Microsoft Patches 398 Flaws in August Patch Tuesday, Including a Zero-Day North Korea Already Exploited

Microsoft's August 2026 Patch Tuesday landed Tuesday, August 11. The company fixed 398 vulnerabilities according to Tenable, a figure that rises to 421 if you count Qualys's tally, which folds in different scoping. BleepingComputer put the number at roughly 400. The gap comes down to counting methodology, not disagreement over the facts.

This release is larger than a typical month. It's smaller than July's 570-flaw release, according to BleepingComputer. Microsoft has warned it expects more of these large batches going forward, because it's now using an AI-powered vulnerability discovery system to hunt for bugs across its own product line.

One flaw was already being used by North Korean hackers

The most significant item in the release is CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock. Microsoft says a locally authenticated attacker can exploit it to grab SYSTEM privileges, no user interaction required, by winning a race condition.

Check Point Research, which credited its own researchers Moshe Marelus and David Driker with finding the flaw, says it was used in real-world attacks by Lazarus, the North Korean state-linked hacking group. According to Check Point, Lazarus exploited the bug to deploy an updated version of FudModule, a kernel-mode rootkit the group has used before. CISA has added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog, according to Qualys, and is telling federal agencies to patch it by August 25, 2026.

Microsoft has not published details on how the attacks were carried out, which is standard practice while a patch is still rolling out.

Two more zero-days, one critical RCE with a 9.8 severity score

Beyond the actively exploited bug, Microsoft patched two more zero-days that were publicly disclosed before fixes existed. CVE-2026-62832 hits the Windows User Profile Service and can hand an attacker administrator rights, scoring 7.8 out of 10 on the severity scale according to Tenable. CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver and allows tampering, though Microsoft rates active exploitation as "unlikely."

CVE-2026-62893 is a remote code execution flaw in the Windows Deployment Services TFTP Server that scored 9.8 out of 10 on the severity scale, with Microsoft assessing exploitation as "more likely." An unauthenticated attacker who can reach the service over a network could trigger it just by sending crafted packets. Tenable credits Nikolai Skliarenko of TrendAI Research with the discovery. A second critical bug, CVE-2026-62823 in Windows DHCP Server, scored 8.8.

Across the release, elevation-of-privilege bugs made up 40.7% of everything patched, with remote code execution flaws close behind at 27.1%, according to Tenable's breakdown. Notably, Microsoft shipped zero fixes for Edge this month, according to Qualys, an unusual gap for the Chromium-based browser.

Adobe and the chip makers had their own month

Adobe released five advisories covering 51 vulnerabilities across ColdFusion, Commerce, Lightroom Classic, the Content Credentials SDK, and Campaign Classic. According to Qualys, 33 were rated critical. Enterprises running ColdFusion or Commerce in production should take note of this ratio.

Back in February, Intel and AMD ran their own coordinated disclosure cycle, patching more than 80 combined vulnerabilities, according to SecurityWeek. AMD's share was the larger chunk: seven advisories covering more than 50 CVEs, including 14 hitting Athlon and Ryzen processors directly and another 15 in graphics drivers. Neither company reported active exploitation of any of those bugs at the time.

A newer chip-level problem: bypassing Spectre defenses with precisely timed interrupts

MIT CSAIL researchers Daniël Trujillo and Mengjia Yan disclosed a technique called Interrupt Injection that lets an unprivileged Linux program time a hardware interrupt to slip into the narrow gap between when a processor cleans its branch predictor and when the kernel actually uses it. This can undo the Spectre v2 defense.

On an AMD Zen 2 machine running Linux 6.14 with every default mitigation turned on, the researchers' exploit leaked kernel memory at 5.47 bytes per second with roughly 92% accuracy, according to The Hacker News. This proved sufficient to read the system's password hash file in half of ten attempts. It requires no special privileges, just the ability to run code locally. Shared systems, like cloud servers running multiple customers' workloads, represent the primary risk.

The researchers disclosed the issue to AMD and Intel on February 5. AMD engineers Borislav Petkov and David Kaplan wrote a kernel fix that landed June 2, and AMD published its own bulletin, AMD-SB-7061, on August 6, naming Zen 1 through Zen 4 as affected. AMD's bulletin says the behavior "appears to be associated with the Linux implementation" of the mitigation rather than a hardware flaw outright. Intel, according to the paper shared with The Hacker News, does not believe a mitigation is necessary on its side.

Neither AMD's bulletin nor MIT's announcement points administrators directly to the kernel commit that fixes it, and there's no CVE number attached. That means an IT team checking whether a given Linux box is protected has to know the exact commit name, "x86/bugs: Make Safe-RET robust against interrupt injection," rather than being able to look up a standard vulnerability ID. Whether AMD assigns a CVE and updates its documented vulnerability status file remains an open question as of this week.