Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)

A blog header image that includes a logo for Tenable Research Special Operations at the top. The image is for the Microsoft Patch Tuesday for August 2026 detailing 398 total CVEs. The severity breakdown is: 42 Critical, 355 Important, 1 Moderate, and 0 Low.

42Critical
355Important
1Moderate
0Low

Microsoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild.

Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.

A pie chart showing the severity distribution across the Patch Tuesday CVEs patched in August 2026.

This month’s update includes patches for:

.NET
.NET Core
.NET Framework
AMD Zen
Active Directory Certificate Services (AD CS)
Application Information Services
Azure Active Directory
Azure CycleCloud
Azure Monitor Agent
Azure Storage Explorer
Capability Access Management Service (camsvc)
Desktop Window Manager
Dynamics Business Central
GitHub Copilot and Visual Studio Code
Microsoft Azure Attestation service and Device Health Attestation Service
Microsoft COM for Windows
Microsoft Defender for Endpoint
Microsoft Digest Authentication
Microsoft Dynamics 365 (on-premises)
Microsoft Entra Connect Sync
Microsoft Exchange Server
Microsoft High Performance Computing (HPC) Pack
Microsoft Identity Services
Microsoft Local Security Authority Server (lsasrv)
Microsoft Office
Microsoft Office Access
Microsoft Office Excel
Microsoft Office Graphics Component
Microsoft Office Outlook
Microsoft Office PowerPoint
Microsoft Office SharePoint
Microsoft Office Word
Microsoft OneDrive
Microsoft PowerShell
Microsoft PowerShell Core
Microsoft QUIC
Microsoft Remote Registry Service
Microsoft Teams Mobile
Microsoft Teams for Android
Microsoft Windows Codecs Library
Microsoft Windows Media Foundation
Microsoft Windows Search Component
Power BI
RPC Runtime
Reliable Multicast Transport Driver (RMCAST)
Remote Desktop Client
User-Mode Power Service (UMPS)
Virtual Hard Disk (VHD) Miniport Driver
Visual Studio Code
Visual Studio Code - Python extension
Visual Studio Code CoPilot Chat Extension
Windows Accessibility Infrastructure (ATBroker.exe)
Windows Active Directory
Windows Ancillary Function Driver for WinSock
Windows Autopilot
Windows Backup Engine
Windows Bind Filter Driver
Windows Cloud Files Mini Filter Driver
Windows Common Log File System Driver
Windows Container Isolation FS Filter Driver (unionfs.sys)
Windows Cross Device Service
Windows DHCP Client
Windows DHCP Server
Windows DNS
Windows DWM Core Library
Windows Defender Firewall Service
Windows Deployment Services
Windows Device Association Service
Windows Display Enhancement Service
Windows Encrypting File System (EFS)
Windows Event Logging Service
Windows GDI
Windows GDI+
Windows Graphics Kernel
Windows HTTP Protocol Stack
Windows HTTP.sys
Windows Hello
Windows Hyper-V
Windows Imaging Component
Windows Installer
Windows Kerberos
Windows Kernel
Windows Key Guard
Windows LDAP - Lightweight Directory Access Protocol
Windows LUAFV
Windows License Manager
Windows MIDI Service Module
Windows Management Instrumentation
Windows Management Services
Windows Message Queuing
Windows Modern Device Management (MDM)
Windows NTFS
Windows Narrator Braille
Windows Network Address Translation (NAT)
Windows Network Connection Broker
Windows Network File System
Windows Package Manager
Windows Program Compatibility Assistant Service
Windows Projected File System
Windows Push Notifications
Windows RPC API
Windows Remote Access API
Windows Remote Access Connection Manager
Windows Remote Desktop Services
Windows Remote Help
Windows Remote Help Defense
Windows Routing and Remote Access Service (RRAS)
Windows SMB Client
Windows SMB Server
Windows Schannel
Windows Secure Socket Tunneling Protocol (SSTP)
Windows Sensor Data Service
Windows Shell
Windows Storage
Windows Storage Port Driver
Windows TCP/IP
Windows Telephony Service
Windows USB Driver
Windows Universal Disk Format File System Driver (UDFS)
Windows User Profile Service
Windows Win32K
Windows Wired AutoConfig Service
Windows Work Folder Service
Windows iSCSI Target Service
Winlogon

A bar chart showing the count by impact of CVEs patched in the August 2026 Patch Tuesday release.

Elevation of Privilege (EoP) vulnerabilities accounted for 40.7% of the vulnerabilities patched this month, followed by remote code execution (RCE) vulnerabilities at 27.1%.

CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2026-68820 is an EoP vulnerability affecting Windows Ancillary Function Driver for WinSock. It received a CVSSv3 score of 7.0 and was rated as important. A local attacker could exploit this vulnerability to elevate to SYSTEM privileges. According to Microsoft, this vulnerability was exploited in the wild as a zero-day.

Two additional EoP vulnerabilities affecting this driver were patched this month. CVE-2026-61348 and CVE-2026-70307 also received CVSSv3 scores of 7.0, however no exploitation has been reported for these flaws. Both were assessed as "Exploitation More Likely" according to Microsoft's Exploitability Index.

Prior zero-days in this driver include CVE-2025-32709 in May 2025, CVE-2025-21418 in February 2025, and CVE-2024-38193 in August 2024.

CVE-2026-62832 | Windows User Profile Service Elevation of Privilege Vulnerability

CVE-2026-62832 is an elevation of privilege vulnerability affecting Windows User Profile Service. It received a CVSSv3 score of 7.8 and is rated as important. A local attacker could exploit this vulnerability to gain ADMINISTRATOR privileges. It was publicly disclosed prior to a patch being available and was assessed as “Exploitation More Likely.”

Historically, the Windows User Profile Service has received four total CVEs since January 2022. Prior zero-days in this family include CVE-2022-21919 in January 2022 and CVE-2022-26904 in April 2022.

CVE-2026-72971 | Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

CVE-2026-72971 is a tampering vulnerability affecting the Windows Container Isolation FS Filter Driver (unionfs.sys). It received a CVSSv3 score of 5.5 and is rated as important. It was publicly disclosed prior to a patch being available. Successful exploitation would allow a local attacker to perform tampering. Despite being publicly disclosed, Microsoft assesses this vulnerability as “Exploitation Unlikely.”

CVE-2026-62893 | Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

CVE-2026-62893 is a remote code execution vulnerability affecting Windows Deployment Services Trivial File Transfer Protocol (TFTP) Server. It received a CVSSv3 score of 9.8 and is rated as critical. It was assessed as "Exploitation More Likely." Successful exploitation of this flaw could occur when a remote, unauthenticated attacker sends crafted packets to a vulnerable service, resulting in code execution. It was reported to Microsoft by Nikolai Skliarenko of TrendAI Research.

CVE-2026-62823 | Windows DHCP Server Remote Code Execution Vulnerability

CVE-2026-62823 is a remote code execution vulnerability affecting Windows DHCP Server. It received a CVSSv3 score of 8.8 and is rated as critical. It was assessed as "Exploitation More Likely" according to Microsoft's Exploitability Index. Successful exploitation would allow a remote, unauthenticated attacker to execute code over an adjacent network by exploiting a heap-based buffer overflow flaw using a crafted packet.

13 additional Windows DHCP server vulnerabilities were patched this month, however these flaws were only rated as important. The flaws include eight information disclosure vulnerabilities with CVSSv3 scores of 6.5 (CVE-2026-62714, CVE-2026-62715, CVE-2026-62716, CVE-2026-62718, CVE-2026-62720, CVE-2026-62742, CVE-2026-62745 and CVE-2026-62814) and five EoP vulnerabilities with CVSSv3 scores of 7.8 (CVE-2026-62761, CVE-2026-62776, CVE-2026-62803, CVE-2026-62807 and CVE-2026-62812).

Multiple CVEs | Microsoft Office SharePoint Spoofing, Remote Code Execution, Elevation of Privilege, Information Disclosure and Tampering Vulnerabilities

This month's update includes patches for 29 CVEs affecting Microsoft Office SharePoint. Of the 29 CVEs, three were rated as critical and three were assessed as 'Exploitation More Likely.' A breakdown of the CVEs can be found in the table below:

CVE	Description	CVSSv3	Severity	Exploitability Index
CVE-2026-70306	Microsoft Office SharePoint Spoofing	9.3	Important	Exploitation Less Likely
CVE-2026-62827	Microsoft SharePoint Server Elevation of Privilege	8.8	Critical	Exploitation Less Likely
CVE-2026-65665	Microsoft SharePoint Server Remote Code Execution	8.8	Critical	Exploitation More Likely
CVE-2026-64921	Microsoft SharePoint Server Elevation of Privilege	8.8	Critical	Exploitation Less Likely
CVE-2026-63514	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-64901	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-65658	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-65663	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-66805	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-66808	Microsoft SharePoint Server Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-70321	Microsoft SharePoint Remote Code Execution	8.8	Important	Exploitation Less Likely
CVE-2026-70324	Microsoft SharePoint Elevation of Privilege	8.8	Important	Exploitation Less Likely
CVE-2026-70326	Microsoft SharePoint Server Elevation of Privilege	8.8	Important	Exploitation Less Likely
CVE-2026-63520	Microsoft SharePoint Server Remote Code Execution	8.1	Important	Exploitation More Likely
CVE-2026-57105	Microsoft Office SharePoint Spoofing	8.0	Important	Exploitation Less Likely
CVE-2026-70355	Microsoft SharePoint Server Elevation of Privilege	7.3	Important	Exploitation More Likely
CVE-2026-58639	Microsoft SharePoint Server Spoofing	6.5	Important	Exploitation Less Likely
CVE-2026-62837	Microsoft SharePoint Server Information Disclosure	6.5	Important	Exploitation Less Likely
CVE-2026-62839	Microsoft SharePoint Server Spoofing	6.5	Important	Exploitation Less Likely
CVE-2026-63512	Microsoft SharePoint Server Tampering	6.5	Important	Exploitation Less Likely
CVE-2026-63516	Microsoft SharePoint Server Spoofing	6.5	Important	Exploitation Less Likely
CVE-2026-65660	Microsoft SharePoint Server Spoofing	6.5	Important	Exploitation Less Likely
CVE-2026-62829	Microsoft SharePoint Server Spoofing	4.6	Important	Exploitation Less Likely
CVE-2026-62917	Microsoft SharePoint Server Spoofing	4.6	Important	Exploitation Less Likely
CVE-2026-64897	Microsoft SharePoint Server Spoofing	4.6	Important	Exploitation Less Likely
CVE-2026-64922	Microsoft SharePoint Server Spoofing	4.6	Important	Exploitation Less Likely
CVE-2026-64900	Microsoft SharePoint Server Spoofing	7.3	Important	N/A
CVE-2026-64902	Microsoft SharePoint Server Spoofing	4.6	Important	N/A
CVE-2026-64916	Microsoft SharePoint Server Spoofing	4.6	Important	Exploitation Unlikely

Tenable Solutions

A list of all the plugins released for Microsoft's August 2026 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats.

Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

Exposure Management
Vulnerability Management