Cyber News: 421 Microsoft Fixes and a Live Zero-Day

This was a patching fortnight rather than a breach fortnight, which is the better kind. One Windows flaw is already being exploited, one of the most common business firewalls picked up an urgent fix, and a security product that was retired last year turned out to need emergency patches because plenty of firms are still running it. None of this requires a security team to act on, but all of it needs someone to confirm it is done.

Microsoft shipped 421 fixes, and one flaw is already being used

Patch Tuesday on 11 August was unusually large: 421 CVEs, including 236 in Windows, 98 across Office, 30 in SharePoint Server and 7 in Exchange Server, with 62 rated critical. The one that matters most is CVE-2026-68820, a use-after-free flaw in the Ancillary Function Driver for WinSock, afd.sys, which was already being exploited before the patch existed. It is a privilege escalation bug rather than a remote break-in: an attacker who can already run code on the machine as an ordinary user can win a race condition and get SYSTEM. CISA added it to its Known Exploited Vulnerabilities catalogue the same day. A second Windows privilege escalation bug, CVE-2026-62832 in the User Profile Service, was publicly disclosed before the fix, and there are remote code execution flaws in Windows DNS Server, Deployment Services TFTP, Microsoft QUIC and HPC Pack.

Privilege escalation is easy to wave away because it needs a foothold first, and that is exactly the mistake. Most real incidents start with a phished credential or a malicious document, which gets the attacker a normal user session; a bug like this is what turns that into domain-wide access. If you have a managed IT provider, the reasonable question this week is simply whether the August updates are deployed and how many machines are outstanding. Cyber Essentials requires high and critical patches within 14 days, and our patch deadline calculator gives you the actual date for this release. If you are unsure how phishing turns into a foothold in the first place, phishing attacks explained covers the chain. Details are at SecurityWeek and the catalogue entry at CISA.

Cisco firewalls and a load balancer join the actively-exploited list

The same 11 August CISA update added CVE-2026-20349, a heap inspection flaw in Cisco Secure Firewall ASA and Firepower Threat Defence, and CVE-2026-72898, a SQL injection flaw in the Metabase analytics tool. Four days earlier, on 7 August, CISA added CVE-2026-8037, a command injection bug in Progress LoadMaster load balancers. Being on that list is not a severity rating, it is a statement that someone is actively using the flaw against real targets.

The pattern here is worth naming, because it keeps repeating: the things being exploited are the boxes at the edge of the network, firewalls, VPN concentrators, load balancers and management consoles. These are the devices that are hardest to take offline for maintenance and easiest to forget, and they sit outside most patching schedules because they are not laptops. A small business is unlikely to run Metabase or LoadMaster, but a Cisco ASA at the office perimeter is entirely plausible, as is one at the managed service provider you rely on. Ask who patches your edge devices and on what cycle. Our network security guide for small businesses covers where those responsibilities usually sit, and managed cyber security services explains what a provider should be contracted to do. The alerts are at CISA and CISA.

SonicWall patched a product it retired last October

On 12 August SonicWall issued fixes for eight flaws across two products, including two critical remote code execution bugs in its Global Management System: CVE-2026-66147, a command injection in the GMS Dispatcher Service scoring 9.4, and CVE-2026-66145, scoring 9.1, which allows data disclosure and arbitrary file writes. Its Email Security appliances picked up two more high-severity bugs that could give an attacker command execution as root. SonicWall says it has no evidence any of these have been exploited, and the fixes are in GMS 9.5.2 and Email Security 10.0.36.

The detail that makes this a story is that GMS was discontinued in October 2025. A vendor does not usually issue critical patches for a retired platform unless a meaningful number of customers are still running it, which is a fair description of how most security kit actually ages out: it keeps working, so nobody replaces it, and the day the vendor stops publishing fixes at all, nothing visibly changes. That is also the version of the problem an insurer will ask you about, because unsupported software is one of the more common ways a cyber claim gets narrowed. Our guide to what cyber insurance covers and excludes sets out the usual wording, and a cyber security audit is the practical way to find out what end-of-life kit is still on your network. The advisory coverage is at SecurityWeek.