# Microsoft Plugs 398 Security Holes in Windows Systems

Critical security updates released for Windows operating systems.

- **Source:** [Krebs on Security](https://brifing.si/source/0a287077-2ca9-4c5d-b9aa-b7b61aa8e436)
- **Published:** 2026-08-11
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/>
- **On Brifing:** https://brifing.si/s/54f76473-ddcd-4f1a-ab46-2e96adcc2e9b

## Record Number of Security Vulnerabilities

Microsoft released updates addressing 398 security flaws in Windows OS and supported software. While lower than last month's record of 570 patches, it doubles June's then-record of 200 fixes. 42 vulnerabilities were rated 'critical', allowing attackers to potentially gain system control without user interaction.

## Actively Exploited Zero-Day Flaw

The only known zero-day patched this month is CVE-2026-68820, a privilege escalation vulnerability in the afd.sys Windows socket driver. Automox explains attackers can use this as step two in an attack chain after initial phishing. Despite its 7.0 complexity score (due to race conditions), attackers are successfully exploiting it in the wild.

## Other Critical Vulnerabilities

CVE-2026-62832 is another privilege escalation flaw in Windows User Profile Service, possibly related to the 'LegacyHive' disclosure. CVE-2026-72971 is a low-impact local tampering vulnerability deemed unlikely to be exploited. Microsoft attributes the surge in discoveries to AI-assisted vulnerability detection methods.

## Industry-Wide Patch Surge

Adobe moved to twice-monthly security bulletins, while Cisco, Google, Mozilla and Oracle are also releasing updates more frequently. AI is dramatically increasing vulnerability discoveries across the software industry. However, experts emphasize human oversight remains crucial in the patching process.

## The AI Patching Challenge

1Password researchers tested LLM-generated patches for complex vulnerabilities. Over half either failed to fix the flaw or introduced new weaknesses. SANS Technology Institute's Ed Skoudis noted: 'AI is becoming astonishingly good at finding vulnerabilities, but fixing them requires human testing and iterative improvement.'

## Recommendations for Security Teams

Fortra's Tyler Reguly advises security leaders to assess how teams are handling increased patch workloads. 'There's no need to rush these updates,' he says, emphasizing thorough testing before production deployment. Only one of the 398 flaws is currently known to be actively exploited, allowing time for proper validation.

## User Recommendations

Experts recommend backing up systems before applying massive patch bundles like this. The day after Patch Tuesday (sometimes called 'Reboot Wednesday') occasionally sees problematic updates. Waiting a few days allows Microsoft time to address any faulty patches that might emerge post-release.

## The New Era of Cybersecurity

AI-powered vulnerability discovery has ushered in a new cybersecurity era. However, human expertise remains essential for effective patching. The industry faces an asymmetric battle as AI enhances both defensive and offensive capabilities. Microsoft's record patch release exemplifies this ongoing technological arms race.

## Sources covering this story

- https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._