Microsoft Patches 398 Flaws, Including Exploited Windows Driver Hole

Microsoft issued 398 security patches in its August 2026 Patch Tuesday release, headlined by a zero-day vulnerability in a Windows driver that attackers are already exploiting, according to a report published today by CSO Online. Separately, SAP released 29 new and updated security fixes, the most serious of which earned a perfect CVSS score of 10. The combined patch load underscores what security researchers are calling the "new normal" of massive monthly vulnerability releases.

The actively exploited zero-day affects Windows' Ancillary Function Driver for WinSock (CVE-2026-68820), a component that has been repeatedly targeted for local privilege-escalation attacks throughout 2026, the report notes. Of Microsoft's 398 total CVEs, 42 were classified as critical while 355 were rated Important, with 236 affecting Windows through a cumulative update and another 98 covering Office products. Microsoft also disclosed two additional zero-days: CVE-2026-62832, an elevation of privilege flaw in Windows User Profile Service that has been publicly disclosed and is linked to the "LegacyHive" proof-of-concept released after July's Patch Tuesday, and CVE-2026-72971, a tampering vulnerability in the Windows Container Isolation FS Filter Driver. SAP's most severe patch addresses CVE-2026-58231, an improper authorization issue in Commerce Cloud's Data Hub Adapter, alongside two critical code injection flaws in Manufacturing Integration and Intelligence (CVE-2026-44772 with CVSS 9.9 and CVE-2026-44758 with CVSS 9.1) and a memory corruption defect in Application Server ABAP (CVE-2026-34265 with CVSS 9.8).

"Exploitation has already been detected," Jack Bicer, director of vulnerability research at Action1, said of the WinSock driver flaw, calling it "the highest priority vulnerability in this month's release." The report highlights that a significant portion of August's risk stems from critical vulnerabilities exploitable remotely without authentication or user interaction, including Windows DNS Server Remote Code Execution Vulnerability (CVE-2026-62878), Microsoft QUIC Remote Code Execution Vulnerability, Windows iSCSI Target Service Remote Code Execution Vulnerability (CVE-2026-65791), and Windows Deployment Services TFTP Server Remote Code Execution Vulnerability, each carrying a CVSS score of 9.8. SharePoint represents another concentration of risk, with CVE-2026-65665 allowing an authenticated attacker with Site Owner privileges to execute arbitrary code remotely, while CVE-2026-62827 and CVE-2026-64921 can permit authenticated attackers with domain access to elevate themselves to SharePoint administrator.

The exploited WinSock driver vulnerability could be leveraged by nation-state actors in the same way 2024's CVE-2024-38193 was reportedly attacked by North Korean hackers linked to the Lazarus group, according to Satnam Narang, senior staff research engineer at Tenable. Past vulnerabilities in this component have allowed an authorized attacker to win a race condition and gain SYSTEM privileges, the report explains. For SAP's critical Commerce Cloud flaw, an unauthenticated remote attacker with network access can submit crafted data to the Data Hub import endpoint, potentially leading to arbitrary code execution and exposing customer and order data, manipulating application behavior, or compromising credentials. The memory corruption issue in SAP's Application Server ABAB stems from logical errors in DIAG protocol parsing that allow unauthenticated attackers to generate memory corruptions, potentially disclosing sensitive system information or crashing the system.

Security teams should prioritize reducing the window of exposure around CVE-2026-68820 because exploitation is already occurring, followed closely by CVE-2026-62832 due to public disclosure and assessed likelihood of exploitation, the report recommends. IT leadership should require accelerated remediation and explicit validation for DNS, DHCP, SharePoint, Exchange, Active Directory Certificate Services, Routing and Remote Access Services, Secure Socket Tunneling Protocol, and other critical services. Because no documented workaround exists for the highlighted vulnerabilities, patch deployment remains the primary risk reduction measure, with systems unable to meet patching timelines requiring documented risk acceptance, exposure reduction, segmentation, enhanced monitoring, and compensating controls until remediation is complete. The practical move is to triage by exploitation status and internet exposure first, then work outward, since a CVE already being exploited against internet-facing systems demands a very different response than a theoretical local privilege escalation on an isolated workstation. Organizations running Windows containers, build agents, or CI infrastructure on affected hosts should give the container isolation vulnerability immediate attention since exploit code could follow public disclosure quickly. The monthly patch burden now represents standard operating procedure for security teams, though volume alone shouldn't be mistaken for risk when prioritization can focus effort where active threats demand it.