Microsoft's August 2026 Patch Tuesday release addresses 421 vulnerabilities, including 62 critical and 357 important-severity issues across a broad range of products and services. This month's updates include fixes for three zero-day vulnerabilities, one of which has been actively exploited in the wild, while the other two were publicly disclosed prior to the patch release.
The exploited zero-day vulnerability is CVE-2026-68820, an elevation of privilege flaw in the Windows Ancillary Function Driver for WinSock. This use-after-free vulnerability could allow an authenticated attacker to gain SYSTEM privileges locally.
The two publicly disclosed zero-day vulnerabilities are CVE-2026-72971, a tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), and CVE-2026-62832, an elevation of privilege vulnerability in the Windows User Profile Service. Both are link-following flaws that could allow an authenticated attacker to perform local tampering or gain ADMINISTRATOR privileges, respectively.
The August 2026 patches cover vulnerabilities in various Microsoft components, including Windows HTTP.sys, Windows Hyper-V, Windows NTFS, Desktop Window Manager, Dynamics Business Central, GitHub Copilot and Visual Studio Code, and Microsoft Exchange Server. Microsoft Edge (Chromium-based) was not included in this month's updates.
Among the critical vulnerabilities addressed are numerous remote code execution (RCE) and elevation of privilege (EoP) flaws. Several RCE vulnerabilities affect Microsoft Office, including CVE-2026-63515, CVE-2026-63513, CVE-2026-64910, and CVE-2026-64909, which involve out-of-bounds reads, heap-based buffer overflows, untrusted pointer dereferences, and integer underflows, potentially allowing unauthenticated attackers to execute code locally or over a network. Additional Office RCEs include CVE-2026-63532, CVE-2026-64903, CVE-2026-64911, CVE-2026-64898, CVE-2026-70130, CVE-2026-66807, and CVE-2026-63526, many of which are heap-based or stack-based buffer overflows or integer overflows.
Other critical RCE vulnerabilities include CVE-2026-62815 in Microsoft QUIC, a use-after-free flaw; CVE-2026-62816 in Windows Reliable Multicast Transport Driver (RMCAST), a heap-based buffer overflow; and CVE-2026-62817 in Windows DNS Server, an out-of-bounds write flaw. Azure Confidential Ledger also has a critical RCE, CVE-2026-68823, and Azure Service Bus has CVE-2026-50515, a deserialization of untrusted data RCE. Windows Device Health Attestation (DHA) has two critical RCEs: CVE-2026-71331, an integer overflow, and CVE-2026-66802, a race condition.
Critical elevation of privilege vulnerabilities include CVE-2026-49163 in Application Insights Profiler, a path traversal flaw; CVE-2026-50481 in Azure Active Directory; CVE-2026-63522 and CVE-2026-56162 in Azure SQL Database, with the latter being an improper authentication flaw allowing unauthenticated attacks; CVE-2026-62836 in Azure SQL Managed Instance, also allowing unauthenticated attacks; and CVE-2026-62830 in Azure SRE Agent. Microsoft 365 Admin Center has CVE-2026-62873, and Microsoft Azure Kubernetes Service has CVE-2026-50516, a missing authentication flaw. Microsoft Entra Provisioning Service has CVE-2026-59115, and Microsoft Exchange Server has CVE-2026-62911.
A critical spoofing vulnerability, CVE-2026-62869, affects Azure Entra ID. An information disclosure vulnerability, CVE-2026-56161, is noted in Azure Logic Apps, though specific details were not provided by Microsoft.
The vulnerabilities are categorized as 20 spoofing, 12 denial of service, 178 elevation of privilege, 84 information disclosure, 109 remote code execution, and 11 security feature bypass issues. Timely deployment of these patches is crucial for organizations to mitigate potential exploitation attempts.
