MICROSOFT PATCHES 421 BUGS INCLUDING EXPLOITED WINDOWS ZERO-DAY

Microsoft released fixes for 421 vulnerabilities in its August Patch Tuesday update, including a zero-day flaw that has already been exploited by attackers. The exploited vulnerability, tracked as CVE-2026-68820, is a use-after-free flaw in the Windows Ancillary Function Driver for WinSock. According to Microsoft, an attacker with low-level local access to a Windows 11 or Windows 10 PC could exploit the bug to gain system-level privileges without requiring user interaction. The patch management provider Action1 recommended prioritising deployment of this fix despite its classification as "Important" rather than "Critical" because exploitation has been detected in the wild.

The vulnerability was discovered and reported by Check Point researchers Moshe Marelus and David Driker. According to Check Point's threat intelligence director Sergey Shykevich, attackers attributed to North Korea's Lazarus Group began exploiting the flaw in early June. Shykevich stated that whilst one successful implementation of the vulnerability was confirmed, the researchers assumed it was used more widely during the campaign. The attack wave has targeted the defence sector in Europe and India, with threat actors impersonating companies including Lockheed Martin and privacy-technology firm Enveil. The attacks are part of Operation Dream Job, a campaign attributed to Lazarus that has run since at least 2020 and uses social engineering to target job seekers with fake employment offers before distributing malware.

Beyond the exploited zero-day, August's Patch Tuesday also addressed two additional zero-day vulnerabilities, including the Windows User Profile Service Elevation of Privilege Vulnerability. The 421 total fixes span Microsoft's product range including Office, Exchange, Azure and SharePoint. The updates also include feature modifications to File Explorer and Windows Hello. Microsoft credited AI-assisted vulnerability disclosures and fixes for the recent increase in patch activity compared to previous months.