That is an accounting difference, not evidence that anyone has found 21 unpatched flaws. The operational takeaway is more direct: this month includes one Windows privilege-escalation vulnerability exploited in the wild, two other zero-days that were publicly disclosed before fixes arrived, and a SharePoint flaw which becomes pre-authentication remote code execution when paired with July’s authentication-bypass patch.
For most Windows administrators, the immediate task is to deploy the relevant August cumulative update across managed clients and servers, beginning with devices exposed to untrusted software, used by privileged staff, or likely to be a foothold after phishing. For SharePoint administrators, the task is more exacting: confirm that both the July and August updates are installed, not merely the newer August package.
CVE-2026-68820 is a post-compromise SYSTEM escalation
The highest-priority Windows issue is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, better known as afd.sys. Microsoft describes it as a local elevation-of-privilege flaw: an authenticated attacker can run a crafted application, trigger a race condition, and obtain SYSTEM privileges without another user doing anything.
The practical distinction is important. This is not an internet-facing wormable Windows bug that an unauthenticated attacker can use to break into arbitrary PCs. It is the sort of flaw that turns a compromised ordinary-user session into full control of a device. That makes it especially valuable after a malicious attachment, stolen credentials, abused remote-access tool, or insider foothold has already delivered code execution.
Check Point Research says it observed DPRK-linked Lazarus operators using the zero-day in an Operation Dream Job campaign targeting defense-sector organizations, especially aerospace and aviation firms. According to Check Point, victims were lured into running altered PDF viewer software; the attackers then used CVE-2026-68820 to deploy an updated FudModule kernel rootkit with SYSTEM privileges and interfere with endpoint security visibility.
Check Point’s reporting provides a useful warning against treating this as a generic patch-management statistic. The campaign required a deceptive initial-access step, but once that step worked, afd.sys supplied the privilege boundary crossing needed to entrench the attacker. Its disclosure timeline says the issue was reported to Microsoft on July 28, confirmed July 31, assigned its CVE on August 5, and fixed on August 11.
Windows fleets that cannot receive the August update immediately should tighten the controls that make this bug useful: prevent users from installing unapproved desktop applications, restrict local administrator rights, ensure endpoint detection is functioning, and investigate suspicious PDF-viewer installers or DLL sideloading behavior. Those are compensating measures, not a substitute for the update; the vulnerable kernel component remains present until the monthly security package is installed.
LegacyHive makes local account boundaries a security boundary
Microsoft also fixed CVE-2026-62832 in the Windows User Profile Service. The National Vulnerability Database records the flaw as improper link resolution before file access, commonly called link following, that allows an authorized attacker to elevate privileges locally.
BleepingComputer reports that the bug matches the previously published LegacyHive proof of concept from the pseudonymous researcher Nightmare Eclipse. The attack requires an authenticated attacker who has credentials for another local account. Microsoft’s description says that attacker can cause the service to load another user’s registry hive, potentially enabling access to or modification of that user’s data and elevation to administrator rights.
The important point for administrators is that “local” does not mean harmless. Shared workstations, developer machines with multiple local accounts, kiosk-style systems, jump boxes, lab environments, and devices where passwords or session access are routinely reused all create the conditions in which another account’s credentials can be available. The vulnerability has no requirement for a victim to click a prompt once the attacker is in position.
NVD’s affected-product information shows that CVE-2026-62832 spans Windows 10 21H2 and 22H2, Windows 11 from 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. That breadth makes it a more ordinary but widely relevant endpoint patching problem than a niche product defect.
It is also one of two publicly disclosed zero-days BleepingComputer counted in this month’s release. The other is CVE-2026-72971, a tampering issue in the Windows Container Isolation FS Filter Driver, unionfs.sys. Notebookcheck’s focus on LegacyHive and the afd.sys exploit is reasonable, but administrators should not mistake those two CVEs for the complete zero-day set.
SharePoint needs both halves of the Rapid7 chain
CVE-2026-63520 is the issue that changes the patch order for organizations running self-hosted SharePoint Server. Rapid7 says the vulnerability affects all supported SharePoint versions and stems from unsafe .NET type instantiation in Business Connectivity Services. On its own, it allows code execution under the Windows service account that runs the SharePoint Site instance.
Rapid7 rates the individual issue 8.1, High. But the August fix closes the second half of a chain: paired with CVE-2026-55040, the SharePoint JWT authentication bypass addressed in July, it permits unauthenticated remote code execution against a vulnerable SharePoint server. The distinction between the standalone CVSS score and the chain’s real-world consequence is why patch severity labels alone are inadequate for prioritization.
Rapid7 says it reported the complete chain to Microsoft on May 18 and that Microsoft planned a split remediation schedule: the authentication bypass in July and the code-execution flaw in August. Therefore, a server that only received July updates still carries the code-execution half; one that missed July but installed August may still carry the authentication-bypass half. Both patch cycles are required to break the disclosed chain.
Rapid7 lists remediation packages for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. It also updated its disclosure on August 13 after Microsoft clarified that Project Server and Office Web Apps Server are not affected by CVE-2026-63520, contrary to information Microsoft had provided Rapid7 on July 31. Administrators should use the final affected-product list rather than expanding emergency maintenance to those two products solely because of the initial disclosure.
Where patching must wait for testing, the defensible short-term measure is to restrict external access to SharePoint, reduce who can reach the server, and monitor it closely. Those precautions reduce exposure, but they do not erase the fact that the published chain starts without credentials on a vulnerable SharePoint deployment.
The patch volume is less useful than the attack paths
The 400-versus-421 total is a reminder that Patch Tuesday vulnerability counts are not standardized operational metrics. BleepingComputer’s 400 reflects a same-day release count and breaks that group into 176 elevation-of-privilege flaws, 110 remote-code-execution flaws, 86 information-disclosure flaws, 21 spoofing flaws, 12 denial-of-service flaws, and 11 security-feature bypasses. Secarma’s 421 is a broader August release total.
Neither number tells an IT team what to patch first. CVE-2026-68820 deserves priority because real attackers have used it to move from local code execution to SYSTEM. CVE-2026-62832 matters because public technical details shorten the time between disclosure and commodity use. CVE-2026-63520 deserves urgent attention because a high-severity SharePoint bug becomes a critical remote attack route when the July bypass remains unpatched.
For August 2026, the concrete deployment check is simple: bring Windows systems to their current August security level, verify the resulting build through the organization’s normal update-management tooling, and verify that every supported on-premises SharePoint server has both the July and August security fixes. The latter check is the one most likely to catch a dangerous false sense of completion.