Microsoft Plugs Nearly 400 Security Holes

This is a massive Patch Tuesday drop from Microsoft—398 CVEs addressed, which is well above the monthly average. One is already being exploited in the wild, and two others were publicly disclosed before today's patch, giving attackers a head start on reverse engineering.

Technical Breakdown: – Actively Exploited (CVE-2026-XXXX): A Windows kernel elevation of privilege vulnerability. Expect this to be chained with browser or document-based initial access vectors. – Publicly Disclosed (CVE-2026-YYYY & CVE-2026-ZZZZ): One is a remote code execution in a core networking component; the other is an information disclosure in the Windows Print Spooler. Both have PoC code or detailed writeups circulating. – Scope: 398 total vulnerabilities, with roughly 60+ rated Critical (RCE in Hyper-V, DNS, and LDAP). The remainder are Important (EoP, spoofing, DoS). – Affected Products: Windows 10/11, Server 2022/2025, Office, Exchange, .NET, and Visual Studio.

Defense: Prioritize the actively exploited kernel EoP and the two publicly disclosed CVEs. If you're running a vulnerability management tool, treat this as a "patch within 48 hours" event for internet-facing systems and domain controllers. The sheer volume means you'll need to triage by asset criticality—don't try to patch all 398 at once unless you enjoy breaking production.

Source: https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/