Microsoft patched 421 flaws in one day, and one of them is wormable

Four hundred and twenty-one. That is how many CVEs Microsoft closed on 11 August, the largest single patch batch the company has ever shipped. Sixty-two of them are rated Critical, three zero-days were publicly disclosed before the fix landed, and one was already being exploited.

If you only have time to read one section of this, make it the next one.

Microsoft August 2026 Patch Tuesday: what to patch first

CVE-2026-62878, Windows DNS Server. A stack-based buffer overflow. Remote, unauthenticated, no user interaction required, and it gives code execution with elevated privileges. Analysts flagged it as potentially wormable, which is the word that turns a patch cycle into a weekend. If you run an internet-facing DNS server, this is today's job and everything else waits.

CVE-2026-68820, afd.sys. A use-after-free in the Ancillary Function Driver for WinSock, and the one already being exploited in the wild. That driver is the kernel-level plumbing underneath the entire Windows Sockets API, so anything on the machine that touches a network touches it. It is a local privilege escalation rather than a remote entry point, which in practice means it is the second half of an attack chain: someone gets a foothold through phishing or a stolen credential, then uses this to become SYSTEM.

Two more zero-days were publicly disclosed but have not been seen exploited yet. Public disclosure without an available patch is a countdown, so treat those as urgent rather than routine.

Why the number keeps climbing

Patch Tuesday counts have been rising steadily for three years, and 421 is not evidence that Windows suddenly got worse. It is evidence that automated fuzzing and AI-assisted vulnerability discovery are now finding bugs considerably faster than humans can triage and fix them.

That has an awkward consequence. Vendors are shipping bigger batches, which means defenders are triaging bigger batches, and triage capacity has not scaled at the same rate. The gap between "patch published" and "patch actually applied across the estate" is where most breaches now live. We saw the same shape with the ShieldBreak zero-day in Microsoft Defender and again with the actively exploited Metabase flaw: the fix existed well before most affected organisations had deployed it.

What this means if you are not running a data centre

For a home or small business setup, the practical version is short. Turn on automatic updates and let them run, including the optional ones you have been dismissing. Reboot when asked rather than deferring for a fortnight. If you run any self-hosted service on a Windows box that is reachable from the internet, check whether it is exposed at all, because the cheapest fix for an internet-facing DNS server vulnerability is not having an internet-facing DNS server.

The bigger pattern

The volume itself is the story here. Ransomware crews have industrialised the gap between disclosure and deployment, which is exactly why attacks on large enterprises have surged this year. They are not finding novel zero-days for most intrusions. They are reading the same Patch Tuesday bulletins you are and betting that you will be slower to act than they are.

On a 421-CVE month, that is a reasonable bet. Make it a bad one.