Microsoft released its August 2026 security updates on August 11, 2026. This release fixes 444 vulnerabilities, with 44 rated Critical. It includes 3 zero-days: 1 already exploited by attackers and 2 publicly disclosed before a fix. Patch those first.
- 444 patches
- 44 Critical
- 3 zero-days
- 1 exploited
Zero-day vulnerabilities
Exploited by attackers or publicly disclosed before the fix. Treat these as urgent.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Elevation of Privilege | 7.0 | Exploited |
| CVE-2026-72971 | Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability | Tampering | 5.5 | Publicly disclosed |
| CVE-2026-62832 | Windows User Profile Service Elevation of Privilege Vulnerability | – | Publicly disclosed |
Critical vulnerabilities
Highest severity scores first.
| CVE | What it affects | Type | CVSS | Status |
|---|---|---|---|---|
| CVE-2026-62815 | Microsoft QUIC Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-62878 | Windows DNS Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-62893 | Windows Deployment Services TFTP Server Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-65791 | Windows iSCSI Target Service Remote Code Execution Vulnerability | Remote Code Execution | 9.8 | |
| CVE-2026-62816 | Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62817 | Windows DNS Server Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62818 | Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62822 | Windows GDI+ Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62823 | Windows DHCP Server Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62824 | Remote Desktop Client Remote Code Execution Vulnerability | Remote Code Execution | 8.8 | |
| CVE-2026-62827 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Elevation of Privilege | 8.8 | |
| CVE-2026-64921 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Elevation of Privilege | 8.8 |
And 32 more Critical fixes. The full list is in Microsoft’s release notes below.
What kinds of problems were fixed
| Type | Count |
|---|---|
| Elevation of Privilege | 160 |
| Remote Code Execution | 112 |
| Information Disclosure | 86 |
| Spoofing | 17 |
| Denial of Service | 11 |
| Security Feature Bypass | 11 |
| Tampering | 4 |
What we recommend
- Patch anything marked as exploited first, ideally within days.
- Then roll out the Critical fixes, starting with internet-facing systems, domain controllers and email servers.
- Test on a small group before pushing to everyone, and keep a way to roll back.
- Check that endpoint protection and backups are healthy before you patch.
Short on time? Talk to Synova and we will help you prioritize and roll out the updates safely.
Counts are vulnerabilities (CVEs) first published on Patch Tuesday. Microsoft also published 337 fixes earlier in the month (mostly Edge and other browser components), which are not included above. Microsoft sometimes revises a release after launch, so this page updates itself. Last updated October 21, 2026, 1:52 AM GMT+0000. Source: Microsoft Security Update Guide, August 2026 release notes.