matters because these same AI technologies also suggest fixes for the vulnerabilities they find. Researchers at 1Password recently examined what happens when different large language models, or LLMs, generate vulnerability patches for newly disclosed, complex vulnerabilities. They found the LLMs produced patches that failed to fix the flaw or added a new weakness in the process, or both, more than half the time. Ed Skoudis, president of the SANS Technology Institute, said his team has seen excellent results using AI to generate patches, provided there are humans in the loop to test the suggested fixes and push for iterative improvements. He wrote in a SANS newsletter that AI is rapidly becoming astonishingly good at finding vulnerabilities, but fixing them is a very different problem. Skoudis warned not to expect one-shot AI patching to work reliably; instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.

Tyler Reguly at Fortra says reports of Microsoft patching hundreds of vulnerabilities in one go have prompted some organizations to try to patch faster, but it is important to remember that only one of the almost 400 bugs addressed today is known to be actively exploited. Reguly suggested security leaders check in with their teams to see how they are handling the increasing workloads, which often involve testing fixes before deploying them in production environments. He recommended that chief security officers talk to their teams about how they are shifting or modifying workflows, and support them across various organizational units by enabling the changes they want to see made. Reguly added there is no need to rush these updates, no matter what various vendors and organizations try to tell you, and that you need to make sure you are rolling out safe updates that will not negatively impact your systems.

Speaking of the humans behind the keyboards, do not neglect to back up your system and data before applying this month's large patch load. The day after each month's Patch Tuesday is sometimes derisively referred to as Reboot Wednesday, but it generally does not hurt to wait a few days to apply these huge update bundles because it sometimes takes a couple of days for the occasional misbehaving patch to get ironed out properly by Microsoft. For a clickable, per-patch breakdown by severity and urgency, security practitioners can consult the roundup from the SANS Internet Storm Center.

For website owners and IT teams, the same patch discipline applies to web servers and hosting platforms. Managed WordPress hosting such as AEU Hosting includes server-side security updates and hardening, so customers are not left to track and test every operating system or application patch themselves.