Patch Tuesday: August 2026

August is usually a quieter month on the IT calendar, but Microsoft's Patch Tuesday doesn't work around anyone's holiday schedule. This month's huge release is a good reminder of that: roughly 400 vulnerabilities addressed, 42 of them rated Critical, and three zero-days that were either being exploited in the wild or had already been disclosed before a fix was ready.

That puts August in line with the some of the busiest releases we've covered this year. 

Key Updates

• Around 400 vulnerabilities patched this month
• 42 critical vulnerabilities
• 3 zero-day vulnerabilities: 1 actively exploited, 2 publicly disclosed
  
  

Vulnerability Types Released in August 2026

Zero-Day Vulnerabilities

CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

This is the one Microsoft confirms was exploited before a patch existed. It's a use-after-free vulnerability in afd.sys, the driver behind Windows' WinSock networking stack, and it lets an attacker who already has low-privilege local access on a machine elevate to SYSTEM. It carries a CVSS score of 7.0 and Microsoft rates it Important rather than Critical, which is typical for elevation-of-privilege bugs that need local access rather than being reachable directly over a network. CISA added it to its Known Exploited Vulnerabilities catalogue on 11 August, with a remediation deadline of 25 August for US federal agencies. Privilege escalation flaws like this are rarely how an attacker gets in, but they're a reliable way to go from a foothold to full control once they're in, so this belongs near the top of the queue rather than the bottom.

CVE-2026-62832: Windows User Profile Service Elevation of Privilege Vulnerability

This one was publicly disclosed before Microsoft had a patch ready, under the researcher-assigned name "LegacyHive." It's a link-following flaw in the Windows User Profile Service that could let a locally authenticated attacker gain administrator-level privileges, and Microsoft rates exploitation "more likely" with a CVSS score of 7.8. There's no confirmation from Microsoft that it's been exploited in the wild, but public disclosure combined with an "exploitation more likely" rating is usually enough reason to move it up the list.

CVE-2026-72971: Windows Container Isolation FS Filter Driver Tampering Vulnerability

The third zero-day is a lower-severity tampering issue in the driver Windows uses to isolate container filesystems, known as unionfs.sys. It primarily affects Windows 11 version 26H1, carries a CVSS score of 5.5, and Microsoft rates exploitation "unlikely."

Critical Vulnerability Summary

Four of this month's critical fixes land in core Windows networking services: DNS Server, Deployment Services, QUIC and DHCP Server. All four are remote code execution flaws that don't require authentication, and three of the four don't even require the attacker to be on the same network segment as the target. Security researchers have singled out the DNS Server flaw, CVE-2026-62878, as potentially wormable, given how often DNS servers sit exposed on a network perimeter. None of the four are confirmed as exploited yet, but low attack complexity, no authentication requirement and a high CVSS score is exactly the profile that history suggests gets weaponised quickly once technical details are public.

Other Vulnerabilities Worth Watching

On its own, CVE-2026-63520 needs an attacker to already be authenticated, which limits how it can be used. But researchers showed it can be chained with CVE-2026-55040, an authentication-bypass flaw Microsoft patched back in July, to produce a fully unauthenticated remote code execution path against on-premises SharePoint Server. SharePoint Online isn't affected. There's no indication that it's been used against real targets, but it's a good illustration of why last month's patches still matter this month: an organisation that applied July's SharePoint fix but is behind on August's update isn't fully covered, and the reverse is also true.

Microsoft's Exchange Server elevation of privilege fix, CVE-2026-62911, is also worth flagging even though it needs both authentication and some user interaction to work. A working exploit was demonstrated at the Pwn2Own Berlin competition, and the underlying authentication-bypass bug can expose entire mailboxes to an attacker who gets it working: reading and sending mail, downloading attachments, effectively acting as any user on the server.

And we can't write off Microsoft HPC Pack just because it's rated Important instead of Critical. CVE-2026-59124 carries the same 9.8 CVSS score as the DNS Server and Deployment Services flaws above it in the table. Microsoft's severity rating takes install footprint into account, and HPC Pack isn't part of a default Windows deployment, but if you're running HPC clusters, the CVSS score is the number that matters, not the Important label sitting next to it.

Actions to Take

With a release this size landing in a month when a lot of teams are running lighter than usual, prioritisation matters more than it might otherwise. A few places to start:

• Patch the actively exploited zero-day first. CVE-2026-68820 is already in CISA's Known Exploited Vulnerabilities catalogue, and once the details are this public, it's a reasonable bet that other attackers will start using it too.
• Get to the unauthenticated remote code execution flaws quickly. DNS Server, Deployment Services, QUIC and DHCP Server all qualify, especially on anything internet-facing or reachable from a broad internal network segment.
• Confirm SharePoint Server is fully patched for both July and August. The chain between CVE-2026-55040 and CVE-2026-63520 only closes when both updates are applied.
• Don't skip HPC Pack because of the Important label, if you run HPC clusters. The CVSS score tells a different story to the severity rating.
• Keep an eye on coverage while people are away. A patching rhythm that depends on one specific person being at their desk is exactly the kind of thing that slips in August.

To Conclude

August's Patch Tuesday is a reminder that vulnerability volume doesn't take the summer off! The headline zero-day is a privilege escalation bug rather than something more dramatic, but it's already being exploited and it's already in CISA's catalogue, which puts it ahead of almost everything else in the queue. Beyond that, the pattern is a familiar one: a long list of elevation of privilege fixes, a handful of unauthenticated remote code execution flaws in core Windows services that are easy to underestimate until you check which of your servers are internet-facing, and at least one reminder, the SharePoint chain, that last month's patches still matter this month.

Working out which of the 400 fixes actually apply to your environment, and which of those genuinely need attention this week, is the hard part. RoboShadow helps with that by continuously mapping your external attack surface, so you can see what's actually exposed, which vulnerabilities are relevant to your specific setup, and where to focus patching first rather than working through Microsoft's list from top to bottom.

Frequently Asked Questions

What is a Zero-Day vulnerability?

A zero-day vulnerability is a security flaw that becomes known to attackers before defenders have had a fair chance to patch it. In practice, that means there are effectively zero days of warning once details are public or exploitation begins. Even where exploitation has not yet been confirmed, a publicly disclosed flaw usually raises the urgency because attackers now know exactly what to start testing against exposed systems.

How many vulnerabilities did Microsoft patch in August 2026?

Microsoft addressed roughly 400 vulnerabilities in the August 2026 Patch Tuesday release, published on 11 August 2026. Of those, 42 are rated Critical, with almost all of the remainder rated Important and one Moderate.

Were any zero-days actively exploited in August 2026?

Yes. Microsoft confirms that CVE-2026-68820, an elevation of privilege vulnerability in the Windows Ancillary Function Driver for WinSock, was exploited before a patch was available. Two further vulnerabilities, CVE-2026-62832 and CVE-2026-72971, were publicly disclosed ahead of the patch but aren't confirmed as exploited in the wild.

What should be patched first this month?

There's no single "worst" vulnerability in this release, but two stand out for different reasons: CVE-2026-68820, because it's confirmed as actively exploited and already listed in CISA's Known Exploited Vulnerabilities catalogue, and CVE-2026-62878 (Windows DNS Server), because it's an unauthenticated, network-reachable remote code execution flaw with a CVSS score of 9.8.

Which Microsoft products are affected this month?

The release touches Windows 10 and 11, Windows Server, Microsoft Office, SharePoint Server, Exchange Server, Azure services, .NET and Visual Studio, and Microsoft Defender, among others. Windows components make up the largest share, followed by Office and SharePoint.

Is SharePoint Server at risk from a chained exploit?

Yes, in a specific sense. CVE-2026-63520, patched this month, can be combined with CVE-2026-55040, an authentication-bypass flaw patched in July, to allow unauthenticated remote code execution against on-premises SharePoint Server. SharePoint Online isn't affected. Organisations need both patches applied to be fully covered.

As always, thank you for your continuous support and feedback, and if you have any questions, please don’t hesitate to reach out to us at hello@roboshadow.com - we are always more than happy to walk through things with you :).