Last August, Microsoft released fixes for 421 vulnerabilities in a single Patch Tuesday. Four hundred and twenty-one. That is not a security bulletin; that is a warehouse inventory. And buried in the pile was a zero-day already being exploited in the wild.
I am writing about it now, months later, not because the news is fresh but because the number deserves to be looked at cold, without the adrenaline of the news cycle. Once the dust settles, what remains is the uncomfortable arithmetic of modern patch management.
The zero-day: same driver, fourth time
The exploited flaw, CVE-2026-68820, is a use-after-free bug in the Ancillary Function Driver for WinSock, afd.sys, the kernel-mode driver that underpins the entire Windows Sockets API. A locally authenticated attacker runs a specially crafted application, triggers a race condition and walks away with SYSTEM privileges. No user interaction required. Microsoft confirmed active exploitation but shared few details about the actual campaigns.
Here is the detail that should keep defenders awake: this is the fourth zero-day exploited in that very same driver since 2022. One of the previous ones, CVE-2024-38193, was reportedly used by North Korean hackers linked to the Lazarus group. The new flaw came with no attribution: state-actor interest was a researcher’s hypothesis, not a finding. Still: the same kernel component, breached four times in four years. Calling that bad luck is an act of faith. Calling it a pattern is just reading.
The rest of the catalogue
The August package reads like a confession written in CVE format. CVE-2026-62832, in the Windows User Profile Service, was publicly disclosed before the patch: an attacker with credentials for another local account can load another user’s registry hive and gain administrator privileges. Microsoft itself rates exploitation as likely in the short term. CVE-2026-72971, in the container isolation filter driver, was also public, though considered unlikely to be exploited.
Then come the remote code execution flaws: in the Windows DNS server, in the TFTP server of Windows Deployment Services, in the QUIC implementation, in HPC Pack. Plus an elevation of privilege in Exchange Server, which the Zero Day Initiative’s Dustin Childs flagged as a priority alongside the RCE bugs.
The distribution tells its own story: 236 vulnerabilities in Windows, 98 in Office, 30 in SharePoint Server, 26 in developer tools, 17 in Azure, 7 in Exchange. The release even includes two fixes for the TPM 2.0 reference implementation. That does not mean every hardware TPM out there is suddenly broken; vendors build on that code in different ways. But the component sold to us as the root of trust needed corrections at the source, and when even the reference design of trust ships with bugs, the marketing brochure and the changelog start telling two different stories.
Patching as someone else’s technical debt
Now the part nobody likes to say out loud. First, the honest caveat: 421 CVEs do not translate into 421 separate patches to deploy, and not all of them apply to every organisation. Many arrive bundled in cumulative updates; many concern products you do not even run. But the assessment burden is real, and evaluating, testing and rolling out a volume like this in a reasonable timeframe collides head-on with change windows, legacy dependencies and the thousand servers nobody dares to reboot. So what actually happens is triage, exactly like an emergency room: exploited vulnerabilities first, Internet-facing systems next, everything else takes a number and waits in the corridor.
Risk-based prioritisation is the professional term, and it is the correct approach. But let us be honest about what it really is: a coping mechanism. The vendor produces vulnerabilities at industrial scale, and the customers pay for the cleanup, every second Tuesday of the month, on subscription. We have normalised a business model where the cost of software defects is structurally transferred downstream, to the security teams, to the IT departments, to the organisations that risk being breached through the patch they could not deploy in time.
Four hundred and twenty-one fixes in one month is not a sign of diligence. It is the size of the invoice.
Raffaele Di Marzio
All my “insane” books on cybersecurity and governance are here 👇 https://cyberium.limited/bookshelf.html