Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack

Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only

The article reports that Microsoft patched 398 flaws and identified CVE-2026-68820 as the only vulnerability in that release being actively exploited; the bug is described as a use-after-free in the Windows networking driver afd.sys that can let a local attacker elevate privileges to SYSTEM[3]. RealGround analysis: this is a conventional Windows exploitation issue, not an AI-specific threat, so the relevance to AI risk is low and the main security implication is rapid patching and exposure reduction for Windows endpoints, especially where untrusted local code execution is possible.