Microsoft Patches 398 Flaws Including Active Windows Zero-Day

Microsoft released its August 2026 Patch Tuesday security updates on Tuesday, addressing a massive batch of 398 new vulnerabilities across its software portfolio, including one flaw already being exploited in the wild. The release, which security experts say reflects the new normal of large-scale patch cycles, includes fixes for critical remote code execution bugs and several publicly disclosed vulnerabilities.

The most urgent issue is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys). Microsoft confirmed this flaw is under active exploitation, allowing a locally authenticated attacker to elevate privileges to SYSTEM level by triggering a race condition. Security researchers at Check Point reported that North Korean threat actors have used this zero-day to deploy a kernel-mode rootkit as part of the Operation Dream Job campaign. The vulnerability requires no user interaction, making it a high priority for patching on systems where an attacker may have already gained initial access.

Four other critical vulnerabilities allow remote code execution without any authentication, each carrying a CVSS score of 9.8. These include...