Microsoft Patches 398 Vulnerabilities Including Active afd.sys Zero-Day CVE-2026-68820

The August bundle addressed 42 critical-rated vulnerabilities. The exploited zero-day CVE-2026-68820 resides in the afd.sys driver handling Windows socket connections. Automox analysis shows it serves as a post-compromise escalation step after phishing, requiring repeated race-condition attempts until timing succeeds. Microsoft also fixed CVE-2026-62832 in the User Profile Service, potentially tied to the LegacyHive disclosure, and a low-impact local tampering flaw CVE-2026-72971.

Procurement and incident records indicate AI tooling now accelerates vulnerability discovery across Microsoft, Adobe, Cisco, Google, Mozilla and Oracle. Patch volumes have doubled or tripled month-over-month. Official statements credit AI for the surge yet provide no data on automated remediation success rates. Contract awards for security tooling continue to emphasize human review cycles despite marketing claims of end-to-end automation.

1Password testing of LLMs on complex vulnerabilities found over half the generated patches either failed to close the flaw or introduced new weaknesses. SANS Institute reporting confirms AI produces usable suggestions only when paired with iterative human testing and verification. This pattern aligns with prior defense contractor disclosures showing discovery tools outpace remediation pipelines in production environments.

Next month’s release is expected to exceed 400 patches again. Organizations without automated deployment pipelines for afd.sys and profile-service components face elevated post-phish escalation risk until verification metrics improve.