Full Report
Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities. [...]
Analysis Summary
# Vulnerability: Microsoft August 2026 Patch Tuesday Zero-Day Bundle
## CVE Details
- **CVE ID:** CVE-2026-68820 (Actively Exploited), CVE-2026-62832 (Publicly Disclosed), CVE-2026-72971 (Publicly Disclosed)
- **CVSS Score:** Scores vary; Critical/Important
- **CWE:**
- CVE-2026-68820: CWE-416 (Use After Free)
- CVE-2026-62832: CWE-59 (Improper Link Resolution / Link Following)
## Affected Systems
- **Products:** Microsoft Windows, Windows Server, Windows Ancillary Function Driver (AFD.sys), Windows User Profile Service, Windows Container Isolation FS Filter Driver (unionfs.sys).
- **Versions:** Applicable to modern supported versions of Windows 10, Windows 11, and Windows Server (2019/2022/2025).
- **Configurations:**
- **CVE-2026-62832:** Requires the attacker to have credentials for a local account to target another user's registry hive.
- **CVE-2026-72971:** Affects systems utilizing Windows Containers.
## Vulnerability Description
This summary covers the primary zero-day threats within a massive 400-flaw update:
- **CVE-2026-68820:** A Use-After-Free flaw in the `AFD.sys` driver. A race condition allows a locally authenticated attacker to gain **SYSTEM** privileges by running a crafted application.
- **CVE-2026-62832 (LegacyHive):** An improper link resolution flaw in the User Profile Service. It allows a non-admin user to load and modify another user's registry hive, potentially executing commands with administrative privileges when the victim logs in.
- **CVE-2026-72971:** A tampering vulnerability in the `unionfs.sys` driver related to container isolation.
## Exploitation
- **Status:**
- **CVE-2026-68820:** Exploited in the wild (attributed to North Korean threat actor **Lazarus**).
- **CVE-2026-62832 / CVE-2026-72971:** Publicly disclosed; PoC concepts exist (e.g., "LegacyHive").
- **Complexity:** Low to Medium
- **Attack Vector:** Local (Requires authenticated access to the target system).
## Impact
- **Confidentiality:** High (Full access to system data/registry hives)
- **Integrity:** High (Ability to modify system files and kernel-mode rootkit deployment)
- **Availability:** High (Potential for system-wide compromise)
## Remediation
### Patches
- Apply the August 2026 Cumulative Updates via Windows Update or Microsoft Update Catalog for all affected Windows OS versions.
### Workarounds
- No specific official workarounds are provided; however, implementing the principle of least privilege (PoLP) and restricting local login access can reduce the attack surface for these local elevation of privilege (EoP) flaws.
## Detection
- **Indicators of Compromise:** Look for the presence of the **FudModule** kernel-mode rootkit. Monitor for unauthorized loading of registry hives from other user profiles.
- **Detection methods and tools:** Use EDR/SIEM tools to monitor for suspicious processes spawned by the Windows Ancillary Function Driver or unusual activity in the User Profile Service.
## References
- Microsoft Update Guide: [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-68820]
- Check Point Research (Lazarus Group): [https://research.checkpoint.com/2026/shattering-the-dream-when-a-job-offer-becomes-a-zero-day-attack/]
- BleepingComputer Article: [https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/]