Microsoft Patch Tuesday August 2026 - Priority Fixes

Microsoft's August 2026 Patch Tuesday delivers an extensive batch of security updates, addressing 421 vulnerabilities across its product ecosystem. These include 62 rated critical, 358 marked important, and one moderate in severity. The vulnerabilities span various categories: 111 involve Remote Code Execution (RCE), 177 Elevation of Privilege, 85 Information Disclosure, 12 Denial of Service, 11 Security Feature Bypass, 21 Spoofing, and 4 Tampering issues. Beyond its own products, Microsoft also released patches for 2 non-Microsoft CVEs, pushing the total count of vulnerabilities addressed this month to 423. Notably, 39 of these CVEs are considered at risk of active exploitation, underscoring the urgency of prompt patch deployment.

The most urgent fix this month is for the actively exploited zero-day, CVE-2026-68820, a use-after-free bug in the Windows Ancillary Function Driver for WinSock that lets an already-logged-in attacker gain higher privileges on a device. The flaw is being exploited in the wild, and the Lazarus group has been using it as part of Operation Dream Job, with its latest campaign targeting defense organizations in Europe and India.

Two publicly known flaws round out the list of already-disclosed issues. CVE-2026-62832 affects the Windows User Profile Service, where a link-following flaw allows privilege escalation, while CVE-2026-72971 hits the Container Isolation FS Filter Driver (unionfs.sys), letting an attacker tamper with the system through the same kind of link-resolution weakness.

Microsoft Office SharePoint sees three notable bugs this cycle. A cross-site scripting issue (CVE-2026-70355) can be used to escalate privileges over a network, a deserialization flaw (CVE-2026-65665) opens the door to remote code execution, and a separate input-validation weakness (CVE-2026-63520) also allows remote code execution without needing prior access.

Developer tools weren't spared either. GitHub Copilot and Visual Studio Code carry an OS command injection bug (CVE-2026-70335) that lets a local attacker escalate privileges, along with two authorization-related flaws in VS Code (CVE-2026-69278 and CVE-2026-58650) that allow attackers to slip past security protections locally.

A large chunk of this month's fixes are privilege-escalation bugs buried deep in Windows components, mostly use-after-free and heap overflow issues that require local access. These include repeated flaws in the WinSock driver (CVE-2026-70307, CVE-2026-61348), Windows Kernel (CVE-2026-62788, CVE-2026-61930, CVE-2026-61929, CVE-2026-62737), Win32k (CVE-2026-65775, CVE-2026-62712), the Desktop Window Manager and DWM Core Library (CVE-2026-65788, CVE-2026-62888), and HTTP.sys (CVE-2026-62741, CVE-2026-62735). Similar issues also turn up in the Cross Device Service, Kerberos, Remote Access Connection Manager, the Cloud Files Mini Filter Driver, Digest Authentication, the Program Compatibility Assistant Service, the MIDI Service Module, Windows Installer, and the Accessibility Infrastructure component (ATBroker.exe).

On the network-facing side, a handful of bugs stand out for allowing remote code execution without any local access needed. Windows Deployment Services has a use-after-free flaw (CVE-2026-62893), the Windows DHCP Server carries a heap overflow reachable from an adjacent network (CVE-2026-62823), Microsoft's HPC Pack has a deserialization bug (CVE-2026-59124), and Microsoft QUIC includes a use-after-free issue (CVE-2026-62815) that could also lead to code execution.

Finally, a few cloud and service-level issues round out the update: HPC Pack also has a privilege escalation flaw tied to unnecessary permissions (CVE-2026-59133), Windows TCP/IP has a null pointer bug that can crash a system remotely (CVE-2026-59132), Microsoft 365 Admin Center has a signature verification flaw allowing privilege escalation (CVE-2026-62873), and Azure SQL Database has an authentication weakness that could let an attacker gain elevated access over the network (CVE-2026-56162).