TL;DR
- This week’s Microsoft Patch Tuesday release included 398 CVEs for some fabulous summer reading, with three zero-days.
- It includes 169 elevation of privilege CVEs, and 110 remote code execution (RCE) CVEs
- We recommend prioritizing patching for the three identified zero-days immediately
It’s late-summer—the time of year that kiddos head back to school and the summer nights are getting shorter. While many are closing out their vacations, Microsoft gave us back-to-back months with a massive CVE volume. Welcome to Patch Tuesday!
| CVE ID | Affects | Affected versions | CVSS | Description |
|---|---|---|---|---|
| Windows Ancillary Function Driver for WinSock Elevation of Privilege | Windows 10-10
Windows 11-8 Windows Servers-12 (30 Total) |
7.0 | Can be exploited for administrator privileges | |
| Windows Kernel Elevation of Privilege Vulnerability | Windows 11-6
Windows Servers-2 (8 Total) |
7.8 | Can be exploited for administrator privileges | |
| Windows User Profile Service Elevation of Privilege Vulnerability | Windows 10-6
Windows 11-8 Windows Servers-4 (18 Total) |
7.8 | Can be exploited for administrator privileges |
Patch Tuesday: August 11, 2026
Tuesday’s release included 398 CVEs, including fixes for three zero-day vulnerabilities. Here are the CVEs we think are deserving of your attention first:
- Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability New (CVE-2026-68820): The CVE has already seen active exploitation, and was quickly added to the CISA KEV on 8/11/26. Bleeping Computers is even tying this CVE to Lazarus group activity. Attackers could leverage this vulnerability to elevate privileges locally. This CVE should be treated as top-priority patching. Apply resources to implement the August 2026 cumulative update to all affected Windows systems.
- Windows Kernel Elevation of Privilege Vulnerability (CVE-2026-62737): A proof-of-concept (PoC) for exploitation has already been published. The vulnerability stems from an ‘untrusted pointer dereference’ weakness that could allow an attacker to gain system privileges. The scope of Microsoft products impacted is smaller, but we recommend remediation.
- Windows User Profile Service Elevation of Privilege Vulnerability (CVE-2026-62832): CVE-2026-62832 is a high-severity (CVSS 7.8) local privilege escalation flaw in the Windows User Profile Service. This allows an authenticated attacker with low-level credentials to load another user’s registry hive, gaining administrator privileges without any user interaction required.
That’s it for this month. Questions? Reach out to your Expel representative or contact us here.
