Microsoft’s August 2026 Patch Tuesday release is one of the larger updates the company has shipped this year, addressing 394 vulnerabilities spread across Windows, Microsoft Office, SharePoint Server, Azure services, .NET, PowerShell, Visual Studio Code, and a long list of other enterprise products. Published on August 11, the update includes fixes for three zero-day vulnerabilities, one of which Microsoft confirms is already being exploited in real-world attacks.

The Three Zero-Days

The most urgent of the trio is CVE-2026-68820, a flaw in the Windows Ancillary Function Driver for WinSock that enables elevation of privilege and is confirmed as actively exploited. This is the same driver-level bug that North Korea’s Lazarus group has been observed weaponizing to deploy its FudModule rootkit against defense and aerospace organizations, giving attackers a path from an initial foothold straight to SYSTEM-level control.

The other two zero-days were publicly disclosed before Microsoft could ship a fix, though neither shows confirmed evidence of active exploitation yet. CVE-2026-72971 affects unionfs.sys, the driver behind Windows Container Isolation, and is classified as a tampering vulnerability that could undermine the integrity of container-related files or behavior — a concern for any organization running containerized workloads on Windows hosts. CVE-2026-62832 is an elevation-of-privilege bug in the Windows User Profile Service; while not yet observed in attacks, public disclosure typically accelerates the appearance of proof-of-concept exploit code.

Where the Bulk of the Fixes Land

Beyond the three headline zero-days, the update’s 394 fixes break down heavily toward privilege escalation and remote code execution: 150 elevation-of-privilege bugs and 132 remote-code-execution flaws account for roughly 70% of the total. The remainder covers 66 information-disclosure issues, 21 spoofing bugs, 12 denial-of-service flaws, 9 security-feature bypasses, and 4 additional tampering vulnerabilities.

That distribution matters for prioritization. Elevation-of-privilege bugs are especially valuable to attackers who already have a foothold on a network — a phishing victim’s laptop or a compromised service account — because they turn limited access into full administrative control. Remote-code-execution flaws, meanwhile, are the bugs most likely to headline a future breach disclosure if left unpatched, since they can potentially be triggered without any prior access to the target system.

Notable Fixes Outside the Zero-Day List

The same update cycle includes a fix for CVE-2026-70329, a high-severity remote code execution flaw in Microsoft Outlook rated 8.8 on the CVSS scale, which requires a victim to open a maliciously crafted Office file. SharePoint Server, Azure services, and several Office applications also received patches for information-disclosure and spoofing issues, rounding out what Microsoft describes as customer-action-required fixes across nearly every major product line the company maintains.

What IT Teams Should Prioritize

• Patch CVE-2026-68820 first — it is the only confirmed actively exploited flaw in this release and has already been tied to a live nation-state campaign.
• Prioritize Windows Container Isolation hosts for the unionfs.sys fix (CVE-2026-72971), since public disclosure increases the odds of near-term exploitation.
• Review endpoint telemetry for signs of unusual local privilege escalation, particularly around the Windows User Profile Service.
• Don’t overlook the Outlook and Office fixes bundled into the same cycle — remote code execution bugs delivered through email remain one of the most common real-world attack paths.
• Given the scale of this update, use vulnerability management tooling to map which of the 394 CVEs actually apply to your environment rather than attempting a blanket manual review.

With 394 vulnerabilities in a single release and at least one already being actively weaponized, this month’s Patch Tuesday is a reminder that patch management can’t be treated as a routine monthly chore. Security teams should move quickly on the confirmed zero-day while working through the broader backlog in order of exposure and exploitability.