Microsoft releases a record 398 vulnerabilities in its August update, highlighting growing patch sizes driven by AI detection tools and escalating operational and compliance challenges for organisations amid active exploitation risks.
Microsoft has shipped fixes for 398 vulnerabilities in Windows in its August 2026 Patch Tuesday, a volume that underlines how large monthly patch sets have become for enterprise administrators. Among them is CVE-2026-68820, an actively exploited flaw in afd.sys, the Windows driver that handles network connections. According to the report, the weakness does not let an attacker break in on its own. It is a privilege-escalation bug, which means it becomes dangerous only after an attacker already has a foothold, often through phishing or another initial compromise. Once inside, however, it can help turn a standard user account into one with system-level control.
Automox, which analysed the fix, said the bug is better understood as a second step in an attack chain than as a doorway into a machine. Its CVSS score of 7.0 reflects the difficulty of exploitation: it is a race condition, a timing flaw in which two operations collide at just the right moment. That makes successful abuse less straightforward than many Windows vulnerabilities, but not theoretical. The fact that exploitation has already been observed shows that determined attackers can and do make it work.
Microsoft also disclosed two other flaws that were already known before the patch release. CVE-2026-62832, affecting the Windows user profile service, is considered likely to be exploited soon and may be linked to the “LegacyHive” disclosure in July. A third issue, CVE-2026-72971, allows limited local data alteration and is regarded as having a narrower impact. Taken together, the set shows the usual Patch Tuesday mix of active threats, likely follow-on issues and lower-severity defects that still require tracking.
The scale of the August release fits a broader trend. June and July 2026 also brought unusually large patch batches, which Microsoft has linked to AI-assisted detection tools that are surfacing more flaws than older processes did. The shift is not limited to Redmond. Adobe now issues security bulletins twice a month, while Cisco, Google, Mozilla and Oracle have all increased their pace. That creates a heavier operational burden for security teams, which must test, prioritise and document fixes more quickly than before.
That pressure is likely to intensify in Europe. NIS2 already requires essential and important entities to maintain documented vulnerability handling, while the Cyber Resilience Act will require manufacturers to notify ENISA about actively exploited flaws. In practice, that means a large Patch Tuesday is no longer just a technical event. It is also a compliance exercise, with organisations expected to show they can absorb hundreds of fixes, identify the highest-risk items and prove that remediation was handled properly.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
