Microsoft patches 398 critical Windows vulnerabilities, fixing one actively exploited flaw

Microsoft released security updates on August 11, 2026, addressing 398 vulnerabilities across Windows systems and supported software, including one confirmed active exploit.

Microsoft shipped security updates on August 11, 2026, resolving at least 398 vulnerabilities in Windows operating systems and compatible software. Among these, one vulnerability (CVE-2026-68820) was confirmed as actively exploited by threat actors, while another (CVE-2026-62832) was flagged as potentially exploitable but not yet confirmed active. The patch bundle included 42 critical vulnerabilities requiring minimal user intervention for exploitation. Microsoft attributed the significant volume increase to AI-assisted vulnerability discovery, with August’s patch count doubling June’s (nearly 200) and exceeding its previous monthly release of 570 vulnerabilities. This represents Microsoft’s second Patch Tuesday cycle in August 2026.

The security update cycle addresses immediate risks to digital infrastructure, particularly for organizations using Windows systems. By fixing critical flaws like the privilege escalation vulnerability in the Windows afd.sys driver (CVE-2026-68820) and the User Profile Service (CVE-2026-62832), Microsoft directly reduces the window for real-time data breaches and financial loss. The focus on high-severity vulnerabilities aligns with the growing trend of AI-driven security updates across major tech platforms.

This patch effort moves security abundance by lowering the risk of exploitation for billions of users. Critical vulnerabilities patched today prevent immediate financial harm and data theft, while the accelerated update cadence signals improved resilience against emerging threats. The active exploitation of only one vulnerability (CVE-2026-68820) underscores the effectiveness of timely fixes in mitigating real-world harm.

What to watch: Whether the remaining vulnerabilities (including CVE-2026-62832) face exploitation before next patch cycle. Patch volumes are reported as 'at least' 398, and the relationship between CVE-2026-62832 and Nightmare Eclipse’s disclosure remains unconfirmed.

Source: Krebs on Security