Microsoft's August 2026 Patch Tuesday fixes 421 CVEs, including an exploited WinSock zero-day

Microsoft's August 2026 Patch Tuesday closed 421 CVEs in a single release. One of them, CVE-2026-68820, was an actively exploited zero-day and the only bug in the batch known to be under attack. It is a use-after-free elevation-of-privilege flaw in the Ancillary Function Driver for WinSock (afd.sys). Because afd.sys underpins the Windows Sockets API, the kernel-mode bug is a notable local privilege-escalation risk.

Why it matters: An exploited kernel driver flaw lets an attacker who already has a foothold escalate to full control, so this is a patch defenders cannot defer.