Expert CVE Analysis: Patch Tuesday August 2026

The industry flew home from Hacker Summer Camp to find 398 CVEs waiting. This month's Patch Tuesday delivers an actively exploited race condition in a networking driver that ships on every Windows endpoint, a publicly disclosed route from one local account to administrator, and 19 critical cloud CVEs Microsoft has already fixed on its side.

For the full breakdown, listen to Patch [FIX] Tuesday podcast.

Windows Ancillary Function Driver for WinSock elevation of privilege vulnerability

CVE-2026-68820 (CVSS 7.0/10) is the only bug in this release Microsoft confirms is being exploited in the wild, and that outranks every bigger number on the advisory sheet. Until the patch dropped, it was a zero-day. The flaw is a use-after-free in the Ancillary Function Driver (AFD) for WinSock, the kernel driver behind Windows socket connections on effectively every endpoint. A locally authenticated attacker runs a specially crafted application, wins a race condition, and walks away with SYSTEM privileges. No user interaction required.

This isn't a front-door bug. It's step two in a chain: an attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box. The 7.0 score reflects the high attack complexity, because race conditions are fiddly. The exploit has to be thrown over and over until the timing lands. Someone is clearly landing it anyway.

The driver also has history. A use-after-free in the same component was exploited in 2024 by the Lazarus Group, the operation tied to North Korea's Reconnaissance General Bureau, and components that produce exploited bugs tend to keep producing them. The entire supported Windows lineup, client and server, takes this patch. A restart is required, and there's no workaround.

How attackers may exploit this vulnerability

• An attacker with an existing foothold runs a specially crafted application that races the AFD driver's memory handling.

• Winning the race hands the attacker SYSTEM privileges, turning a phished user account into full control of the endpoint.

• Expect repeated attempts. Race conditions rarely land on the first try, so the exploit runs in a loop until one does.

What to look out for

• Crashes or instability tied to afd.sys. Failed race attempts are noisy, and the noise often precedes the successful exploit.

• Low-privilege accounts spawning SYSTEM-level processes outside expected elevation paths.

• Endpoint detection alerts on unfamiliar applications hammering socket operations in tight loops.

Mitigation guidance

• Patch now and enforce the restart. The fix isn't active until the endpoint reboots, and there's no workaround to bridge the gap.

• Treat this as the month's deadline item. It's the one confirmed-exploited bug in the release, and it applies to every Windows endpoint you manage.

• Put the noise to work. This exploitation pattern is detectable, but only if your detection actually covers kernel-driver race abuse. Most coverage doesn't, so verify rather than assume.

Windows User Profile Service elevation of privilege vulnerability

CVE-2026-62832 (CVSS 7.8/10) was publicly disclosed before the patch shipped, and Microsoft rates exploitation as more likely. The flaw is improper link resolution, or link following, in the Windows User Profile Service. An authenticated attacker who holds credentials for another local account can run a specially crafted application to load that user's registry hive. Successful exploitation ends in administrator privileges, with access to the other user's data along the way. Attack complexity is low, and no user interaction is required.

The living-off-the-land angle is what makes this one interesting. There's no malware to drop and no exploit infrastructure to stand up, just a legitimate Windows service doing something it shouldn't with attacker-supplied links. That's the kind of quiet escalation that slides past tooling tuned for payloads. The attack vector is local, so an attacker needs a foothold first, which puts shared endpoints at the top of the exposure list: terminal servers, lab machines, kiosks, and any workstation with a stack of local accounts.

Put this bug next to CVE-2026-68820 and you get the month's triage lesson. A 7.8 rated "exploitation more likely" and an exploited 7.0 both matter more than any of this release's 10.0s. CVSS measures impact. Exploitability measures probability. You need both to know what to patch first.

How attackers may exploit this vulnerability

• An attacker with credentials for one local account runs a crafted application that abuses link resolution to load another user's registry hive.

• From there, they can read or modify the other user's data and escalate to administrator on the endpoint.

• Public disclosure means the mechanics are already in the open, which shortens the runway to a working exploit.

What to look out for

• Registry hive loads for profiles that aren't logged on, particularly when initiated from a different user's session.

• Unexpected symbolic links or junctions appearing under user-profile paths.

• Standard accounts turning up in the local Administrators group outside normal provisioning.

Mitigation guidance

• Patch multi-user endpoints first. Shared workstations and terminal servers concentrate exactly the local-account access this bug needs.

• Audit local accounts while you're at it. Stale credentials for forgotten accounts are the entry ticket here.

• Sort your queue by exploitability, not score. Between the disclosure and Microsoft's "more likely" rating, this is a strong candidate for the next bug to show up in the wild.

Microsoft Teams elevation of privilege vulnerability

CVE-2026-65667 is a perfect 10.0, a missing-authorization flaw in Microsoft Teams, and there is nothing for you to patch. Microsoft fully mitigated it in its own cloud before publication. The CVE exists for transparency, not action, and it isn't alone.

Teams heads a group of cloud-service CVEs in this release, every one rated critical, every one already fixed on Microsoft's side.

There's history behind that oddity. CVEs were defined for vulnerabilities that require customer action, and the guidance to CVE Numbering Authorities was not to issue IDs for cloud flaws the vendor fixes itself. Microsoft spent years being criticized for keeping cloud vulnerabilities off the books, and eventually relented. The transparency is genuine progress.

The bookkeeping is the problem: severity-sorted triage lists now open with scores that carry no action, and at current volumes that's noise a patching team has to filter every single month.

Apple's entry this month is CVE-2026-65400, a flaw in how the Screen Sharing service handles Secure Remote Password authentication. The published description is blunt: an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. A failed length check leaves the service holding a stale success state, so an unauthenticated connection gets treated as authenticated. Calif.io has published a proof of concept, including a demo video, so this is past the theoretical stage.

Apple patched it on August 6 across all three supported lines: macOS Sonoma 14.8.9, Sequoia 15.7.9, and Tahoe 26.6.1. Anything older than Sonoma is out of support and should be upgraded, not hardened. And because the bug is pre-authentication, the usual hardening doesn't help anyway. Trimming the allowed-users list or rotating the VNC password changes nothing. Push the updates across your Mac fleet today, and where a machine can't take the update yet, disable Screen Sharing until it can.

Big number, familiar playbook. Nineteen critical CVEs need nothing from you this month. Two need everything. That's the sorting rule worth keeping past August: exploitability first, score second. The bug at the top of that list doesn't even finish its own job without you. CVE-2026-68820's fix sits inert until the endpoint reboots, so the patch is only half the fix.

Patch CVE-2026-68820 tonight, and enforce the reboot. Patch CVE-2026-62832 right behind it, multi-user endpoints first. Run the normal monthly rollup underneath those two.

Push the three macOS updates to your Mac fleet, and keep Linux kernel updates in the monthly cadence, not the annual one. The cloud criticals are already handled. Spend the time you saved on the two bugs that actually need it.