August 2026 Patch Tuesday: North Korea’s Lazarus Group Weaponized a Windows Zero-Day Before Microsoft Could Patch It

Microsoft’s August 2026 Patch Tuesday, released on August 11, closes out a summer that has kept enterprise patch teams on a record-setting cadence. This cycle’s headline is not volume - it is attribution: Check Point researchers tied the month’s actively exploited zero-day directly to Lazarus, the North Korean state-sponsored threat actor, which used the flaw to deploy an updated build of its FudModule kernel-mode rootkit during a fake job-offer social-engineering campaign. It is a reminder that Patch Tuesday triage isn’t only about CVSS scores - it is about who is already using the bug, and how.

Microsoft addressed 421 CVEs this month (industry trackers report a range of 394–421 depending on methodology). Of those 421, 62 vulnerabilities are rated “Critical,” 357 “Important,” and 2 “Moderate.” Three of this month’s flaws are zero-days: one actively exploited in the wild and two publicly disclosed before a patch was available.

August 2026 Patch Tuesday at a Glance

Vulnerabilities Analysis in the August 2026 Patch Tuesday Release 

This month’s release fixes three zero-day vulnerabilities, all three in core Windows components rather than server applications - a different profile from July, when both exploited zero-days sat in Active Directory Federation Services and SharePoint Server. One flaw was already being weaponized in targeted attacks before Microsoft shipped a fix; the other two were publicly disclosed, which raises the risk of rapid proof-of-concept development even though Microsoft has not confirmed exploitation for either.

One of the publicly disclosed flaws, CVE-2026-62832 in the Windows User Profile Service, is being connected by researchers to “LegacyHive,” a privilege-escalation proof-of-concept that the researcher known as Nightmare Eclipse published last month. Tharro's principal vulnerability analyst Will Dormann had already warned that LegacyHive let a non-admin user modify a loaded registry hive to run commands with administrator rights the next time an admin account signed in - this month’s fix is widely believed to close that gap.

Windows Ancillary Function Driver for WinSock – Elevation of Privilege:

CVE-2026-68820 is an Elevation of Privilege vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel-mode driver that underpins the Windows Sockets API on every supported version of Windows. It was assigned a CVSS score of 7.0 and rated Important. Microsoft describes the flaw as a use-after-free that lets a locally authenticated attacker run a specially crafted application to trigger a race condition and gain SYSTEM privileges - no user interaction required. Microsoft confirmed active exploitation and credited the discovery to Moshe Marelus and David Driker of Check Point. In a report published the same day, Check Point attributed the in-the-wild exploitation to Lazarus, the North Korean state-sponsored threat actor, which used the bug during a fake job-offer campaign to deploy an updated build of its FudModule kernel-mode rootkit. Two related EoP flaws in the same driver, CVE-2026-61348 and CVE-2026-70307, were patched in the same cycle with identical CVSS scores but no confirmed exploitation.

HCL BigFix remediates CVE-2026-68820 through the standard cumulative security update fixlets published for every actively supported Windows Client and Server version in the Patches for Windows site, since afd.sys ships as part of the core Windows operating system rather than a separately serviced component.

Windows User Profile Service – Elevation of Privilege

CVE-2026-62832 is an Elevation of Privilege vulnerability in the Windows User Profile Service, assigned a CVSS score of 7.8 and rated Important. Microsoft describes the root cause as improper link resolution before file access (“link following”): an attacker who already holds credentials for another local account on the same machine can run a crafted application that loads a different user’s registry hive, then modify it to gain administrator privileges the next time that account signs in. Microsoft rates it “Exploitation More Likely” on its Exploitability Index and credited an anonymous researcher, though the technique matches LegacyHive, disclosed last month by researcher Nightmare Eclipse.

HCL BigFix remediates this vulnerability through the same cumulative Windows security update fixlets in the Patches for Windows site, applicable to every actively supported Windows Client and the affected Server versions..

Windows Container Isolation FS Filter Driver (unionfs.sys) – Tampering

CVE-2026-72971 is a tampering vulnerability affecting the Windows Container Isolation FS Filter Driver (unionfs.sys), assigned a CVSS score of 5.5 and rated Important. It was publicly disclosed before a patch was available and credited to researchers identified only as “yhw” and “txz”; Microsoft assesses it as Exploitation Unlikely. The driver underpins Windows Container Isolation, so practical exposure is concentrated on Windows Server hosts running the Containers feature - a much narrower population than the other two zero-days.

Organizations should prioritize deployment specifically to Windows Server hosts with the Containers feature enabled rather than treating it as an urgent, fleet-wide push.

Microsoft SharePoint Server – Remote Code Execution

CVE-2026-63520 is a Remote Code Execution vulnerability in Microsoft SharePoint’s Business Connectivity Services, assigned a CVSS score of 8.1 High. Successful exploitation lets an attacker run arbitrary code with the privileges of the SharePoint site’s service account. Rapid7 Labs disclosed the flaw to Microsoft on May 18, 2026, as the second half of an exploit chain that, combined with CVE-2026-55040 - a SharePoint JWT authentication-bypass flaw patched last month - enables fully unauthenticated remote code execution against a vulnerable server. Unlike this month’s two MSRC-designated zero-days, CVE-2026-63520 was reported and patched under a coordinated disclosure timeline: it was not exploited in the wild and not publicly disclosed ahead of the fix. 

HCL BigFix delivers the SharePoint Server, Project Server, and Office Web Apps Server security updates for CVE-2026-63520 through the dedicated Microsoft Office/SharePoint patch content published alongside the core Windows fixlets this cycle. Organizations should prioritize the SharePoint Subscription Edition and 2019 fixlets given their prevalence, and confirm last month’s CVE-2026-55040 authentication-bypass fix is also applied - the two vulnerabilities form a single exploit chain when either is left unpatched.

HCL BigFix’s Patch team published 348 fixlets for every actively supported Windows Client and Server version as soon as Microsoft releases them, covering the zero-days addressed this cycle alongside the rest of August’s Windows, .NET, Office, and SharePoint Server updates. 

Additional remediation content for third-party Windows software is available through the HCL BigFix “Updates for Windows Applications” External Site. The full list of fixlets for this month's security updates is available in the BigFix Forum 

Compliance Risks from August 2026 Patch Tuesday Vulnerabilities 

This month’s compliance exposure centers on the actively exploited flaw. CVE-2026-68820 was already being used by a nation-state actor before Microsoft shipped a fix, which removes any argument that the risk was theoretical - auditors and regulators generally hold organizations to materially tighter remediation windows for confirmed in-the-wild exploitation than for disclosed-but-unexploited issues.

Because CVE-2026-68820 and CVE-2026-62832 both grant local privilege escalation to SYSTEM or administrator level, they are directly relevant to access-control requirements under frameworks such as NIST 800-53, SOC 2, and ISO 27001: an attacker who lands on an endpoint with even limited access can use either flaw to bypass the least-privilege boundary those frameworks require. CVE-2026-63520 carries its own compliance weight despite not being a zero-day: SharePoint routinely stores regulated content such as PII, financial records, and healthcare data, so an RCE chain capable of unauthenticated exploitation directly threatens data-handling controls under HIPAA, PCI DSS, and similar regimes. Organizations that already applied last month’s CVE-2026-55040 authentication-bypass fix but have not yet deployed this month’s CVE-2026-63520 update remain exposed to the full chain.

Conclusion

August 2026 Patch Tuesday is a reminder that headline CVE counts don’t tell the whole story. Of the roughly 421 vulnerabilities Microsoft fixed this cycle, only one was being actively exploited - but that one was already in the hands of a nation-state threat actor, sitting in a core Windows driver present on every supported endpoint and server. This cycle also closes a publicly disclosed Windows privilege-escalation flaw that traces directly back to last month’s LegacyHive proof-of-concept, and a severe SharePoint remote-code-execution chain that Rapid7 disclosed to Microsoft under coordinated timelines rather than in public - proof that not every must-patch flaw this month arrived with attacker fingerprints already on it. Organizations that can push the AFD.sys, User Profile Service, and SharePoint fixes fleet-wide within days, rather than weeks, are best positioned to close these gaps before any of them is weaponized further. HCL BigFix is built for exactly that turnaround.