Microsoft’s August 2026 Patch Tuesday landed on August 11 with 421 CVEs fixed in a single release, according to SecurityWeek’s count of the disclosure — a tally independently matched by Splashtop, which also counted 421 CVEs spanning Windows, Office, Azure, Exchange, SharePoint, and Defender, and by Malwarebytes, whose own August 2026 roundup arrived at the identical 421-CVE figure. Other outlets tracking the same release, including BleepingComputer and The Hacker News, put the figure closer to 398-400, Security Affairs’ own tally landed at the same 398 CVEs for the August 2026 release, and Tenable’s own August 2026 advisory lands at 398 CVEs, with 42 rated Critical and just 1 Moderate, a gap that comes down to how each publication counts advisory updates versus net-new CVE identifiers. Whichever number you use, one detail is not in dispute: CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (afd.sys), is already being exploited in the wild, and it is the only bug in this month’s batch that Microsoft has confirmed as an active zero-day.
For IT administrators, the August 2026 Patch Tuesday is less about the raw CVE count and more about triage. Sixty-two of the fixes carry a Critical rating — a figure SANS ISC corroborated in its own August 2026 tally of 418 vulnerabilities, with 62 Critical, 1 confirmed exploited, and 2 publicly disclosed — and three qualify as zero-days under Microsoft’s own definition (one exploited, two publicly disclosed before a patch existed). Roboshadow’s independent count landed close behind at roughly 400 vulnerabilities with 42 flagged Critical and the same 3 zero-days, released August 11, 2026. Senserva counted the release differently still, tallying 67 separate updates fixing 751 CVEs once cumulative rollups and out-of-band advisories are folded into the total, illustrating how far the headline number can swing depending on whether an outlet counts unique CVE identifiers or bundled update packages. Several of the remote code execution bugs sit in components, like Windows DNS Server and Microsoft QUIC, that face the open internet with no authentication required. This piece breaks down what shipped, why the WinSock flaw matters more than its CVSS score suggests, and how this release compares to the two Patch Tuesdays that came before it this summer.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Shipped in the August 2026 Patch Tuesday
Microsoft’s August 2026 Patch Tuesday covers the usual sweep of products: Windows 10 and 11, Windows Server, Exchange Server, Microsoft Office, SharePoint, Defender, Azure components, and a handful of developer tools. CrowdStrike’s breakdown of the release tallies 62 vulnerabilities rated Critical alongside 349 rated Important or lower, a split that tracks with recent months but still leaves defenders with a long list to work through. CrowdStrike’s own zero-day accounting flags 1 confirmed exploited vulnerability and 3 separate publicly disclosed zero-days in the August 2026 batch, a slightly wider count than some other vendors’ tallies but one that reinforces the same triage priority: the exploited bug first, the disclosed ones close behind. Qualys’s own analysis reached a nearly identical conclusion, counting 421 vulnerabilities overall — 62 Critical and 357 Important — with 3 zero-days broken down the same way Microsoft describes them: 2 publicly disclosed and 1 actively exploited. Splashtop’s product-level breakdown put SharePoint Server’s share at 30 vulnerabilities on its own — a figure SecurityWeek’s own August 11, 2026 count corroborated separately — while Dark Reading’s count of the same release found 98 vulnerabilities in the mainstream Office suite plus another 98 specifically affecting Office 2016, a reminder of how much of this month’s total sits outside the Windows kernel entirely. The bulk of the Critical-rated bugs are remote code execution flaws, the category security teams prioritize first because they let an attacker run arbitrary code without needing to already have a foothold on the machine.
What separates this release from a routine monthly patch cycle is the presence of an actively exploited zero-day. Microsoft defines a zero-day as a vulnerability that is either publicly disclosed or under active attack before an official fix ships, and this month’s release contains three that meet that bar — a count BleepingComputer independently confirmed in its own August 2026 report, which tallied 400 flaws fixed alongside the same 3 zero-days, and one Tenable’s own August 11, 2026 advisory corroborated separately, likewise putting the zero-day count for the release at 3. One is being exploited right now, a status CrowdStrike’s research team also confirmed in its own August 2026 analysis. The other two were publicly disclosed ahead of the patch but, as of this writing, have not been confirmed as exploited in live attacks.
CVE-2026-68820: The WinSock Zero-Day Under Active Attack
CVE-2026-68820 sits in afd.sys, the Ancillary Function Driver that underpins the Windows Sockets (WinSock) networking stack. It’s a use-after-free vulnerability, a class of memory corruption bug where a program keeps using a reference to memory that has already been freed, which an attacker can manipulate to execute their own code in that freed space. In this case, the flaw lets a local attacker who already has some level of access on a machine escalate their privileges to SYSTEM, the highest privilege tier on Windows.
Microsoft rates CVE-2026-68820 at CVSS 7.0, which lands in the “Important” tier rather than “Critical” under Microsoft’s own severity scale, per Tenable’s advisory listing — a score Daily.dev’s own coverage of the August 2026 release independently confirmed. That score reflects the fact that it’s a local, not remote, vulnerability. But CVSS scores measure technical severity, not real-world risk, and this is a textbook case of the gap between the two. Privilege escalation bugs like this one are the second half of nearly every serious intrusion: an attacker gets a low-privileged foothold through phishing, a web app flaw, or a leaked credential, then uses something like CVE-2026-68820 to jump from “regular user” to “SYSTEM” and take full control of the box. Security researchers who track exploitation chains note that WinSock and other low-level networking drivers are attractive escalation targets precisely because they run in kernel mode and are present on every Windows install by default.
Because Microsoft has confirmed active exploitation, CVE-2026-68820 is a prime candidate for the CISA Known Exploited Vulnerabilities catalog, which typically triggers a mandatory patching deadline for U.S. federal civilian agencies. Enterprises outside that mandate should treat the same signal as an urgent internal deadline, since public confirmation of in-the-wild exploitation tends to accelerate copycat activity from other threat actors within days.
Critical Remote Code Execution Flaws: DNS Server, QUIC, TFTP, and HPC Pack
The scarier bugs in this release, at least on paper, are the unauthenticated remote code execution flaws. CVE-2026-62878, in Windows DNS Server, is a stack-based buffer overflow that’s remotely reachable, requires no authentication, and needs no user interaction to trigger. That combination, no login, no click, network-reachable, is the profile security teams associate with wormable vulnerabilities: the kind that can, in theory, spread from one exposed server to another without any human involvement.
CVE-2026-62815 carries the same risk profile but sits in Microsoft QUIC, the transport protocol increasingly used underneath modern Windows networking and HTTP/3 traffic. As more infrastructure adopts QUIC for its lower latency, a remote, unauthenticated code execution flaw in Microsoft’s implementation becomes a bigger blast radius than it would have been two or three years ago, before QUIC saw wide production deployment.
Rounding out the RCE list, CVE-2026-62893 affects the TFTP server component of Windows Deployment Services and, per RoboShadow’s advisory, actually carries the highest severity score in this month’s release at CVSS 9.8, while CVE-2026-59124 hits Microsoft HPC Pack, used for high-performance computing clusters. Both are narrower in exposure than the DNS Server and QUIC bugs since fewer organizations run those specific services, but where they are deployed, they tend to sit in privileged, business-critical infrastructure, and CVE-2026-62893’s near-maximum CVSS score means it deserves a closer look than its lower public profile might suggest.
The Publicly Disclosed Zero-Days: User Profile Service and Exchange
Beyond the actively exploited WinSock flaw, Microsoft flagged two vulnerabilities as publicly disclosed before a patch was available, meeting its zero-day threshold even without confirmed in-the-wild attacks. Elevation-of-privilege bugs carry an outsized share of this release’s overall volume — Dark Reading counted 180 EoP vulnerabilities fixed across the August 2026 batch — and CVE-2026-62832, in the Windows User Profile Service, lets an attacker abuse link resolution handling to gain administrator rights. SecurityWeek’s coverage also calls out CVE-2026-62911, an elevation-of-privilege flaw in Exchange Server, as one worth watching closely because, like the WinSock bug, it’s the kind of vulnerability that becomes dangerous once chained with a remote entry point.
Public disclosure before a patch exists is its own risk category. It means proof-of-concept details, or at minimum a description specific enough to reverse-engineer, were circulating before defenders had a fix to apply. Attackers routinely monitor disclosure feeds and CVE databases specifically to catch this window, so the absence of confirmed active exploitation as of August 15, 2026 shouldn’t be read as low risk. It’s more accurately read as “not yet observed,” a status that can change within days of a Patch Tuesday.
Why Independent Vendor Confirmation Matters for These Two CVEs
One detail that separates this Patch Tuesday from a routine high-volume release is how many independent security vendors converged on the same two CVEs as the ones worth an accelerated patch cycle. Sophos’s own analysis of the August 2026 release corroborated SecurityWeek’s tally of 421 CVEs and the August 11, 2026 ship date, breaking that total down as patches spanning 29 distinct product families, which matters because it confirms the widely cited figure as a number two separate research teams arrived at independently, rather than a single outlet’s count that other publications simply repeated without verifying.
The corroboration carries more weight on the exploitation side. CVE-2026-68820, the WinSock use-after-free bug, was not flagged by SecurityWeek alone. Splashtop and Secarma each published their own advisories confirming active exploitation in the wild, meaning three separate security organizations, working from different telemetry and research pipelines, reached the same conclusion about the same driver in the same patch cycle. That kind of convergence is a stronger signal than any single vendor’s severity rating, and it is the reason security teams should treat CVE-2026-68820 as a same-week patching priority rather than waiting for a CISA Known Exploited Vulnerabilities catalog entry to make the exploitation status official.
CVE-2026-62832 tells a related but distinct story. Rapid7 and Splashtop both flagged the Windows User Profile Service flaw as publicly known, alongside SecurityWeek’s own coverage, without any of the three confirming active exploitation as of this writing. Rapid7’s broader analysis of the release counted 421 vulnerabilities total, including 236 specifically in Windows components — a figure SecurityWeek’s own August 2026 count reached independently, while Splashtop broke that same fix down into 32 distinct Windows updates addressing those 236 vulnerabilities — underscoring just how much of this month’s patch load traces back to the operating system rather than the surrounding product suite. That distinction, publicly known versus actively exploited, is not one security teams should treat as a reason to deprioritize the fix. Public disclosure means enough technical detail is already circulating for a motivated attacker to build a working exploit without repeating the original research, and CVE-2026-68820’s own trajectory this cycle is a reminder of how quickly a publicly known bug can flip to a confirmed one.
August 2026 Patch Tuesday: Highest-Priority CVEs at a Glance
| CVE ID | Component | Vulnerability Type | Attack Vector | Status |
|---|---|---|---|---|
| CVE-2026-68820 | WinSock (afd.sys) | Use-after-free / EoP | Local, CVSS 7.0 | Actively exploited |
| CVE-2026-62878 | Windows DNS Server | Stack buffer overflow / RCE | Remote, unauthenticated | Critical, not yet exploited |
| CVE-2026-62815 | Microsoft QUIC | Remote code execution | Remote, unauthenticated | Critical, not yet exploited |
| CVE-2026-62893 | Windows Deployment Services (TFTP) | Remote code execution | Remote | Critical, not yet exploited |
| CVE-2026-59124 | Microsoft HPC Pack | Remote code execution | Remote | Critical, not yet exploited |
| CVE-2026-62832 | Windows User Profile Service | Elevation of privilege | Local | Publicly disclosed pre-patch |
| CVE-2026-62911 | Exchange Server | Elevation of privilege | Network | Flagged for priority patching |
How August Compares to June and July’s Patch Tuesdays
Zoom out from any single month and a pattern emerges: Microsoft’s 2026 Patch Tuesday releases keep landing with large CVE counts and multiple zero-days almost every cycle. June 2026 shipped 206 fixes with 3 zero-days. July 2026 jumped to 570 CVEs with 2 zero-days, one of the largest single-month totals Microsoft has published in recent memory. August settled in the middle at 421, still with 3 zero-days flagged, one of them under active attack.
| Month | CVEs Patched | Zero-Days | Actively Exploited |
|---|---|---|---|
| June 2026 | 206 | 3 | Yes |
| July 2026 | 570 | 2 | Yes |
| August 2026 | 421 (398-400 per some counts) | 3 | Yes (CVE-2026-68820) |
Three consecutive months with a confirmed actively exploited zero-day is not typical even by recent standards, and it says less about Microsoft’s code quality slipping and more about how much research and criminal attention is now aimed at Windows kernel and networking components specifically because privilege escalation bugs are the missing piece in so many ransomware and espionage intrusion chains.
Why WinSock and Kernel Drivers Keep Showing Up in Patch Tuesday
WinSock isn’t a new attack surface. Ancillary Function Driver vulnerabilities have appeared in Patch Tuesday releases repeatedly over the past several years, and CVE-2026-68820 is the latest in that lineage rather than an outlier. The driver runs in kernel mode, handles socket operations for essentially every networked application on Windows, and has decades of legacy code paths that predate modern secure-coding practices. That combination, broad exposure plus old code, makes it a recurring target for researchers on both sides: the defenders looking for bugs to report, and the attackers looking for bugs to weaponize before anyone reports them.
Use-after-free bugs specifically remain one of the most common memory-safety issues Microsoft patches month over month, which is part of why the company has spent the past several years pushing Rust adoption in parts of the Windows kernel, precisely to eliminate this bug class at compile time rather than catching it after the fact through patching. That migration is gradual, and afd.sys, like much of the networking stack, is still primarily C and C++, which keeps this category of vulnerability in the pipeline for the foreseeable future.
Detecting Post-Exploitation Activity After a WinSock Compromise
Because CVE-2026-68820 is a local privilege escalation bug rather than a remote one, detection strategy looks different than it would for an internet-facing RCE. The flaw only becomes useful to an attacker after they already have some foothold on the machine, so the highest-value monitoring window is the moment a low-privileged process suddenly gains SYSTEM-level capability. Security teams running Sysmon or equivalent EDR telemetry should watch for anomalous process creation events, Sysmon Event ID 1, where a normally unprivileged parent process spawns a child running under a SYSTEM token, alongside Windows Security Event ID 4672, which logs when special privileges are assigned to a new logon and can surface an escalation attempt before an attacker moves laterally.
Kernel-mode use-after-free bugs also tend to leave a noisier trail than their user-mode counterparts before an exploit becomes fully reliable. Failed or partial exploitation attempts against afd.sys can manifest as unexpected crashes or blue screens referencing the driver, and Windows Error Reporting logs that mention afd.sys around the time of a crash are worth cross-referencing against patch deployment records. An endpoint that crashed with an afd.sys fault before the August 11, 2026 update installed is a reasonable candidate for deeper forensic review, since crash artifacts sometimes predate a successful exploitation chain by days or weeks while an attacker tunes their approach against a specific build.
None of this replaces patching, but for organizations that cannot push the August update to every endpoint on day one, the gap between disclosure and full deployment is exactly when telemetry-based monitoring earns its keep. It gives defenders a chance to catch exploitation attempts against still-vulnerable machines rather than discovering the compromise after an attacker already has SYSTEM-level control and has moved on to establishing persistence elsewhere on the network.
Enterprise Patch Management: What to Prioritize First
With 421 CVEs to work through, most security teams can’t patch everything on day one, so prioritization matters. The consensus from CrowdStrike, SecurityWeek, and BleepingComputer’s coverage points to the same order of operations: patch CVE-2026-68820 first since it’s already being exploited, then move to the unauthenticated remote code execution bugs in DNS Server and QUIC given their internet-facing exposure, then address the publicly disclosed elevation-of-privilege flaws in User Profile Service and Exchange, and finally work through the remaining Critical-rated bugs before Important and Moderate ones.
Administrators managing Windows Server fleets can pull the exact list of applicable updates and their KB numbers through the Microsoft Update Catalog or via PowerShell against WSUS or Microsoft Endpoint Configuration Manager. For Windows 11 24H2, PatchTuesday.com catalogs this release as KB5121003, which brings the build to 26100.9168; Windows Server 2022 shipped as KB5120242, moving that build to 20348.5499, while Windows 11 23H2 moved to build 22631.7517 via KB5120240, per Ghosxt’s build tracking of the August 2026 cycle; Windows 11 26H1 also received its own August 2026 cumulative update, bringing that build to 28000.2704, according to ManageEngine’s patch tracking. Azure customers have their own line item to track separately: Microsoft Learn lists the August 11, 2026 Azure Guest OS rollup as version 5.121, shipped under KB5120418, alongside the 17 Azure-specific vulnerabilities SecurityWeek counted in this release, which cloud administrators should confirm alongside the on-premises fixes when reconciling patch coverage across hybrid environments. A simple query to confirm which August 2026 updates have already deployed to a given machine looks like this:
Get-HotFix | Where-Object {$_.InstalledOn -ge (Get-Date "2026-08-11")} | Select-Object HotFixID, Description, InstalledOnFor organizations without automatic patch deployment already enforced, the standard advice applies: test the cumulative update against a representative sample of endpoints and servers, prioritize internet-facing DNS and any QUIC-dependent services for accelerated rollout, and confirm the fix for CVE-2026-68820 lands on every workstation image before scheduling anything else.
Market Impact: Vulnerability Management and Cyber Insurance
Every large Patch Tuesday cycle produces a small ripple through the vulnerability management and cyber insurance markets. Vendors that sell patch orchestration, attack surface management, and exposure prioritization tools use these releases as proof points for their platforms, since the core sales pitch, “you can’t manually triage 421 CVEs every month,” gets easier to make with each oversized release. Security teams already using platforms from vendors compared in our Microsoft Sentinel vs. Splunk vs. Elastic breakdown lean on automated correlation to flag which of the 421 fixes actually touch their exposed asset inventory, rather than triaging the full CVE list by hand.
On the insurance side, underwriters increasingly ask for evidence of patch cadence and mean-time-to-remediate as part of renewal questionnaires. A month with a confirmed actively exploited zero-day like CVE-2026-68820 tends to sharpen those questions, particularly for policyholders running large Windows Server estates in regulated industries like healthcare and finance, where an unpatched privilege escalation bug sitting for weeks after disclosure is exactly the kind of gap claims adjusters look for after a breach.
Historical Context: A Pattern of Rising Patch Volume
Patch Tuesday has grown heavier almost every year since Microsoft standardized the monthly release cadence in 2003. Early releases in the mid-2000s routinely covered a dozen or two dozen bugs. By the early 2020s, monthly totals in the 60-100 range were common. The jump to releases regularly exceeding 200, 400, or even 570 CVEs, as seen across June, July, and August 2026, reflects both a genuinely larger and more complex Windows codebase and a much bigger, more organized community of security researchers, bug bounty hunters, and red teams actively hunting for flaws across Microsoft’s expanding product surface, which now spans Windows, Azure, Exchange, Office, and dozens of developer and enterprise tools under one release umbrella.
That volume growth is also why the zero-day count matters more than the total CVE count for prioritization purposes. A team that tried to treat every one of 421 fixes as equally urgent would burn weeks on regression testing alone. Watching for Microsoft’s own “exploited” and “publicly disclosed” labels, as this release’s WinSock, User Profile Service, and Exchange bugs carry, remains the fastest signal for where limited patching hours should go first.
Predictions: Where Patch Tuesday Goes From Here
- Zero-day counts stay elevated through year-end. With three straight months of confirmed active exploitation heading into fall 2026, expect September and October releases to carry at least one exploited zero-day each, continuing the trend rather than breaking it.
- CISA adds CVE-2026-68820 to its Known Exploited Vulnerabilities catalog within days. Given the confirmed active exploitation, federal civilian agencies should expect a Binding Operational Directive deadline, typically two to three weeks out, forcing accelerated patching across government networks.
- Kernel-mode memory safety bugs keep appearing despite Rust migration efforts. Microsoft’s push to rewrite parts of the Windows kernel in memory-safe languages is real but incremental; legacy drivers like afd.sys will keep surfacing use-after-free and buffer overflow bugs for at least another two to three years.
- QUIC-related vulnerabilities become a recurring Patch Tuesday category. As QUIC adoption grows across Windows networking and HTTP/3 deployments, expect more remote code execution disclosures tied to Microsoft’s QUIC implementation in coming months, mirroring what happened with earlier protocol stacks like SMB and RDP.
- Vulnerability management vendors report a busy Q3 2026 earnings cycle. Platforms built around automated CVE prioritization and exposure management are likely to cite this string of oversized, zero-day-heavy Patch Tuesdays as validation in upcoming investor updates, reinforcing enterprise demand for tools beyond manual patch tracking.
What Security Teams Should Do This Week
The immediate action list is short but urgent. First, confirm CVE-2026-68820 patches have deployed across every Windows endpoint and server, prioritizing machines with elevated network exposure or shared administrative access. Second, patch or isolate any internet-facing Windows DNS Server and QUIC-dependent services given the unauthenticated remote code execution risk in CVE-2026-62878 and CVE-2026-62815. Third, review Exchange Server and User Profile Service exposure for CVE-2026-62911 and CVE-2026-62832, since both were disclosed publicly before this patch shipped. Fourth, run a full asset inventory check against the complete August 2026 CVE list to catch any HPC Pack or Windows Deployment Services instances that might otherwise slip through standard workstation-focused patch cycles.
The Bigger Picture for Windows Security in 2026
August 2026’s Patch Tuesday fits a broader story that’s played out across this year’s cybersecurity coverage: large software vendors are shipping bigger, more frequent security releases, and attackers are moving faster to exploit disclosed flaws before organizations finish patching. That same dynamic showed up with the JetBrains TeamCity flaw CISA confirmed under active exploitation earlier this month, with the Oracle PeopleSoft zero-day that hit more than 100 schools, and with the 370-vulnerability Chrome 151 release patched earlier this summer. Windows, as the most widely deployed desktop and server operating system, remains the single highest-value target in that landscape, which is exactly why Patch Tuesday keeps growing rather than shrinking.
For most organizations, the takeaway isn’t that Windows is becoming less secure. It’s that the scale of scrutiny, from Microsoft’s internal security teams, external researchers, and threat actors alike, has grown enough that the monthly patch cycle has effectively become a running scoreboard of who found what first. This month, the WinSock zero-day tips that scoreboard toward attackers, at least until the patch finishes rolling out across enough of the Windows install base to close the window.
Frequently Asked Questions
How many vulnerabilities did Microsoft patch in August 2026?
SecurityWeek counted 421 CVEs in the Corrected: August 11, 2026 release, while BleepingComputer reported that Microsoft’s August 11, 2026 Patch Tuesday fixed 400 flaws, and The Hacker News and other sources reported 398 CVEs, a difference driven by how each outlet counts net-new CVEs versus broader advisory sets rather than “398–400 advisories.”
What is CVE-2026-68820?
CVE-2026-68820 is a use-after-free elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), rated CVSS 7.0. Microsoft confirms it is being actively exploited, letting a local attacker escalate to SYSTEM privileges.
Is CVE-2026-68820 remotely exploitable?
No. It requires local access to the machine first, which is why it’s typically chained with a separate remote entry point, such as phishing or another exposed vulnerability, as the second stage of an intrusion rather than an initial attack vector on its own.
Which August 2026 vulnerabilities pose the biggest remote risk?
CVE-2026-62878 in Windows DNS Server and CVE-2026-62815 in Microsoft QUIC are the highest-risk remote flaws, since both allow unauthenticated remote code execution with no user interaction required.
How many zero-days were in the August 2026 Patch Tuesday?
Three. CVE-2026-68820 is confirmed as actively exploited, while CVE-2026-62832 and CVE-2026-62911 were publicly disclosed before a patch was available, meeting Microsoft’s zero-day classification even without confirmed in-the-wild attacks.
How does August 2026 compare to previous Patch Tuesdays this year?
August’s 421 CVEs sit between June 2026’s 206 and July 2026’s 570, but all three months shared a confirmed actively exploited zero-day, marking three consecutive months of urgent out-of-band risk on top of the routine patch load.
Should home users worry about this Patch Tuesday?
Home users on Windows 10 or 11 should install the August 2026 cumulative update as soon as it’s offered through Windows Update. The DNS Server, QUIC, and HPC Pack flaws mostly affect server environments, but the WinSock zero-day applies to any Windows installation and is already being exploited.
Where can I check if my organization is exposed to these CVEs?
Microsoft’s Security Response Center update guide lists every CVE from this release with affected product versions and KB numbers, and it’s the authoritative source for confirming patch availability for a specific Windows or Windows Server build.
