Microsoft Ships August Update With an Exploited Zero-Day, Then Faces a Fix-Bypass Claim
Microsoft kicked off its August Patch Tuesday with patches for hundreds of flaws, one of them a Windows kernel bug already under attack in the wild. Within hours, a security researcher posted a proof-of-concept that claims to slip past another recent fix in a different part of the stack. The two events together are a reminder of how fast the window between a shipped patch and a public exploit can close.
A kernel driver zero-day gets exploited before the fix lands
The most urgent item is tracked as CVE-2026-68820, a use-after-free bug in the Ancillary Function Driver for WinSock, the kernel-mode driver better known by its filename, afd.sys, that forms the backbone of the Windows Sockets API. Redmond assigned the issue a CVSS score of 7.0 and an Important rating, and it confirmed threat actors had already used it as a zero-day.
Microsoft describes the flaw as a race condition that a locally authenticated attacker can trigger by running a specially crafted application on an affected system. No user interaction is required. A successful hit raises the attacker's privileges all the way to SYSTEM, the highest access level on a Windows machine, which means a foothold on a low-privilege account can quickly turn into full control of the endpoint. The company has not shared details of the observed attacks, so the exact campaigns remain unclear.
Tenable senior staff research engineer Satnam Narang pointed out that afd.sys has become a recurring target for this kind of work. Windows has shipped three other afd.sys zero-days exploited in the wild since 2022, including CVE-2025-32709, CVE-2025-21418, and CVE-2024-38193. That last one was tied to North Korean hackers linked to the Lazarus group. Narang's read is that, based on that tradecraft, the latest afd.sys flaw may well trace back to a nation-state actor too. None of those are small-scale concerns: an elevation-of-privilege bug in a networking driver is precisely the kind of primitive that gives hands-on-keyboard attackers a straight line from a compromised service account to total control of a corporate laptop.
Beyond the exploited bug: a stack of other disclosures
The August release patched 421 vulnerabilities in all, according to a SecurityWeek breakdown, with CrowdStrike's own tally coming in at 415 after it factored in later additions. Either way, the bulk is heavy: Microsoft said the month clears up 236 issues in Windows, 98 in Office, 30 in SharePoint Server, 26 in developer tools, 17 in Azure, 7 in Exchange Server, one in Defender, and six in other products, plus a pair of non-Microsoft CVEs in the TPM 2.0 reference implementation.
CrowdStrike broke the month's vulnerabilities down by exploitation technique: 174 elevation-of-privilege flaws (about 42 percent), 109 remote code execution bugs (26 percent), and 85 information-disclosure issues (20 percent). Elevation of privilege leading the list matches the reality that getting a local bug to first-ring SYSTEM access is the bread-and-butter of modern Windows attack chains.
Beyond the exploited zero-day, a few other items deserve attention. CVE-2026-62832 is a link-following bug in the Windows User Profile Service, rated 7.8, that Microsoft flagged as publicly disclosed. An authenticated attacker with credentials for another local account can load that user's registry hive and, from there, read or change their data and reach administrator privileges. CrowdStrike assesses that this is likely the fix for an exploit called LegacyHive that the Nightmare-Eclipse persona released in July 2026. CVE-2026-72971, a link-following issue in the Windows Container Isolation FS Filter Driver, was also disclosed publicly, though Microsoft believes it is unlikely to be exploited in the wild.
For remote code execution, defenders should look at CVE-2026-62878 in the Windows DNS server, CVE-2026-62893 in the Windows Deployment Services TFTP server, CVE-2026-62815 in Microsoft QUIC, and CVE-2026-59124 in HPC Pack, along with CVE-2026-62911, an elevation-of-privilege bug in Exchange Server flagged by the Zero Day Initiative's Dustin Childs. The Windows DNS server flaw is worth singling out: DNS is exposed on many networks and is routinely the fastest way for a remote attacker to gain a beachhead, which is why RCEs in that component draw outsized attention from security teams.
The release also carried two non-Microsoft CVEs tucked into the TPM 2.0 reference implementation, which vendors bake into hundreds of firmware images. The first, CVE-2026-6726, is a spoofing bug; the second, CVE-2026-6727, leaks information. Neither was described as exploited, but they matter because updates to TPM firmware take longer to roll out than a typical monthly Windows update, so knowing about them early gives supply-chain teams a head start. The one Defender patch in the bundle, meanwhile, is a reminder that even the security stack itself is not exempt from the monthly cycle.
A researcher claims to walk past a Defender fix hours later
Less than three hours after Microsoft posted the disclosures, a researcher operating under the handle MSNightmare released a tool it calls ShieldBreak. The proof-of-concept targets CVE-2026-50656, a local privilege escalation bug in the Microsoft Defender Malware Protection Engine that the security community knows as RoguePlanet. RoguePlanet itself ran into reliability trouble and was limited to desktop editions of Windows. ShieldBreak, by the researcher's account, clears that bar: a standard user can escalate to SYSTEM on fully patched Windows 11 25H2 and Windows Server 2025, with a claimed 100 percent success rate in testing.
The mechanism, according to MSNightmare, abuses Defender's Cloud Files API through object manager symlinks and byte-range locks, a route different enough from the original RoguePlanet to dodge signature-based detection. CrowdStrike's preliminary analysis sizes up the threat as low. The exploit was functional on Patch Tuesday itself, but Microsoft quickly pushed Defender signature updates that appear to block this specific implementation. Because Defender has to be running for the attack to work, those rules largely neutralize the current public version. What stays unknown is whether the signature catches modified or obfuscated variants, and the researcher has not released the source under an open license that would let defenders audit exactly how the bypass threads the Cloud Files API.
ShieldBreak is the tenth release in the Nightmare-Eclipse series, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive. Some of that lineup's earlier vulnerabilities have been confirmed exploited in the wild, which gives the persona's output more weight than the average exploit-hobbyist posting. No CVE has yet been assigned to ShieldBreak and no permanent patch exists; Microsoft's response so far has been the signature-level block.
What this means for a busy patching calendar
For teams running Windows, the practical takeaway is straightforward. The afd.sys zero-day is the one to fix first, since it is confirmed under attack and needs no interaction to land SYSTEM. Patching to the August build closes that hole. The User Profile Service and container-driver issues sit a step behind but deserve the same urgency because they are already public, and public disclosure tends to accelerate weaponization. The Defender situation is a reminder that a patch alone is not always the end of a story: if an exploit surfaces that claims to bypass the fix, the fallback is up-to-date signatures and close monitoring until Redmond ships a permanent repair.
On the larger calendar, the ZDI's monthly update review adds a second opinion on which bugs deserve attention first, and Microsoft's own MSRC update guide lists every affected product and severity. Organizations that treat patch Tuesday as a box-ticking exercise rather than a triage decision are the ones most likely to get burned by the next exploited zero-day. For a broader look at what this site covers on cyber risk, the article archive keeps up with CVE and incident reporting as the disclosures land.