Microsoft August 2026 Patch Tuesday

Release Date: 11 August 2026  

Severity: Critical / High  

Affected Vendor: Microsoft

Executive Summary

Microsoft's August 2026 Patch Tuesday is a large release, closing out 421 vulnerabilities across the product line, of which 62 are rated Critical and 357 Important. Within that total, 109 are Remote Code Execution flaws and 178 allow Elevation of Privilege, giving this month's cycle an unusually heavy weighting toward issues that let an attacker either run their own code or climb their privileges on an affected system.

Three zero-days round out the release. Two were publicly disclosed before or alongside the patches, and one - CVE-2026-68820 is already being actively exploited in the wild, which makes it the clear starting point for remediation. This is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock, rooted in the way Windows handles memory during network operations. An attacker who already has authenticated access to a machine can use it to escalate to SYSTEM-level privileges.  

Beyond this, the release also touches a wide range of enterprise infrastructure: Windows DNS Server, Windows Deployment Services, the Windows iSCSI Target Service, HTTP.sys, SharePoint Server, Exchange Server, Microsoft Office, and several Azure services.

Given the mix of an actively exploited zero-day, two publicly known ones, and a large batch of Critical-rated bugs, organizations should prioritize their response by exploitation status first, then by exposure starting with those reachable from the network or sitting on business-critical systems.

The Zero-Days

CVE-2026-68820: is the vulnerability to act on first, precisely because it's already being used in the wild. It's a use-after-free issue in the Windows Ancillary Function Driver for WinSock: an attacker with valid credentials can run a specially crafted application locally to trigger the flaw and escalate to SYSTEM. Beyond patching immediately, affected environments should be checked for signs of local privilege-escalation activity that may indicate the flaw has already been used.

CVE-2026-62832 sits in the Windows User Profile Service and stems from improper link resolution ahead of file access. A locally authenticated attacker can exploit it to load another user's registry hive, potentially exposing or altering that user's data, and ultimately opening a path to administrator-level access.

CVE-2026-72971 affects the Windows Container Isolation FS Filter Driver (unionfs.sys). It's a tampering vulnerability that an authenticated local attacker can trigger to interfere with protected data or components.

Recommendations

1. Roll out the August 2026 updates across all supported Windows systems.

2. Update Office and Microsoft 365 applications.

3. Patch Exchange and SharePoint environments.

4. Validate that the underlying vulnerabilities are remediated  

5. Re-scan affected assets afterward to confirm remediation.

Conclusion

The recommended sequence is straightforward: address the three zero-days first, move on to Critical RCE vulnerabilities affecting internet-facing and business-critical infrastructure, and then complete the remaining updates from the August cycle. In practical terms, that means identifying exposure to CVE-2026-68820 right away, deploying the relevant security update, validating that remediation worked, and keeping an eye on affected systems for signs of exploitation.

‍