Microsoft's 11 August 2026 update addressed 421 vulnerabilities — 62 critical and 357 important. It contained three zero-days: two publicly disclosed, one already exploited in the wild. Microsoft shipped no Edge (Chromium) fixes this month, so 421 is the operating-system and application total with no browser padding.
That last detail explains the disagreement in coverage, where figures of 394 and 400 also circulated. Different outlets counted at different points and folded in different things. If the number matters for a report, count it from the Security Update Guide yourself.
The three zero-days
| CVE | Component | Type |
|---|---|---|
| CVE-2026-68820 | Ancillary Function Driver for WinSock (afd.sys) |
Use-after-free → elevation of privilege |
| CVE-2026-72971 | Container Isolation FS Filter Driver (unionfs.sys) |
Link-following → tampering |
| CVE-2026-62832 | User Profile Service | Link-following → elevation of privilege |
Only CVE-2026-68820 is confirmed exploited. CISA added it to the Known Exploited Vulnerabilities catalogue the same day with a 25 August remediation deadline.
The pattern is more interesting than the total
Not one of the three is remote code execution. All three require the attacker to already be running code on the machine. In a month with 62 critical CVEs, the bugs that were actually being used — or were public before the patch — were the unglamorous local ones.
And two of the three are the same bug class. CVE-2026-72971 and CVE-2026-62832
are both link-following flaws: the attacker plants a symbolic link or junction where a
privileged service expects a real path, and the service follows it, performing a
file operation as SYSTEM against a target the attacker chose.
That class has been productive against Windows for years for a structural reason. A great many services run as SYSTEM and touch paths under user-writable directories — profile folders, temp directories, container layers. Every one of those interactions is a place where "the path I was given" and "the path I ended up at" can be made to diverge. The fix is per-instance; the pattern keeps recurring because the underlying design invites it.
Why local bugs deserve better ranking
The habit of triaging RCE first and elevation of privilege second is understandable and, this month, wrong.
Modern intrusions rarely begin with remote code execution against a patched perimeter. They begin with a credential, a phishing lure, or a malicious document — arriving as a low-privileged user in a sandbox. What converts that into a real compromise is precisely an EoP. It is the difference between one user's mailbox and the domain.
CVE-2026-68820 is the demonstration: reporting attributes its exploitation to North
Korean operators who used it to load a kernel-mode rootkit. Nobody needed remote code
execution. They needed the step after the foothold.
What to do
Deploy the August cumulative update. The exploited flaw's federal deadline has passed, which is a fair signal for everyone else.
If you are ranking within the 421, put the three above at the top regardless of their CVSS relative to the criticals, on the grounds that public disclosure and confirmed exploitation beat theoretical severity.
For the link-following pair, the durable defence is not the patch alone — it is reducing how many privileged services touch user-writable paths at all, and monitoring for junction and symlink creation in profile and temp directories. That detection generalises to the next two of these, which will come.