Microsoft patches 421 vulnerabilities including exploited Windows zero-day in August update

Microsoft’s August Patch Tuesday resolves 421 vulnerabilities across Windows, Office, Exchange, Azure, and SharePoint. The most urgent fix targets a zero-day flaw in the Windows Ancillary Function Driver for WinSock, which has been exploited in the wild. This vulnerability allows attackers with existing low-privilege access to escalate to SYSTEM-level control, enabling file manipulation, malware installation, or botnet recruitment. The patch is mandatory for all supported Windows versions, but manual verification and rebooting are required to complete installation.

The zero-day’s exploitation in the wild underscores the risk of local privilege escalation attacks. While the flaw is rated as ‘Important’ rather than ‘Critical,’ its active abuse makes it a higher priority than other vulnerabilities. Two other zero-days were also addressed, including one in the Windows User Profile Service that could grant administrative privileges. Public disclosure of this second flaw increases the likelihood of future exploitation, though no attacks have been reported yet.

Beyond security fixes, the update introduces minor usability improvements. File Explorer now displays larger file sizes in MB or GB, and middle-clicking tabs works in the address bar. Windows Hello adds support for external fingerprint readers, while Voice Access gains a Voice Isolation feature for better speech recognition. These changes are incremental but may reduce friction for users relying on biometric or voice-based interactions.

The sheer volume of patched vulnerabilities, 421, reflects Microsoft’s ongoing efforts to address security gaps, though it’s fewer than the 570 fixed in July. The company attributes some of this progress to AI-driven tools like MDASH, which accelerates vulnerability detection and reduces false positives. While this may shorten the window for zero-day exploitation, it doesn’t eliminate the need for prompt patching. Engineers should prioritize this update, especially for systems exposed to untrusted local access.