Microsoft’s August 2026 Patch Tuesday addresses 421 vulnerabilities across its product line, including 62 rated as critical. The update package, while smaller than July’s record release, remains one of the largest Patch Tuesday batches to date. Among the fixes are three zero-day vulnerabilities, one of which has been actively exploited in the wild by the Lazarus group.
The exploited vulnerability, identified as CVE-2026-62893, is an unauthenticated remote code execution (RCE) flaw in the Trivial File Transfer Protocol (TFTP) server component of Windows Deployment Services (WDS). This critical flaw, with a CVSS score of 9.8, typically affects enterprise and school networks where WDS is deployed, and could facilitate lateral movement within a compromised network. TFTP usually operates on UDP port 69 and lacks built-in authentication.
Another significant vulnerability addressed is CVE-2026-62832, an elevation of privilege (EoP) flaw in the Windows User Profile Service. This issue, dubbed "LegacyHive" by researchers, had a limited public proof-of-concept (PoC) released in July. The PoC demonstrated how a local authenticated attacker could manipulate the service’s registry hive handling to load another user’s hive, potentially including an administrator’s. While the public demonstration required existing user credentials, the availability of code and the broad presence of the Windows User Profile Service make this a prime target for future exploitation attempts.
The August update also includes a newly completed unauthenticated SharePoint remote code execution chain and a potentially wormable vulnerability in Windows DNS Server, both of which are likely to attract attacker interest. Additionally, Microsoft has released fixes for 48 remote code execution vulnerabilities affecting various Office applications and components, including Excel, Word, Outlook, PowerPoint, and the Office graphics component. These document-borne vulnerabilities are particularly attractive to phishing operators due to the common use of email attachments and shared documents as delivery mechanisms.
Users are advised to apply these updates promptly to secure their systems. The update process involves navigating to Windows Update in the Settings menu, checking for updates, and installing any available patches. A system restart may be required to complete the installation.
