Microsoft’s August 2026 Patch Tuesday landed as one of the largest security releases in company history, and it arrived with a live fire problem attached. BleepingComputer’s initial count put the release at 400 flaws on August 11, 2026, including 3 zero-days, while CrowdStrike counted 415 vulnerabilities in the release, including 62 rated critical and four zero-days, one of which attackers were already exploiting before the fixes shipped. SecurityWeek, Check Point and NotebookCheck put the total closer to 421 CVEs, a figure Sophos independently matched while noting the patches touched 29 separate product families. The gap between vendor counts is itself a small story: different firms include or exclude open-source components, Azure Linux packages, and browser patches differently, so “how many holes did Microsoft plug this month” no longer has a single agreed-upon answer.
What isn’t in dispute is the urgency. On August 19, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued a special alert demanding immediate patching of four vulnerabilities spanning Microsoft, VMware, and Apple products that were already being exploited in the wild. Separately, Cisco pushed emergency hotfixes for a firewall management flaw tied to hard-coded credentials, and Varonis disclosed a Microsoft Copilot Personal bug that let a single malicious link siphon data out of a victim’s connected Gmail, Google Drive, and Calendar accounts. This is a look at what shipped, who’s actively exploiting it, and why the monthly patch cycle keeps getting heavier.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside Microsoft’s Record August 2026 Patch Tuesday
CrowdStrike’s patch analysis puts the August 2026 release at 415 vulnerabilities: one exploited zero-day, three publicly disclosed zero-days, and 62 critical-rated bugs, with 349 additional flaws of lower severity layered on top. Check Point’s threat intelligence team, working from Microsoft’s Security Update Guide directly, counts 421 CVEs across Windows, Office, SharePoint, Exchange Server, and Azure, with more than 40 rated critical, a number Qualys corroborates with its own count of 421 vulnerabilities including three zero-days, and SANS ISC lands close by at 418 vulnerabilities with 62 critical in its August diary entry. Tenable, working from a narrower scope, reported 398 CVEs broken down as 42 critical and 355 important, matching Krebs on Security’s earlier internal tally of 398 flaws with 42 marked critical, and BleepingComputer likewise reported that Microsoft rated 42 of the August vulnerabilities critical. At the far end of the spectrum, Lansweeper counted 669 fixes including 82 critical, and Computerworld’s tally ran to 751 fixes with 108 critical, both apparently folding in a much wider set of cumulative and non-security updates. All these descriptions point at the same event, just sliced differently.
The headline fix is CVE-2026-68820, a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that underpins the entire Windows Sockets API. NotebookCheck flagged it as “the most urgent fix” in the release because it was already being used by attackers to escalate to SYSTEM-level privileges on unpatched machines. Check Point’s August 17 threat report and multiple vendor advisories independently confirmed active exploitation, which is why it made CISA’s emergency list two days later.
Three Excel remote code execution bugs, CVE-2026-68794, CVE-2026-68804, and CVE-2026-68816, each carry a CVSS score of 7.8 and let an attacker run arbitrary code the moment a victim opens a malicious spreadsheet, according to CrowdStrike’s breakdown. SharePoint took another hit too: CVE-2026-63520, a high-severity remote code execution bug rooted in unsafe .NET type instantiation inside Business Connectivity Services, lets an attacker trigger code execution through a specially crafted data connection. Rapid7’s Patch Tuesday review, which separately counted 421 vulnerabilities in the release with 236 concentrated in Windows components alone, calls it out as a top priority for any internet-facing SharePoint deployment.
CVE-2026-68820: The WinSock Zero-Day Attackers Are Already Using
The afd.sys driver has been a recurring soft spot in Windows for years because it sits directly in the path of nearly every network socket call the operating system makes. A use-after-free bug there is valuable to an attacker precisely because it doesn’t require tricking a user into anything unusual, it just requires local code execution to escalate to full SYSTEM control. Once an attacker has SYSTEM, endpoint detection tools, credential stores, and kernel-level defenses are all fair game.
Cyber Tech Cafe’s August roundup links the exploited zero-day activity to the Lazarus Group, the North Korea-linked threat actor best known for financial-sector intrusions and supply chain attacks. Integrity360’s separate cyber news roundup, published a week earlier, confirms the broader shape of the release: 42 critical issues, 37 of which are remote code execution flaws and five of which are elevation-of-privilege bugs, the exact category CVE-2026-68820 falls into.
CISA’s Emergency Order Covers Microsoft, VMware, and Apple
CISA’s August 19 alert, reported by SecurityWeek, named four vulnerabilities under active exploitation and gave federal agencies a hard deadline to patch. Two of the four are Microsoft bugs.
CVE-2026-33824: Windows IKE VPN Bug, CVSS 9.8
This is a double-free bug in the Windows Internet Key Exchange Service Extension, the component that negotiates IPsec VPN tunnels. A CVSS score of 9.8 puts it at the very top of the severity scale, and SecurityWeek notes it allows remote compromise of IPsec VPN infrastructure, meaning an attacker doesn’t need existing network access to start the attack chain.
CVE-2026-55040: SharePoint Weak Authentication, CVSS 9.1
A weak authentication flaw in SharePoint, scored 9.1, that CISA confirmed attackers are actively leveraging. It has already been added to the agency’s Known Exploited Vulnerabilities catalog, which effectively functions as a public list of “patch this or assume compromise.”
The remaining two entries on CISA’s list cover VMware and Apple products, both detailed below.
VMware vCenter’s Authentication Bypass Crisis
VMware’s vCenter, the management plane that controls most enterprise virtualization environments, has two serious problems this cycle. CVE-2026-59309 is an authentication-bypass vulnerability in VMware Directory Service that lets a network-adjacent attacker fully bypass vCenter authentication and seize the management plane outright, no credentials required. Security newsletters covering the release describe it as “most severe” among the VMware fixes for exactly that reason: a full vCenter takeover with zero prior access.
A companion flaw, CVE-2026-59310, is a directory-traversal bug in the vCenter Syslog server that enables arbitrary code execution. A third, CVE-2026-47876, is a VMXNET3 guest-to-host escape, meaning a compromised virtual machine can potentially break out and execute code on the underlying ESX host. Stacked together, the three bugs cover the entire chain from remote authentication bypass to code execution to hypervisor escape, which is why VMware shops are being told to patch on an emergency, not routine, schedule.
Cisco’s Hard-Coded Credential Problem
Cisco shipped emergency hotfixes for CVE-2026-20316, a zero-day in Secure Firewall Management Center caused by static, hard-coded credentials embedded directly in the web interface. That combination, a management-plane tool with a backdoor-style credential baked into the code, permits full administrative compromise of every firewall the console manages. Reports on the disclosure indicate exploitation in the wild before the patch went out, which is the worst possible sequence for a security vendor’s own management software.
Apple, Adobe, Zoom, and Chrome Round Out the Patch Wave
Apple’s contribution is CVE-2026-65400, a critical macOS Screen Sharing authentication vulnerability, CVSS 9.8, that let a network attacker authenticate to Screen Sharing without valid credentials. Check Point’s threat report flagged the simplicity of exploitation as the concerning part: no phishing, no malware delivery, just a network-adjacent connection to a service many Mac users don’t even realize is enabled.
Adobe patched CVE-2026-71362, a critical authentication bypass in Adobe Commerce and Magento Open Source that could let an attacker reach administrative functionality directly, a serious problem for any merchant storing customer or payment data on the platform. Zoom addressed three critical vulnerabilities in Zoom Workplace, including CVE-2026-53413, which could allow remote code execution during a live meeting through malicious content delivered to a participant. And in early August, Google shipped Chrome 151 to the stable channel, patching 41 vulnerabilities including six critical memory-safety bugs in components like WebGL and Aura.
Two more items rounded out the week’s disclosures away from the Patch Tuesday cycle itself: CISA flagged active exploitation of a command-injection flaw in Progress Kemp LoadMaster, an application delivery controller, and researchers reported a Metabase zero-day being used to inject arbitrary SQL and steal database credentials from connected systems, according to GBHackers’ weekly recap.
August 2026’s Highest-Priority CVEs at a Glance
| CVE | Product | CVSS | Status |
|---|---|---|---|
| CVE-2026-68820 | Windows AFD.sys (WinSock) | Not publicly scored | Actively exploited |
| CVE-2026-33824 | Windows IKE VPN Extension | 9.8 | Actively exploited, CISA KEV |
| CVE-2026-55040 | SharePoint (weak auth) | 9.1 | Actively exploited, CISA KEV |
| CVE-2026-65400 | macOS Screen Sharing | 9.8 | Critical, patched |
| CVE-2026-62896 | Microsoft Teams | 9.6 | Elevation of privilege |
| CVE-2026-59309 | VMware vCenter Directory Service | Not publicly scored | Full auth bypass |
| CVE-2026-20316 | Cisco Secure Firewall Mgmt Center | Not publicly scored | Actively exploited |
| CVE-2026-65665 | SharePoint Server | 8.8 | Remote code execution |
| CVE-2026-63520 | SharePoint (Business Connectivity Services) | High severity | Remote code execution |
| CVE-2026-24301 (“CoSnitch”) | Microsoft Copilot Personal | Not publicly scored | Patched Aug 18, no known exploitation |
Source: CrowdStrike, Check Point Research, SecurityWeek, Zero Day Initiative, and Varonis Threat Labs, as cited throughout this article.
The Copilot Angle: CoSnitch and AI-Assistant Risk
The most unusual disclosure of the month didn’t come from a traditional vendor advisory. Varonis Threat Labs found CoSnitch (CVE-2026-24301), a chained vulnerability in Microsoft Copilot Personal built from three separate weaknesses that, combined, let an attacker exfiltrate data from a victim’s connected Gmail, Google Drive, and Calendar accounts with a single click on a crafted link. Varonis researchers say they found the bug by probing Copilot’s own reasoning until it revealed an undocumented parameter and the protections around it, an approach that says as much about how AI assistants get security-tested now as it does about the bug itself.
Microsoft patched CoSnitch on August 18, 2026, and Varonis reports no evidence of exploitation before the fix shipped. But the firm also notes this is the third Copilot vulnerability it has identified in 2026 alone, a pattern that’s starting to look less like isolated bugs and more like a structural gap in how quickly AI-assistant integrations get security review before shipping to consumers.
The Lazarus Group Connection: Nation-State Actors Move Fast
Attribution for the CVE-2026-68820 exploitation activity to the Lazarus Group, per Cyber Tech Cafe’s reporting, fits a well-worn pattern. Lazarus and comparable state-linked groups have repeatedly been first movers on Windows kernel and privilege-escalation bugs because those flaws offer the cleanest path from initial access to full system control without triggering the kind of alerts that phishing or malware delivery tends to generate. A kernel-level zero-day is quieter, more reliable, and reusable across multiple targets before defenders catch on.
The pairing of a state-linked actor with a kernel driver bug also explains the speed of the CISA response. Federal directives typically move fastest when there’s a documented in-the-wild exploitation chain tied to a known persistent threat, rather than a purely theoretical vulnerability sitting in a lab report.
Historical Context: How Patch Volume Has Grown Since 2023
August 2026’s release didn’t come out of nowhere. Microsoft’s monthly CVE counts have been climbing steadily for three years. Rapid7’s August 2023 Patch Tuesday review recorded 86 vulnerabilities that month, including a single zero-day, CVE-2023-38180, a denial-of-service bug in .NET, ASP.NET Core, and Visual Studio. By August 2025, the count had risen to 107 CVEs according to a consensus of Tenable, CrowdStrike, Lansweeper, and Action1 (Qualys counted 119 using a broader inclusion methodology), with one publicly disclosed zero-day, CVE-2025-53779, a Windows Kerberos elevation-of-privilege bug.
Annual totals tell the same story. Tenable’s year-in-review data puts 2024’s total at 1,009 CVEs across all twelve Patch Tuesday releases, including 22 zero-days, an average of roughly 84 CVEs per month. In 2025, that annual total climbed to 1,130 CVEs, including 41 zero-days, 24 of which were exploited in the wild, pushing the monthly average to roughly 94. Krebs on Security independently corroborates the scale, reporting Microsoft patched “a whopping 1,129 vulnerabilities in 2025, an 11.9% increase from 2024.” August 2026’s single-month total of 398 to 421 CVEs, depending on the counting methodology, is close to half of an entire year’s total from just three years earlier.
Patch Tuesday CVE Volume: 2023 to 2026
| Period | Total CVEs | Zero-Days | Source |
|---|---|---|---|
| August 2023 | 86 | 1 (CVE-2023-38180) | Rapid7 |
| 2024 full year (12 releases) | 1,009 (~84/month avg.) | 22 for the year | Tenable |
| August 2025 | 107 (consensus); 119 (Qualys) | 1 (CVE-2025-53779) | Tenable, CrowdStrike, Qualys |
| 2025 full year (12 releases) | 1,130 (~94/month avg.) | 41 for the year, 24 exploited | Tenable |
| August 2026 | 398-421 (vendor-dependent) | 4 (1 exploited, 3 disclosed) | CrowdStrike, Check Point, Krebs on Security |
The trend line is unambiguous even accounting for methodology differences between vendors: monthly and annual CVE volume has roughly doubled since 2023, and the exploited-zero-day count is no longer a rare event bolted onto an otherwise routine release, it’s now a near-monthly fixture.
Why the Numbers Keep Climbing
Several forces are pushing the count up at once. Microsoft’s product surface has expanded, Copilot integrations, Azure services, and cloud-connected Office features all add new attack surface that didn’t exist three years ago. Security researchers, both independent and vendor-employed, are also better resourced and more numerous than they were in 2023, and bug bounty programs across Microsoft, VMware, Cisco, and Apple have matured enough to surface flaws that used to sit undiscovered for years. On the offensive side, state-linked groups like Lazarus have gotten faster at weaponizing disclosed bugs, which pressures vendors to patch and disclose faster, sometimes before a full severity picture is even settled, which is part of why CVSS scores are still pending on several of this month’s most serious bugs.
There’s also a straightforward compounding effect: more connected products means more code, and more code at Microsoft’s scale means more bugs, full stop. The company’s own transparency reporting has generally trended toward disclosing more, not less, which raises the visible CVE count independent of whether the underlying software is getting any less secure.
Market Impact: What This Means for Enterprise Security Budgets
For IT and security teams, a 400-plus CVE month with four zero-days and a CISA emergency directive attached is not a routine patch cycle, it’s a resourcing event. Teams running lean patch management operations are being forced to triage 62 critical bugs against limited maintenance windows, and the VMware vCenter and Cisco firewall management flaws in particular require infrastructure-level changes rather than a simple endpoint update, meaning downtime planning, change-control approval, and rollback testing all have to happen faster than usual.
That pressure shows up directly in vendor spending. Organizations without automated patch orchestration or vulnerability prioritization tooling are the ones most exposed when a month like this hits, since manually triaging hundreds of CVEs against CISA’s Known Exploited Vulnerabilities catalog isn’t realistic without tooling. Expect renewed enterprise interest in vulnerability management platforms, attack-surface monitoring, and patch orchestration tools through the rest of 2026 as CISOs use this release as a budget justification data point heading into 2027 planning cycles.
Competitive Landscape: How Security Vendors Are Responding
The vendor response to a release this size splits into two camps. Detection and response vendors, CrowdStrike, Rapid7, and Zero Day Initiative among them, moved fastest with detailed technical breakdowns of the individual CVEs, prioritization guidance, and in several cases same-day detection signatures for the actively exploited bugs. Vulnerability management vendors like Tenable and Qualys focused on scanning coverage, pushing plugin updates to flag the exposed CVEs across customer environments within hours of disclosure.
The more interesting shift is Varonis’s role in the CoSnitch disclosure. A data-security vendor, not a traditional OS or endpoint player, found and reported a critical flaw in an AI assistant’s cloud integrations, which signals that AI-assistant security testing is becoming its own specialty distinct from classic application security. Expect more vendors from the data-security and cloud-security space to start publishing Copilot- and AI-assistant-specific research as that surface area keeps growing.
Checking Patch Status: A Quick Reference
For administrators trying to confirm which of these August 2026 fixes are already installed on a Windows fleet, a quick PowerShell check against the hotfix list is the fastest first pass before running a full vulnerability scan.
Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date).AddDays(-14) } | Select-Object HotFixID, Description, InstalledOn | Sort-Object InstalledOn -DescendingThat command surfaces every update applied in the last two weeks, which should include the August cumulative update if deployment succeeded. Microsoft’s August 11, 2026 packages included KB5120240 (build 22631.7517) for Windows 11 23H2 and KB5121000 for Windows 11 26H1, which are the hotfix IDs to look for on those versions. It’s not a substitute for a proper vulnerability scanner cross-referenced against CISA’s KEV catalog, but it’s a fast sanity check before escalating.
Predictions: Where Patch Management Goes From Here
- Monthly CVE counts keep climbing through 2027. Given the 2023-to-2026 trend line, expect annual totals to push past 1,200 CVEs in 2026, with individual months regularly exceeding 150-200 disclosures even outside the largest releases.
- AI-assistant vulnerabilities become a standing category. With three Copilot bugs surfaced by Varonis alone in 2026, expect dedicated “AI assistant CVE” tracking to become standard practice at major vulnerability databases within the next year.
- Management-plane bugs draw more scrutiny. The VMware vCenter and Cisco Secure Firewall Management Center flaws both hit infrastructure control planes rather than endpoints, a pattern likely to repeat as attackers realize management consoles offer higher-value access than individual machines.
- CISA emergency directives become more frequent, not less. Four actively exploited vulnerabilities triggering a special alert in a single week suggests the agency’s threshold for emergency action is being tested more often as exploitation windows shrink.
- Patch orchestration tooling sees increased enterprise adoption. Expect vendors offering automated prioritization against CISA’s KEV catalog to see stronger demand as manual triage of 400-plus monthly CVEs becomes unsustainable for mid-sized IT teams.
Frequently Asked Questions
How many vulnerabilities did Microsoft patch in August 2026?
Vendor counts vary between 398 and 421, and outliers folding in cumulative updates run far higher, depending on whether open-source and Azure Linux components are included. CrowdStrike reports 415 with 62 critical; Check Point, NotebookCheck, and Splashtop report 421 CVEs across major Microsoft products; Krebs on Security reported an earlier tally of 398 with 42 critical. Tech Insider’s own reconciliation, published August 11, 2026 and drawing on SecurityWeek, BleepingComputer, and other outlets, settled on 421 CVEs as the most consistent figure.
Which August 2026 vulnerability is being actively exploited right now?
CVE-2026-68820, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock, is confirmed as actively exploited and was reported by Cyber Tech Cafe as linked to the Lazarus Group. CVE-2026-33824 (Windows IKE) and CVE-2026-55040 (SharePoint) are also on CISA’s Known Exploited Vulnerabilities catalog.
What is the CoSnitch vulnerability in Microsoft Copilot?
CoSnitch (CVE-2026-24301) is a chained vulnerability in Microsoft Copilot Personal, disclosed by Varonis Threat Labs, that allowed data exfiltration from a victim’s connected Gmail, Google Drive, and Calendar accounts via a single malicious link. Microsoft patched it on August 18, 2026.
Should I patch VMware vCenter immediately?
Yes. CVE-2026-59309 allows a network-adjacent attacker to fully bypass vCenter authentication without credentials, and CISA included a VMware flaw in its August 19 emergency directive. Any organization running vCenter should treat this as a same-week priority, not a routine maintenance-window item.
Is the Cisco Secure Firewall Management Center flaw a backdoor?
CVE-2026-20316 involves static, hard-coded credentials embedded in the web interface, which functions similarly to a backdoor even if it wasn’t intentionally designed as one. Cisco issued emergency hotfixes, and reports indicate exploitation occurred before the patch was available.
How does August 2026 compare to previous years’ Patch Tuesdays?
August 2023 saw 86 CVEs and one zero-day (Rapid7). August 2025 saw 107 CVEs and one zero-day (Tenable, CrowdStrike). August 2026’s total of 398-421 CVEs with four zero-days represents roughly a fourfold increase in monthly volume over three years.
What should security teams prioritize first from this release?
The four vulnerabilities on CISA’s Known Exploited Vulnerabilities catalog take priority: CVE-2026-68820 (WinSock), CVE-2026-33824 (Windows IKE), CVE-2026-55040 (SharePoint), and the VMware and Apple flaws named in the August 19 directive. After that, the three Excel RCE bugs and the SharePoint Business Connectivity Services flaw are the next tier given their remote code execution potential.
Where can I track newly exploited vulnerabilities as they’re added?
CISA maintains a public Known Exploited Vulnerabilities catalog that’s updated as new active-exploitation evidence emerges, and vendors including CrowdStrike, Rapid7, and Zero Day Initiative publish detailed monthly Patch Tuesday breakdowns within hours of each release.
