Microsoft Patches Nearly 400 Security Flaws

Microsoft has shipped a fresh wave of security fixes covering at least 398 vulnerabilities across Windows and its supported software lineup, with one bug already under active attack and two others publicly disclosed ahead of release.

The August patch bundle lands well below last month’s record-shattering 570-plus update release, but it still doubles June’s then-unprecedented batch of nearly 200 fixes. Microsoft points to AI-assisted vulnerability discovery as a key driver behind the recent surge in patch volume, and security experts broadly agree that Windows users should anticipate monthly Patch Tuesday releases (the second Tuesday of each month) routinely addressing hundreds of new flaws.

Of the 398 vulnerabilities patched today, 42 earned Microsoft’s most severe “critical” rating. That classification means the flaws are serious enough that attackers could seize remote control of a Windows machine with minimal user interaction.

The single confirmed zero-day addressed this month is CVE-2026-68820, a privilege escalation weakness in afd.sys, a core Windows component. Automox describes this driver as “the driver behind Windows socket connections on effectively every endpoint.”

“This isn’t a front-door bug,” said Landon Miles of Automox in a Patch Tuesday analysis. “It’s step two in a chain: an attacker phishes their way into a low-privilege foothold, then uses the driver flaw to take the box. The 7.0 score reflects the high attack complexity, because race conditions are fiddly. The exploit has to be thrown over and over until the timing lands. Someone is clearly landing it anyway.”

Another privilege escalation flaw, CVE-2026-62832, sits in the Windows User Profile Service and carries Microsoft’s “likely to be exploited” label. It may connect to the recent “LegacyHive” public disclosure from the prolific researcher known as Nightmare Eclipse. The second publicly disclosed issue, CVE-2026-72971, is a low-impact local tampering vulnerability that Microsoft judges unlikely to be weaponized.

Other major vendors are similarly scaling up their patch output thanks to AI. Adobe shifted to twice-monthly security bulletins last month, publishing on the second and fourth Tuesdays. Cisco, Google, Mozilla, and Oracle are also shipping updates at a noticeably faster clip.

AI has proven highly effective at spotting security holes in software. But whether it can fix them as reliably remains an open question, particularly since the same AI systems are increasingly suggesting the patches themselves.

Researchers at 1Password tested how various large language models (LLMs) handle patch generation for newly disclosed, complex vulnerabilities. Their findings showed that LLM-produced patches either failed to resolve the flaw, introduced a new weakness, or both, in more than half of the cases.

Ed Skoudis, president of the SANS Technology Institute, reports that his team has seen strong results using AI to generate patches, but only with humans in the loop to test fixes and push for iterative improvements.

“AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem,” Skoudis wrote in a SANS newsletter. “Don’t expect one-shot AI patching to work reliably. Instead, iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard.”

Fortra’s Tyler Reguly notes that while reports of Microsoft patching hundreds of vulnerabilities in a single release have pushed some organizations to accelerate their patching timelines, only one of the nearly 400 bugs fixed today is confirmed actively exploited. He encourages security leaders to check in with their teams about managing the heavier workloads, which typically involve testing fixes before production deployment.

“If you’re a chief security officer talk to your teams about how they are shifting or modifying their workflows to better accommodate the patching shift that we’re seeing and support them across various organizational units by enabling the changes they want to see made,” Reguly said. “There’s no need to rush these updates, no matter what various vendors and organizations try to tell you. You need to make sure that you are rolling out safe updates that will not negatively impact your systems.”

On a practical note, back up your system and data before applying this month’s hefty update bundle. The day after Patch Tuesday is sometimes jokingly called Reboot Wednesday, but waiting a few days before deploying these large releases can be wise, as Microsoft occasionally needs time to smooth out a misbehaving patch.

For a detailed, clickable breakdown of each patch by severity and urgency, the SANS Internet Storm Center has published a full roundup.