MICROSOFT’S August Patch Tuesday release fixes 421 vulnerabilities, among them three zero‑day flaws that have already been seen in attacks linked to the Lazarus Group, according to Malwarebytes.
The updates cover Windows, Office and several backend components, with 62 of the flaws rated critical.
The most actively exploited issue is CVE-2026-68820, a use‑after‑free vulnerability in the Windows Ancillary Function Driver for WinSock that allows attackers to elevate to SYSTEM privileges without user interaction.
Two other zero‑days disclosed in the same batch are CVE-2026-62832, an elevation of privilege flaw in the User Profile Service, and CVE-2026-72971, a tampering vulnerability in the Windows Container Isolation FS Filter Driver, as noted by Infosecurity Magazine.
Both CVE-2026-62832 and CVE-2026-72971 are rated high and medium respectively, though no public exploits have been confirmed for them at this time.
Among the critical remote code execution flaws are CVE-2026-62893, an unauthenticated SharePoint vulnerability that could let an attacker run arbitrary code on exposed servers, and CVE-2026-63520, a separate SharePoint RCE issue also rated critical, as highlighted by Rapid7.
The batch also includes CVE-2026-62815 and CVE-2026-62878, both scoring CVSS 9.8 and affecting the Microsoft QUIC protocol and Windows DNS Server respectively.
Although these latter two have not yet been observed in the wild, their severity warrants immediate patching.
Threat intelligence indicates that the Lazarus Group has leveraged CVE-2026-68820 in recent intrusions to gain full control of compromised endpoints, a finding reported by Securityonline.info.
While the other zero‑days remain unexploited publicly, their disclosure raises the likelihood that adversaries will develop working exploits in the near term.
The sheer volume of critical fixes highlights the importance of treating this Patch Tuesday as a high‑priority event for all Windows environments.
Administrators should deploy the August updates through Windows Update, WSUS or Microsoft Endpoint Configuration Manager as soon as possible, prioritising systems that expose SharePoint or run the WinSock driver.
Network defenders are advised to review authentication logs for unusual privilege escalation attempts and to monitor for lateral movement indicators such as unexpected service installations.
Where immediate patching is not feasible, consider applying temporary mitigations like restricting outbound SMB traffic from SharePoint servers and disabling unnecessary Windows Container features until the patches can be applied.
Finally, maintain offline backups and ensure incident response playbooks include steps for handling potential SYSTEM‑level compromise stemming from the WinSock zero‑day, guidance echoed by SecurityWeek