On 11 August 2026 Microsoft released its monthly security updates, covering 421 separate flaws. One of them, CVE-2026-68820, was already being used in real attacks before the fix existed. Microsoft's own advisory marks it as exploitation detected, and credits researchers at Check Point with finding it.
What it actually does
The flaw is in a low-level Windows networking component called the Ancillary Function Driver for WinSock — afd.sys. It is an elevation of privilege flaw, which is worth translating.
It does not let a stranger break into your network from the internet. It lets someone who has already got a foothold — a phished password, a bad download, a contractor's infected laptop — go from being one ordinary user to having complete control of that machine. It is the second step of an attack, not the first, and it is the step that turns a contained problem into a very bad week.
Microsoft also flagged CVE-2026-62832, a Windows User Profile Service flaw, in the same batch. That one was publicly disclosed before the patch, which historically means exploitation follows quickly.
The fix
Install the August 2026 Windows security update. That is the whole fix. There is no configuration change, no workaround worth using instead, and no version of this where waiting is the better call.
The part people get wrong
Most firms assume Windows Update handled it. Usually it did. The machines that quietly did not are the ones that matter, and they are predictable:
- machines that have not been restarted in weeks — the update is downloaded, not finished, and the flaw is still open
- laptops that were off or travelling, and have not been on long enough since
- shared and back-office machines nobody signs into daily
- servers, where updates are often deliberately held for a maintenance window that then gets skipped
How to check one machine yourself
On the machine, open Settings, then Windows Update, then Update history. Look for a security update installed on or after 12 August 2026, and check whether it says a restart is still needed. If it does, the machine is not patched yet, whatever the green tick suggests.
That works for one machine. The reason firms end up exposed is that nobody wants to do it thirty times, so nobody does it at all — and the one machine that was off that week is the one that matters.
How we handle this: patch status is reported centrally for every covered machine, including the ones that were switched off, and pending-reboot machines are chased rather than assumed. See the services page.