Microsoft Patches Nearly 400 Windows Vulnerabilities Including Active Zero-Day

Microsoft released updates on August 11, 2026, to fix at least 398 security vulnerabilities across its Windows operating systems and supported software. The release includes one actively exploited zero-day flaw and two previously detailed weaknesses, following a trend of massive patch volumes driven by artificial intelligence vulnerability discovery.

August 2026 Patch Tuesday Volume and Critical Ratings

The August bundle did not surpass the record-setting release of more than 570 security updates issued last month, but it still doubled the nearly 200 fixes published in June. Microsoft attributes this recent patch deluge to vulnerability discoveries aided by artificial intelligence. Out of the 398 flaws fixed on August 11, 2026, exactly 42 earned Redmond’s most-dire critical rating. These severe vulnerabilities could allow malware or unauthorized actors to gain remote control over a Windows computer with little to no user interaction.

Zero-Day Vulnerability in afd.sys and Other Publicly Disclosed Flaws

The sole known zero-day bug patched in August 2026 is CVE-2026-68820, a privilege escalation weakness in the core Windows component afd.sys. According to the security firm Automox, afd.sys is the driver behind Windows socket connections on effectively every endpoint. Landon Miles of Automox explained in a Patch Tuesday blog post that the flaw acts as a secondary step in an attack chain where an adversary first establishes a low-privilege foothold via phishing before utilizing the driver flaw to take over the system. The vulnerability received a 7.0 score reflecting high attack complexity due to fiddly race conditions that require repeated exploitation attempts for correct timing.

Microsoft also labeled CVE-2026-62832, a privilege escalation flaw in the Windows User Profile Service, as likely to be exploited. This flaw may connect to the recent LegacyHive public disclosure by bug hunter Nightmare Eclipse. An additional publicly disclosed flaw, CVE-2026-72971, involves a low-impact local tampering vulnerability that Microsoft considers unlikely to be exploited.

Industry-Wide Patch Deluge and the AI Patching Dilemma

Other major software vendors are similarly increasing patch volumes and cadence due to artificial intelligence adoption. Adobe shifted to twice-monthly security bulletins published on the second and fourth Tuesday of each month, while Cisco, Google, Mozilla, and Oracle are shipping updates more frequently and abundantly. While AI excels at finding security holes, researchers note that fixing them remains a heavily human-centric endeavor. A recent study by researchers at 1Password examining large language models (LLMs) generating vulnerability patches found that the models produced patches that either failed to fix the flaw or introduced a new weakness more than half the time.

Ed Skoudis, president of the SANS Technology Institute, noted positive results using AI for patch generation when human oversight is applied. AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem, Skoudis wrote in a SANS newsletter on August 11, 2026. Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.

Security Guidance and Recommendations for Organizations

Tyler Reguly at Fortra advises organizations not to rush updates despite reports of massive patching loads, noting that only one of the nearly 400 addressed bugs is known to be actively exploited. Reguly recommends that security leaders check in with teams regarding workload management and testing fixes prior to production deployment. If you’re a chief security officer talk to your teams about how they are shifting or modifying their workflows to better accommodate the patching shift that we’re seeing and support them across various organizational units by enabling the changes they want to see made, Reguly stated.

Security professionals recommend backing up systems and data prior to applying the August 2026 patch load. Organizations often wait a few days before deploying large update bundles to allow Microsoft time to resolve any initial misbehaving patches. A clickable, per-patch breakdown categorized by severity and urgency is available through a roundup published by the SANS Internet Storm Center.