Reported by 10 outlets
Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)
Why this score
- Breadth
- 2.00 / 2.0 · 10 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.13 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Microsoft's August 2026 Patch Tuesday fixed 398 CVEs by Tenable's count, 42 critical, with Qualys logging 421 because its tally includes fixes Microsoft shipped earlier in the month outside the main bundle. The one bug exploited in the wild is CVE-2026-68820, a use-after-free elevation of privilege in the Windows Ancillary Function Driver for WinSock (afd.sys), CVSS 7.0, where an authenticated local attacker wins a race condition and lands SYSTEM; Microsoft credits Check Point researchers, and observed use has been tied to Lazarus Group's Operation Dream Job campaign. Two other zero-days were public before patch day: CVE-2026-62832 in the User Profile Service, matching the LegacyHive exploit Nightmare Eclipse dropped July 14, and CVE-2026-72971, a tampering flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys). Rapid7 also completed its two-stage SharePoint chain that day, pairing CVE-2026-55040, a JWT authentication bypass it disclosed July 14, with the new CVE-2026-63520 remote code execution bug and a public proof of concept.
The exploitable subset of this cycle is small, specific, and unevenly distributed. Only one of the 398 flaws is known exploited, but it is a chain-finisher: Automox describes CVE-2026-68820 as step two after a phish, which means the population at risk is every endpoint that handles hostile content, not a server shortlist. The SharePoint pair punishes partial patching, because an organization that applied July's KB5002882 already broke the chain, while one that patched nothing now faces public exploit code for unauthenticated code execution against SharePoint Server Subscription Edition, 2019, and 2016, and CISA added CVE-2026-55040 to the KEV catalog on August 18 citing exploitation evidence. Server teams should read the "exploitation more likely" flags instead of the severity spread: CVE-2026-62893 in Windows Deployment Services TFTP Server is a 9.8 unauthenticated network RCE and CVE-2026-62823 in Windows DHCP Server is an 8.8 adjacent-network heap overflow. At a volume past 400 CVEs for a second consecutive month, driven by Microsoft's AI-assisted discovery pipeline, CVSS is noise and exploitation status, KEV presence, and public PoC availability are the sort keys.
Deploy KB5121003 for Windows 11 24H2/25H2, KB5120240 for 23H2, and KB5120249 for Windows 10 ESU, which moves builds to 19045.7663 and 19044.7663; the afd.sys fix replaces a kernel driver, so remediation is not verified until the reboot completes, and CISA's same-day KEV entry for CVE-2026-68820 starts BOD 26-04 remediation clocks of 3 to 14 days. On SharePoint, apply August's CVE-2026-63520 patches across Subscription Edition, 2019, and 2016, then confirm July's KB5002882, KB5002883, or KB5002891 actually landed, since a missed July update leaves the full chain open. Hunt on SharePoint front-ends for unauthenticated GETs to /_layouts/15/metadata/json/1, which leaks the STS signing certificate, followed by Bearer-token requests to /_api/web/currentuser or /_api/contextinfo carrying forged JWTs, alg none headers, or an actor token whose x5t matches the local STS certificate; Rapid7's proof of concept is public and reproduces exactly that sequence. For CVE-2026-68820, treat phishing as stage one per the Lazarus tradecraft and prioritize patch verification on endpoints with inbound mail and browser exposure.
Two developments would change this assessment. Weaponization of the SharePoint chain beyond the evidence behind the August 18 KEV entry, or any confirmed in-the-wild use of CVE-2026-63520, converts a patch-cycle story into an incident response problem for every unpatched farm. Nightmare Eclipse also kept its habit of timing releases for maximum friction, dropping ShieldBreak on August 11 as a full bypass of July's RoguePlanet fix in Defender, so another exploit targeting August's fixes, or a weaponized rebuild of the deliberately incomplete LegacyHive PoC, would push endpoint risk above the current baseline.
Timeline
-
original reporting
Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)
tenable.com · 63d ago · August 11th, 2026
42Critical 355Important 1Moderate 0Low Microsoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild. Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727. This month’s update includes patches for: .NET .NET Core .NET Framework AMD Zen Active Directory Certificate Services (AD CS) Application Information Services Azure Active Directory Azure CycleCloud Azure Monitor Agent Azure Storage Explorer Capability Access Management Service (camsvc) Desktop Window Manager Dynamics Business Central GitHub Copilot and Visual Studio Code Microsoft Azure Attestation service and Device Health Attestation Service Microsoft COM for Windows Microsoft Defender for Endpoint Microsoft Digest Authentication Microsoft Dynamics 365 (on-premises) Microsoft Entra Connect Sync Microsoft Exchange Server Microsoft High Performance Computing (HPC) Pack Microsoft Identity Services Microsoft Local Security Authority Server (lsasrv) Microsoft Office Microsoft Office Access Microsoft Office Excel Microsoft Office Graphics Component Microsoft Office Outlook Microsoft Office PowerPoint Microsoft Office SharePoint Microsoft Office Word Microsoft OneDrive Microsoft PowerShell Microsoft PowerShell Core Microsoft QUIC Microsoft Remote Registry Service Microsoft Teams Mobile Micro
-
update from rapid7.com
CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED)
rapid7.com · 92d ago · July 14th, 2026
Rapid7 and Microsoft jointly disclosed CVE-2026-55040 on July 14, 2026: an authentication bypass in SharePoint's JWT token validation pipeline, scored CVSSv3.1 9.1 Critical, letting a remote unauthenticated attacker impersonate any SharePoint site user. It is the first half of a two-vulnerability unauthenticated RCE chain Rapid7 built for Pwn2Own Berlin using AI-assisted research, with the RCE component scheduled for the August 2026 update cycle. Fixes were already available as KB5002882 (SharePoint Server Subscription Edition 16.0.19725.20434), KB5002883 (SharePoint Server 2019), and KB5002891 (SharePoint Enterprise Server 2016). The page's disclosure timeline records that CISA added CVE-2026-55040 to the KEV catalog on August 18, 2026 based on evidence of active exploitation.
-
update from theregister.com
LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised
theregister.com · 90d ago · July 15th, 2026
Pseudonymous researcher Nightmare Eclipse published the LegacyHive zero-day on July 14, 2026, shortly after that month's Patch Tuesday: a local privilege escalation in the Windows User Profile Service (profsvc) that abuses arbitrary registry hive loading so a standard user can mount another user's hive, including an administrator's. The public proof of concept is deliberately partial and requires additional user credentials, but experts warned capable attackers could weaponize the missing pieces quickly, noting the researcher's earlier drops saw rapid criminal adoption. A Microsoft spokesperson said on July 16 the company was aware of the reported vulnerability and actively investigating.
-
update from bleepingcomputer.com
Windows 11 KB5121003 & KB5120240 cumulative updates released
bleepingcomputer.com · 63d ago · August 11th, 2026
Microsoft has released Windows 11 KB512103 and KB5120240 cumulative updates for versions 25H2/24H2 and 23H2 to fix security vulnerabilities, bugs, and add new features. Today's updates are mandatory as they contain the August 2026 Patch Tuesday security patches for 400 vulnerabilities discovered in previous months. You can install today's update by going to Start > Settings > Windows Update and clicking on 'Check for Updates .' You can also manually download and install the update from the Microsoft Update Catalog . There are no exclusive or special changes. You'll get the same fixes across the two versions of Windows 11. What's new in the August 2026 Patch Tuesday update With today's update, Microsoft is making Windows Search better at typos and rolling out multiple performance-related fixes, but the catch is that most changes don't show up right away. Here's the full list of improvements and fixes: File Explorer File sizes in the Details view now display using appropriate units (KB, MB, GB) instead of KB-only, making them easier to understand at a glance. Middle click to open a folder in a new tab is now supported in the Address Bar and the Home page for a more consistent and efficient tabbed navigation experience across File Explorer. This update eliminates a grey flash on load and unexpected scrolling to t
-
update from malware.news
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th)
malware.news · 63d ago · August 11th, 2026
Notable fixes include Windows privilege escalation, container tampering, and critical QUIC and DNS Server remote code execution bugs. Article Link: Microsoft Patch Tuesday August 2026 - SANS ISC
-
update from bleepingcomputer.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
bleepingcomputer.com · 63d ago · August 11th, 2026
The approximate number of bugs in each vulnerability category is listed below: 176 Elevation of Privilege Vulnerabilities 11 Security Feature Bypass Vulnerabilities 110 Remote Code Execution Vulnerabilities 86 Information Disclosure Vulnerabilities 12 Denial of Service Vulnerabilities 21 Spoofing Vulnerabilities When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include some flaws in Mariner, Microsoft Teams, Microsoft Azure, Microsoft Entra, Microsoft Office, and Power Apps that were fixed by Microsoft earlier this month. While this Patch Tuesday is not as large as last month's, which fixed 570 flaws , it is still very large compared to the previous month. Microsoft warned that there would be an increase in Patch Tuesday security updates as it has begun to use an AI-powered vulnerability discovery system to identify more security flaws across its software products. Microsoft classifies a z
-
update from bleepingcomputer.com
Microsoft releases Windows 10 KB5120249 extended security update
bleepingcomputer.com · 63d ago · August 11th, 2026
After installing today's update, Windows 10 will be updated to OS Builds 19045.7663 and 19044.7663. What's new in the Windows 10 August 2026 Patch Tuesday update With today's update, Microsoft is fixing a File History backup issue and expanding the rollout of new Secure Boot certificates. Here's the full list of improvements and fixes: [Backup] File History automatic backups to network shares using Server Message Block (SMB) might fail with an incorrect "invalid credentials" error. [Secure Boot] This update includes additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Microsoft also said that Secure Boot certificate deployment via Windows updates continues across supported PCs and non-managed business devices in the coming months.
-
mentioned by securityweek.com
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day
securityweek.com · 63d ago · August 11th, 2026
-
update from rapid7.com
Patch Tuesday - August 2026
rapid7.com · 63d ago · August 11th, 2026
This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. As usual, browser vulns are not included in the Patch Tuesday count above, but unusually, Microsoft does not appear to have published any desktop browser security patches so far this month. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer , and published today in coordination with Microsoft; this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability in a vulnerable SharePoint server.
-
update from krebsonsecurity.com
Microsoft Plugs Nearly 400 Security Holes
krebsonsecurity.com · 63d ago · August 11th, 2026
Image: Shutterstock, Mallika Home Studio. August’s overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month , but it is double June’s then-record batch of nearly 200 fixes . Microsoft has attributed the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree that Windows users should get used to the idea of Patch Tuesdays (the second Tuesday of each month) covering hundreds of newly discovered security flaws. Fully 42 of the 398 flaws that Microsoft patched today earned Redmond’s most-dire “critical” rating, meaning they are severe enough that malware or malcontents could exploit them to gain remote control over a Windows computer with little to no help from the user. The sole known “zero day” bug fixed by Microsoft this month is CVE-2026-68820 , a privilege escalation weakness in a core Windows component called afd.sys , which the security firm Automox describes as “the driver behind Windows socket connections on effectively every endpoint.” “This isn’t a front-door bug,” Automox’s Landon Miles wrote in a Patch Tuesday blog post. “It’s step two in a chain: an attacker phishes their way
-
mentioned by malware.news
Microsoft Plugs Nearly 400 Security Holes
malware.news · 63d ago · August 11th, 2026
-
update from blog.qualys.com
Microsoft Patch Tuesday, August 2026 Security Update Review
blog.qualys.com · 63d ago · August 11th, 2026
As attackers continue to exploit unpatched vulnerabilities, timely patching remains critical for reducing exposure and strengthening enterprise security. As always, timely patch deployment is crucial to reduce exposure and ensure systems remain resilient against exploitation attempts.
-
update from malware.news
Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities
malware.news · 63d ago · August 12th, 2026
A Use After Free vulnerability could allow an authorized attacker to elevate privileges locally. This vulnerability has a CVSS base score of 7.0. Microsoft considers exploitation of the following vulnerabilities more likely. A Heap-based Buffer Overflow could allow an unauthorized attacker to execute code over an adjacent network.
-
mentioned by malware.news
Security Alert: Microsoft Releases August 2026 Security Updates
malware.news · 63d ago · August 12th, 2026
-
mentioned by malware.news
August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs
malware.news · 63d ago · August 12th, 2026
-
update from gbhackers.com
Microsoft Patch Tuesday Update August 2026 Fixes Actively Exploited Windows Zero-Day
gbhackers.com · 62d ago · August 12th, 2026
A total of 394 distinct flaws were documented in this release. Among these vulnerabilities, three zero-day issues are particularly noteworthy.
-
update from cyberpress.org
Microsoft Patches 398 Windows Flaws Including Actively Exploited WinSock Zero-Day
cyberpress.org · 62d ago · August 12th, 2026
The actively exploited issue, tracked as CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock (AFD.sys), a kernel-mode component responsible for handling socket operations. Microsoft Patches 398 Windows Flaws Microsoft rates the flaw as Important, but its confirmed exploitation and potential to provide SYSTEM-level privileges make it the highest-priority remediation target in this month’s cycle. Such local privilege-escalation bugs are commonly chained with phishing, malicious documents, browser exploits, or remote-access compromises, converting an initial foothold into full administrative access. However, observed activity involving the WinSock zero-day in the Lazarus Group’s Operation Dream Job campaign underscores the value of i
-
update from cyberpress.org
Microsoft Outlook RCE Flaw Lets Attackers Execute Code via Malicious Office Files
cyberpress.org · 62d ago · August 12th, 2026
Microsoft has disclosed a high-severity remote code execution vulnerability in Outlook that could allow threat actors to run malicious code on targeted devices by delivering specially crafted Office files. Microsoft Outlook RCE Flaw CVE-2026-70329 is an integer overflow or wraparound vulnerability, categorized as CWE-190. This weakness occurs when software performs a calculation that produces a value exceeding the storage capacity of its assigned integer type. Instead of handling the excessive value safely, the application may wrap it to an unexpected smaller or negative number. In security-sensitive code paths, such behavior can result in memory corruption, incorrect validation, or program execution. Successful exploitation requires no prior privileges on the victim’s system, and the attack complexity is considered low. An attacker must send a malicious Office file to a target and convince that individual to open it. This makes phishing emails, document-sharing lures, and compromised business communication accounts likely delivery mechanisms. A threat actor could disgui
-
update from gbhackers.com
Microsoft Outlook RCE Vulnerability Lets Attackers Execute Code Remotely
gbhackers.com · 62d ago · August 12th, 2026
The flaw falls under […] The post Microsoft Outlook RCE Vulnerability Lets Attackers Execute Code Remotely appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from malware.news
Patch Tuesday: Update now to fix 421 flaws, including three zero-days
malware.news · 62d ago · August 12th, 2026
How to apply patches and check if you’re protected These updates fix security problems and help keep your Windows PC protected. Select Windows Update (usually at the bottom of the menu on the left). If you’ve enabled Get the latest updates as soon as they’re available under More options , you may be prompted to restart immediately to complete the update. Otherwise, continue to the next step.
-
mentioned by gbhackers.com
Microsoft Exchange Server Vulnerabilities Allow DoS, Privilege Escalation, and RCE
gbhackers.com · 61d ago · August 13th, 2026
-
mentioned by malware.news
Windows 10 KB5120249, Windows 11 KB5121003 security updates
malware.news · 61d ago · August 13th, 2026
-
update from blog.qualys.com
CVE-2026-68820 is in KEV. Here Is What CISA BOD 26-04 Actually Requires Now
blog.qualys.com · 56d ago · August 18th, 2026
CISA BOD 26-04 introduces risk-based remediation timelines ranging from 3 to 14 days, increasing the pressure on teams to move quickly from patch availability to verified remediation. Qualys AI-Powered Patch Reliability Scoring rates the KB5121003 and KB5120249 updates high for reliability, while Qualys TruRisk Eliminate helps teams deploy the update, enforce the required reboot, and verify that remediation is complete within the required timeline. Qualys TruRisk Eliminate helps teams respond to patches that can’t wait, deadlines that don’t bend, and environments where standard staged rollouts collapse under the timeline. CVE-2026-68820 shows why this matters. That gives IT Ops 3 to 14 days to test the patch, deploy it across affected endpoints, complete the required reboots, and verify that remediation is complete.