Microsoft security patches close on 400 Windows flaws in massive August rollout

Microsoft today unleashed its latest batch of Microsoft security patches, addressing ↑ 398 flaws across Windows and ancillary software. The haul, while shy of last month’s record‑breaking ↓ 42 critical‑rated bugs, still dwarfs the typical monthly update and underscores the accelerating role of artificial intelligence in vulnerability hunting.

Microsoft security patches target critical Windows components

Among the fixes, CVE‑2026‑68820 stands out as the only confirmed zero‑day, a privilege‑escalation flaw in the afd.sys driver that underpins socket communication on virtually every Windows endpoint. Security firm Automox warned that attackers can first gain a low‑privilege foothold via phishing, then exploit the driver to seize full control, noting the exploit’s high complexity but proven success.

Additional high‑risk flaws

Two other vulnerabilities – CVE‑2026‑62832 in the User Profile Service and CVE‑2026‑72971 a local tampering issue – were disclosed publicly before today’s patch cycle; the former is flagged as likely to be weaponized, the latter as low impact.

“AI is rapidly becoming astonishingly good at finding vulnerabilities, but fixing them remains a distinctly human challenge,” says Ed Skoudis, president of the SANS Technology Institute.

Must Read Intel Threema DDoS attacks cripple secure messaging service, users face extended outage

Industry peers such as Adobe, Cisco and Google have similarly accelerated their update cadence, with Adobe moving to bi‑monthly bulletins. Yet research by 1Password reveals that large‑language models often generate patches that miss the mark or introduce new flaws, reinforcing the need for rigorous human testing. Tyler Reguly of Fortra cautions security leaders to resist the urge to rush deployments; only one of the 398 bugs is known to be actively exploited, so thorough validation remains essential. Best practice: back up critical data before applying the massive update bundle, and consider delaying the rollout by a day or two to allow Microsoft to address any errant patches that surface post‑release. For a detailed per‑vulnerability breakdown, consult the SANS Internet Storm Center’s latest report. Reuters and Bloomberg have covered the broader industry trend. Correction: An earlier version misstated the number of critical bugs as 42 instead of 42.