Microsoft has released its monthly security updates for August 2026, addressing a total of 421 vulnerabilities across various products. Of these, 62 are classified as "critical" by Microsoft. The company confirmed that one of the vulnerabilities, CVE-2026-68820, an elevation of privilege flaw in the Windows Ancillary Function Driver for WinSock, has already been exploited in the wild. This vulnerability, with a CVSS base score of 7.0, is a Use After Free issue that could allow an authorized local attacker to elevate privileges.
Among the 62 critical vulnerabilities, 40 are remote code execution (RCE) vulnerabilities. Microsoft has highlighted several vulnerabilities it deems more likely to be exploited. These include CVE-2026-62893, an RCE in Windows Deployment Services TFTP Server with a CVSS score of 9.8, which is a Use After Free flaw enabling unauthorized network code execution. Another is CVE-2026-65665, an RCE in Microsoft SharePoint Server (CVSS 8.8) stemming from Deserialization of Untrusted Data, allowing authorized network code execution. CVE-2026-62823, an RCE in Windows DHCP Server (CVSS 8.8), is a Heap-based Buffer Overflow that could enable unauthorized code execution over an adjacent network.
Other vulnerabilities considered less likely to be exploited but still significant include CVE-2026-62830, an elevation of privilege flaw in Azure SRE Agent (CVSS 9.9) due to Missing Authorization, allowing authorized network privilege escalation. CVE-2026-50516 is an elevation of privilege vulnerability in Microsoft Azure Kubernetes Service (CVSS 9.4) caused by Missing Authentication for Critical Function, which could allow an unauthorized network attacker to elevate privileges.
Microsoft Excel is affected by three RCE vulnerabilities: CVE-2026-68794 (Heap-based Buffer Overflow), CVE-2026-68816 (Stack-based Buffer Overflow), and CVE-2026-68804 (Numeric Truncation Error and Heap-based Buffer Overflow). All three have a CVSS score of 7.8 and could allow an unauthorized local attacker to execute code. Microsoft Exchange Server has an elevation of privilege vulnerability, CVE-2026-62911 (CVSS 8.0), an Authentication Bypass by Capture-replay issue allowing authorized network privilege escalation.
A total of nine RCE vulnerabilities affect Microsoft Office, all with a CVSS base score of 7.8, except for CVE-2026-70130 which has a CVSS score of 8.4. These include CVE-2026-63515 (Out-of-bounds Read and Integer Underflow), CVE-2026-65657 (Use After Free), CVE-2026-63532 (Integer Overflow and Heap-based Buffer Overflow), CVE-2026-64898 (Heap-based Buffer Overflow and Integer Overflow), CVE-2026-64903 (Integer Overflow and Heap-based Buffer Overflow), CVE-2026-64909 (Integer Underflow, Out-of-bounds Read, and Heap-based Buffer Overflow), CVE-2026-64910 (Untrusted Pointer Dereference), CVE-2026-64911 (Integer Overflow and Heap-based Buffer Overflow), and CVE-2026-70130 (Heap-based Buffer Overflow). These could allow an unauthorized local attacker to execute code.
The Microsoft Office Graphics Component is impacted by five RCE vulnerabilities, all with a CVSS score of 7.8, enabling unauthorized local code execution. These are CVE-2026-63513 (Heap-based Buffer Overflow), CVE-2026-63519 (Heap-based Buffer Overflow), CVE-2026-65664 (Heap-based Buffer Overflow), CVE-2026-63526 (Stack-based Buffer Overflow), and CVE-2026-66807 (Stack-based Buffer Overflow). Microsoft Office Word also has three RCE vulnerabilities (CVSS 7.8) that could allow unauthorized local code execution: CVE-2026-63518 (Heap-based Buffer Overflow), CVE-2026-63525 (Numeric Truncation Error), and CVE-2026-64907 (Stack-based Buffer Overflow).
Microsoft SharePoint Server has two elevation of privilege vulnerabilities, CVE-2026-62827 (Improper Authentication) and CVE-2026-64921 (Missing Authentication for Critical Function), both with a CVSS score of 8.8, allowing authorized network privilege escalation. A remote code execution vulnerability, CVE-2026-62824, affects Remote Desktop Client (CVSS 8.8) and is a Stack-based Buffer Overflow, allowing unauthorized network code execution. Windows Active Directory Certificate Services (AD CS) has an RCE vulnerability, CVE-2026-62818 (CVSS 8.8), a Use After Free flaw enabling authorized network code execution.
Windows DNS Server is affected by three RCE vulnerabilities: CVE-2026-62817 (Out-of-bounds Write, CVSS 8.8) allowing unauthorized code execution over an adjacent network; CVE-2026-62820 (Race Condition, CVSS 8.1) allowing unauthorized network code execution; and CVE-2026-62878 (Stack-based Buffer Overflow, CVSS 9.8) allowing unauthorized network code execution. Windows Device Health Attestation (DHA) has two RCE vulnerabilities, CVE-2026-66802 (Race Condition and Use After Free) and CVE-2026-71331 (Integer Overflow and Heap-based Buffer Overflow), both with a CVSS score of 8.1, allowing unauthorized network code execution.
Windows GDI+ is affected by two RCE vulnerabilities: CVE-2026-62890 (Heap-based Buffer Overflow, CVSS 7.8) allowing authorized local code execution; and CVE-2026-62822 (Integer Overflow and Heap-based Buffer Overflow, CVSS 8.8) allowing unauthorized network code execution. Finally, Windows Key Guard has an elevation of privilege vulnerability, CVE-2026-66799 (Heap-based Buffer Overflow, CVSS 7.8), allowing authorized local privilege escalation. Windows Reliable Multicast Transport Driver (RMCAST) has an RCE vulnerability, CVE-2026-62816 (Heap-based Buffer Overflow and Integer Overflow, CVSS 8.8), allowing unauthorized code execution over an adjacent network.
