As expected following last July’s largest Patch Tuesday release, the new normal has arrived with 398 CVEs being addressed in August. In this month’s release, 41% of all CVEs patched were elevation of privilege bugs. This tracks with the overall trends in 2026, with privilege escalation accounting for 46% of all CVEs this year.
Three zero-days were patched this month, including CVE-2026-68820, an elevation of privilege flaw in the Windows Ancillary Function Driver (afd.sys) for WinSock, that handles socket commands. Not only was this vulnerability exploited in the wild, it could be an exploit leveraged by nation state actors.Since 2022, there have been three other afd.sys zero-days exploited in the wild including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group. While no exploit details have been made public yet for CVE-2026-68820, historical tradecraft of this nature is typically leveraged by APT groups in limited, targeted attacks.
Another privilege escalation flaw, CVE-2026-62832, in Windows User Profile Service (ProfSvc), a service for loading/unloading user profiles, was publicly disclosed prior to this month’s Patch Tuesday release. This is the third elevation of privilege flaw in the User Profile Service to be disclosed publicly as a zero-day, the first in four years, since CVE-2022-21919 in January 2022 and CVE-2022-26904 in April 2022.
The other publicly disclosed flaw, CVE-2026-72971, is a local tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), a service for Unix-like operating systems including Linux, FreeBSD, and NetBSD, that can union mount other file systems. —- Satnam Narang, Senior Staff Research Engineer at Tenable