- Published on
Microsoft Plugs Nearly 400 Security Holes
- Authors
- Name
- DeepHorus
Microsoft today released security updates addressing at least 398 vulnerabilities across its Windows operating systems and supported software, including one zero-day exploit already being actively targeted in the wild. The massive patch bundle, part of the company's August Patch Tuesday release, also includes fixes for two other flaws that were publicly disclosed before today. This marks the third consecutive month of unusually high patch volumes.
The August release follows July's record-breaking 570 security fixes and June's then-unprecedented batch of nearly 200 updates. Microsoft attributes this surge to vulnerability discoveries aided by artificial intelligence, a claim echoed by cybersecurity experts who warn that Windows users should expect Patch Tuesday to routinely cover hundreds of flaws. The trend reflects a fundamental shift in how vulnerabilities are found and reported.
Of the 398 vulnerabilities patched, 42 earned Microsoft's most severe "critical" rating, meaning they could allow remote code execution with minimal user interaction. The sole known zero-day is CVE-2026-68820, a privilege escalation flaw in afd.sys, the Windows socket driver. Microsoft also flagged CVE-2026-62832, a User Profile Service bug likely to be exploited, and CVE-2026-72971, a low-impact tampering issue.
According to security firm Automox, CVE-2026-68820 is not a front-door vulnerability but rather a second step in an attack chain. An attacker first gains a low-privilege foothold through phishing, then exploits the driver flaw to escalate privileges and take over the system. The 7.0 CVSS score reflects high attack complexity due to race conditions, requiring repeated exploitation attempts, yet attackers are clearly succeeding.
The sheer volume of patches places a significant burden on IT teams and home users alike. Organizations must prioritize the actively exploited zero-day while also deploying the other critical fixes. The broader industry is feeling the strain, with Adobe, Cisco, Google, Mozilla, and Oracle also increasing patch frequency. AI's ability to find bugs is outpacing the human capacity to fix them, creating a "bugpocalypse" that demands new strategies.
"AI is rapidly becoming astonishingly good at finding vulnerabilities, but this research shows that fixing them is a very different problem," said Ed Skoudis, president of the SANS Technology Institute. His team has seen success using AI to generate patches, but only with humans in the loop for testing and iteration. Meanwhile, 1Password researchers found that LLM-generated patches failed or introduced new weaknesses more than half the time, underscoring the need for caution.
Tyler Reguly of Fortra notes that while reports of Microsoft patching hundreds of vulnerabilities are alarming, the industry is adapting to this new reality. Going forward, AI will likely play an increasingly prominent role in both finding and fixing vulnerabilities, but one-shot automated patching is not reliable. Skoudis advises: "Iterate, test, challenge, improve, and verify. AI can be an extraordinary patching partner, but today it still needs a skilled human at the keyboard."
This month's patch release is part of a larger trend where AI is transforming the cybersecurity landscape. The same technologies that help defenders are also being used by attackers to discover and exploit flaws more rapidly. As the volume of vulnerabilities continues to grow, the question is not whether AI can keep up, but whether human defenders can manage the flood. For now, the answer lies in a collaborative approach that leverages AI's speed while retaining human judgment.
