Zero-Day in Windows Winsock Kernel Driver Exploited in Attacks

August's Patch Tuesday brings one of the largest security update loads in recent memory, with Microsoft addressing 421 CVEs across its product line. Buried in that stack is a zero-day already being used in the wild, a privilege escalation flaw in the Windows kernel that draws on a driver long favored by sophisticated attackers.

Exploited Zero-Day in AFD.sys

The actively exploited vulnerability is tracked as CVE-2026-68820, a use-after-free issue in the Ancillary Function Driver for WinSock (afd.sys). This kernel-mode driver serves as the backbone for the Windows Sockets API, making it a high-value target for attackers seeking to gain elevated privileges.

Microsoft says threat actors have been exploiting the security defect to elevate their privileges to System, but has not shared details on the observed attacks. The tech giant describes the flaw as allowing a locally authenticated attacker to run a specially crafted application to trigger a race condition, potentially granting SYSTEM privileges without user interaction.

According to Tenable senior staff research engineer Satnam Narang, based on historical tradecraft targeting afd.sys flaws, the CVE might have been exploited by nation-state threat actors. Narang noted in a statement that “Since 2022, there have been three other afd.sys zero-days exploited in the wild, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. CVE-2024-38193 was reportedly exploited by North Korean hackers linked to the Lazarus group.”

Publicly Disclosed Flaws Flagged

Beyond the exploited zero-day, Microsoft also highlighted CVE-2026-62832, an improper link resolution before file access (link following) bug in Windows's User Profile Service. This vulnerability could allow attackers to elevate their privileges locally. Microsoft explains that an authenticated attacker with credentials for another local account could run a specially crafted application to load another user's registry hive, potentially accessing or modifying another user's data and gaining administrator privileges without user interaction.

The tech giant flagged this security defect as publicly disclosed and believes that threat actors are likely to start exploiting it in attacks. Another publicly disclosed flaw, CVE-2026-72971, affects the Windows Container Isolation FS Filter Driver (unionfs.sys) and could lead to local tampering, but Microsoft believes it is unlikely to be exploited in the wild.

Notable RCEs and Other Priority Bugs

Defenders should also pay attention to several remote code execution (RCE) vulnerabilities, including CVE-2026-62878 in Windows DNS server, CVE-2026-62893 in Windows Deployment Services TFTP server, CVE-2026-62815 in Microsoft QUIC, and CVE-2026-59124 in Microsoft HPC Pack. ZDI's Dustin Childs notes these as ones to watch, along with CVE-2026-62911, an elevation of privilege issue in Exchange Server.

Scale of the August Update

The sheer volume of fixes is notable. In total, Microsoft's August 2026 security updates resolve 236 vulnerabilities in Windows, 98 in Office, 98 in Office 2016, 30 in SharePoint Server, 26 in Developer Tools, 17 in Azure, 7 in Exchange Server, 1 in Defender, and 6 in other products. The updates also include fixes for two non-Microsoft CVEs, namely a spoofing bug (CVE-2026-6726) and an information disclosure issue (CVE-2026-6727) in the TPM 2.0 reference implementation.

Trend of High-Volume Patches

This release continues a pattern of large Patch Tuesday updates, though the frequency of these massive drops has been increasing. Last year's August update was also substantial, and this one tops it with 421 CVEs. For IT teams, this means more time spent triaging and prioritizing which patches to apply first, especially those with active exploitation or public disclosure.

Why It Matters

The active exploitation of a kernel driver zero-day, combined with two publicly disclosed vulnerabilities, raises the stakes for IT administrators to patch quickly. The fact that the AFD.sys flaw has been targeted in the wild suggests that attackers are actively scanning for vulnerable systems, and the public disclosure of the User Profile Service flaw could lead to exploit development in the near term. Organizations that haven't yet applied the August updates should treat them as a high priority, particularly for internet-facing systems and those with trust boundaries between local accounts.