421 Vulnerabilities: It Only Took One

Last updated: August 17, 2026 · Author: Zach Carothers · Reading time: 4 minutes

Executive Summary

A layman’s breakdown for executives

• Microsoft released fixes for 421 security vulnerabilities in August, but one stood out because attackers were already using it before the patch was available.
• The incident is a reminder that not every vulnerability carries the same level of business risk. What matters most is whether a weakness affects your environment and whether criminals are actively exploiting it.
• Organizations should have a clear process for identifying which security updates require immediate action, which systems are affected, and whether any systems missed the patching window.
• For executives, the key question is simple: Can your team quickly show which known security threats affect the organization, what has been fixed, and what still requires attention?

The Massive Patch Count Is Mostly Noise

421 vulnerabilities sounds terrifying, but that wasn’t even Microsoft’s biggest month this summer. July, just last month, had even more. And that’s exactly why patch count numbers are becoming less useful.

No real IT team treats Patch Tuesday like a shopping list. It’s just not practical. There are servers that can’t simply reboot, applications that need thorough testing, and at least one business owner who swears a 2017 Windows server is “mission critical.” (No, I’m not kidding)

The question is not:

“How do we patch 421 vulnerabilities immediately?”

The question is:

“Which ones cannot wait?”

This month, CVE-2026-68820 was near the top of that list.

Who Already Had the Exploit

CVE-2026-68820, which was already being exploited, is a use-after-free vulnerability in afd.sys, the Windows Ancillary Function Driver for WinSock.

It is a local privilege-escalation flaw, which basically means an attacker needs to already be on the machine, then the vulnerability can help elevate their access to SYSTEM, which is partly why its CVSS score is only 7.0.

Check Point observed Lazarus using the flaw in its Operation Dream Job campaign. Once attackers were in, the flaw helped them reach SYSTEM privileges and deploy FudModule, a kernel-mode rootkit that can reduce visibility from endpoint security tools.

Check Point says the exploit was already being used in July, researchers reported the bug to Microsoft on July 28, and Microsoft patched it August 11, the same day CISA added it to the Known Exploited Vulnerabilities (KEV) catalog.

The hackers had a clear head start.

Why a 7.0 Can Beat a 9.8

This is where vulnerability management gets interesting. August included vulnerabilities with much higher severity scores, including a 9.8 remote-code-execution flaw.

But CVSS is not a to-do list.

A 9.8 vulnerability affecting software you do not use may be less urgent than a 7.0 vulnerability attackers are actively exploiting on systems sitting all over your network.

Good prioritization combines severity with reality:

• Is it being exploited?
• Are we exposed?
• What systems are affected?
• How important are those systems?
• What protections exist until we patch?

That is why CISA’s KEV catalog is such a useful reference.

CVSS tells you how bad a vulnerability could be, but KEV tells you attackers are actually using it.

What to Check Now

Start with the obvious: confirm Microsoft’s August updates reached affected Windows endpoints and servers, and make sure systems waiting on a reboot actually finished the job.

Then look at what did not patch.

Because this flaw was exploited before a fix existed, an unpatched machine is not necessarily just behind schedule. If there are suspicious indicators, it may deserve investigation before someone installs the update and closes the ticket.

Then ask a few uncomfortable questions:

• Which systems are still vulnerable?
• Which vulnerabilities in your environment are currently being exploited?
• What gets bumped to the top of the patch queue?
• Which machines, if any, routinely miss patch windows?
• Can you prove when remediation happened?

For credit unions and other regulated organizations, that last question matters almost as much as the patch itself. A mature program needs to show how risk was identified, prioritized and remediated, not merely that Windows Update was enabled.

Patch Tuesday Is a Triage Event

Keep in mind, out of the 421 vulnerabilities, it only took one. And that one vulnerability, sitting at a 7.0, can easily fly under the radar when 9.0s and a 9.8 are on the same list.

The single vulnerability was already being used by a nation-state hacker. It was rated Important, scored 7.0, and could turn an attacker’s existing foothold into SYSTEM-level control.

Modern vulnerability management is not about patching everything at the same speed. It’s about knowing what can’t wait.

If your team can’t quickly identify the known-exploited vulnerabilities in your environment, where they live and whether they are fixed, that is a major problem that needs to be solved now, not later.