August 2026 Patch Tuesday: 400 Fixes, 3 Zero-Days, and What a Small Business Needs to Do

Microsoft shipped its monthly security updates today at 10 AM Pacific. This one is big, though not July big, and one of the flaws it fixes is already being used by attackers, per BleepingComputer's August 2026 roundup. Here is what is in the release, the CVEs and KB numbers worth knowing, and how a ring-based managed deployment handles a month like this.

What Patch Tuesday is and how it works

On the second Tuesday of every month, Microsoft releases fixes for security flaws found in Windows, Office, and its server products. A security flaw, also called a vulnerability, is a mistake in software that an attacker can use to do something the software never intended, like reading your files or taking control of the machine. The fix for a flaw is called a patch, and the industry has called this monthly event Patch Tuesday for over twenty years.

Why batch them into one day a month instead of releasing each fix immediately? Predictability. IT teams can plan testing and deployment around a known date, and businesses are not rebooting machines at random all month. Microsoft holds everything except emergency out-of-band fixes for the monthly release, then publishes the details of what was fixed the same day.

How a patch reaches your PC depends on who manages it. A home computer gets updates directly from Microsoft through Windows Update, whenever Windows decides to install them. A managed business computer gets them through an RMM, short for remote monitoring and management, which is the software an IT provider uses to watch, update, and support every machine in your fleet from one place. That central control is what lets updates deploy on a schedule, with per-machine verification that the patch installed and the reboot completed, instead of hoping each PC got around to it.

Why 2026 broke the model

Until this year, Microsoft had never fixed more than about 200 flaws in a single month. Then AI-assisted tools for finding software bugs came of age, and researchers on every side started using them, a dynamic we covered when an AI model found 271 vulnerabilities in Firefox. June 2026 set a record near 200, July shattered it with 570, the largest Patch Tuesday ever, and August lands at 400. Microsoft has responded by rewriting its own deployment guidance: quality update deferral periods under three days, deadlines of zero or one day, and a grace period of no more than two, because the same AI tooling helps attackers turn a published patch into a working exploit faster than ever.

August 2026 by the numbers

This month's release fixes 400 vulnerabilities by BleepingComputer's count, which we use because they count only the CVEs Microsoft published on release day. Other outlets report anywhere from 394 to 669 because Microsoft's Security Update Guide changed format in July and no longer publishes one simple list, so each outlet counts differently: the Zero Day Initiative tallies 398 new CVEs with 62 Critical by its own severity math, and Lansweeper's 669 folds in flaws from bundled third-party components. A CVE, for reference, is the industry's tracking number for a single vulnerability.

By Microsoft's ratings, 42 are Critical, 37 of those remote code execution. By class, the release breaks down as:

• 176 elevation-of-privilege flaws. These let an attacker who already has a foothold on a machine promote themselves to administrator or SYSTEM. Rarely the way in, almost always the next step, and this month's actively exploited zero-day is one of them.
• 110 remote-code-execution flaws. The dangerous class: an attacker runs their own code on your systems, sometimes with no user interaction at all. 37 of the 42 Critical fixes are RCEs.
• The rest: 86 information-disclosure flaws, 21 spoofing, 12 denial-of-service, and 11 security-feature bypasses.

The notable items:

• CVE-2026-68820: the exploited zero-day, and the headline fix. A race condition in the Ancillary Function Driver for WinSock (afd.sys), the kernel driver behind the Winsock networking API, rated CVSS 7.0. Winning the race takes a local attacker to SYSTEM, the highest privilege level in Windows. Check Point attributes in-the-wild use to the Lazarus group, a North Korean state operation, and Microsoft patched two sibling flaws in the same driver (CVE-2026-61348 and CVE-2026-70307) in this release. One oddity the Zero Day Initiative flagged: Microsoft simultaneously lists the flaw's exploit-code maturity as "Unproven" while confirming active exploitation, another sign the old triage labels are straining.
• CVE-2026-62832: the LegacyHive flaw, publicly disclosed. This is the Windows User Profile Service bug that made news in July, when a researcher published details before a fix existed. It is an improper-link-resolution (link following) flaw: by abusing how the service resolves links when loading profile hives, a regular non-admin user could mount another user's registry hive, the per-user database where Windows stores settings and saved secrets, in full access mode and read or modify it. ACROS Security shipped free unofficial micropatches through 0patch in the interim; the official fix is confirmed in this release.
• CVE-2026-63520: the second half of the SharePoint attack chain. In July, Rapid7 disclosed CVE-2026-55040, a JWT token validation flaw that lets an unauthenticated attacker who knows a target's Active Directory SID or User Principal Name forge a token SharePoint accepts. Microsoft said the companion flaw would land in August, and it did: CVE-2026-63520 (CVSS 8.1) is an unsafe .NET type instantiation in Business Connectivity Services that yields code execution as the SharePoint service account. Chained, that is unauthenticated remote code execution against self-hosted SharePoint 2016, 2019, and Subscription Edition, fixed in KB5002893, KB5002894, KB5002896, KB5002905, and KB5002906. No in-the-wild exploitation had been observed at disclosure, but the write-up is public now. SharePoint Online through Microsoft 365 is patched server-side by Microsoft; the history of self-hosted SharePoint as a ransomware entry point is covered in the May SharePoint post.
• CVE-2026-62878: Windows DNS Server RCE, CVSS 9.8. A stack-based buffer overflow reachable by an unauthenticated remote attacker, which the Zero Day Initiative describes as wormable, meaning malware could use it to spread from server to server with no human involvement. On most small networks the DNS role runs on the domain controller, so this is a patch-the-DC-now item.
• The enterprise corner. On-premises Exchange gets a fix for CVE-2026-62911, an elevation-of-privilege flaw that could hand an attacker control over every user's mailbox, and two more CVSS 9.8 RCEs land in Microsoft QUIC (CVE-2026-62815, the transport under HTTP/3) and HPC Pack (CVE-2026-59124, unauthenticated and rated "exploitation more likely"). The third zero-day, CVE-2026-72971, is a publicly disclosed tampering flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys) that Microsoft rates unlikely to see exploitation.

KB numbers for the current builds: Windows 11 24H2 and 25H2 take KB5121003 (builds 26100.9168 and 26200.9168, with servicing stack update KB5123304 bundled), and Windows 11 23H2 takes KB5120240 (build 22631.7517). Windows 10 21H2 and 22H2 take KB5120249 (builds 19044.7663 and 19045.7663), and only on devices enrolled in Extended Security Updates, the paid program that is now the only way a Windows 10 machine gets patched at all. On the server side, Windows Server 2025 takes KB5120233 and Windows Server 2022 takes KB5120242 (build 20348.5499), per Microsoft's update history. As of release day, Microsoft lists no known issues against any of these packages, which is not something every month can say.

How a managed deployment actually works

We do not push a release like this to production machines on Tuesday afternoon, and that is deliberate. Patches occasionally break things, and when they do, the industry finds out within the first day or two as millions of machines install them and telemetry rolls in. A roughly 48-hour soak costs attackers little of the window that matters and has saved our clients from more than one bad patch that Microsoft had to pull and reissue.

So the updates go out in rings, which just means groups in a planned order. Our own machines and a small test group take the release first. Client workstations follow in an after-hours window once telemetry is clean, so nobody's workday is interrupted by an installing-updates screen. Servers deploy separately in a maintenance window, when a reboot cannot take down file shares or a line-of-business app in the middle of an invoice run. An actively exploited zero-day can compress that timeline: the soak is a default, not a dogma.

Reboots are the unglamorous half of patching, and they matter more than people think. A patch that has been downloaded but not rebooted into place is not protecting anything. Reboots are scheduled for early morning hours, and afterward the RMM verifies per machine that the update applied, the build number moved, and the machine came back healthy. That verification step is the difference between patching as a policy and patching as a hope, the same discipline covered in the patch management post. Ghosxt clients get the specifics of each month's deployment windows by email, so none of the above requires anything from them.

How to prioritize this week

If you run your own patching, in order:

• Install and reboot, everywhere. The cumulative update covers all three zero-days at once. Confirm automatic updates are actually on, and confirm the reboot happened, not just the download.
• Self-hosted SharePoint first. The CVE-2026-55040 plus CVE-2026-63520 chain is unauthenticated RCE with a public write-up. Apply the SharePoint KBs today if that server is reachable from the internet.
• Domain controllers and DNS servers next. CVE-2026-62878 is a wormable 9.8 in the DNS Server role, which usually lives on the same box as everything else.
• On-premises Exchange after that. CVE-2026-62911 puts every mailbox in reach of an attacker with a foothold.
• Audit the Windows 10 stragglers. Either they are ESU-enrolled and took KB5120249, or they are unprotected against everything in this release. Know which, this week; the Windows 10 end-of-life post lays out the exit paths.
• Verify, do not assume. Spot-check build numbers (26100.9168 or 26200.9168 on Windows 11, 19045.7663 on ESU Windows 10) rather than trusting the green checkmark in Windows Update.

Where this fits

• The July 2026 Patch Tuesday post and the June post, for the two previous releases and the patch-cadence habit.
• The LegacyHive post, for the July disclosure this release finally patches.
• The AI-found Firefox flaws post, for the AI-driven discovery wave behind 2026's record volumes.
• The May SharePoint post, for why self-hosted SharePoint keeps showing up in these roundups.
• The Windows 10 end-of-life post, for the machines this release skipped entirely.
• The patch management post, for the cadence and ownership structure that makes months like this one routine instead of a scramble.
• The 10 essentials and the cybersecurity page, for where patching sits in the full defense.
• The managed IT page, for patch management that is verified across every device.

We run monthly patch management for small businesses across Salinas, Monterey, Santa Cruz, Watsonville, and San Jose, and the rest of the Central Coast. This is the kind of thing we watch so you do not have to.

FAQs about the August 2026 Patch Tuesday

How many vulnerabilities did the August 2026 Patch Tuesday fix?

Microsoft's August 11, 2026 release fixes 400 vulnerabilities by BleepingComputer's count, which tallies only the CVEs Microsoft published on release day: 42 rated Critical (37 of those remote code execution), broken down as 176 elevation-of-privilege, 110 remote-code-execution, 86 information-disclosure, 21 spoofing, 12 denial-of-service, and 11 security-feature-bypass flaws. Other outlets report totals anywhere from 394 to 669 because Microsoft's Security Update Guide changed format in July 2026 and no longer publishes one simple list; the Zero Day Initiative counts 398 new CVEs with 62 Critical by its own severity tally, and Lansweeper's 669 folds in flaws from bundled third-party components.

What is the zero-day being actively exploited, and does it affect us?

CVE-2026-68820 (CVSS 7.0) is a race condition in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel driver that backs the Winsock networking API on every supported Windows PC and server, so yes, it affects essentially everyone running Windows. Winning the race lets a local attacker who already has code running on a machine elevate to SYSTEM, the highest privilege level in Windows. Security firm Check Point attributes in-the-wild exploitation to the Lazarus group, a North Korean state operation, and Microsoft patched two more flaws in the same driver (CVE-2026-61348 and CVE-2026-70307) in this release. Installing this month's cumulative update and rebooting closes all three.

Did the SharePoint attack chain from July get fully patched?

Yes. In July, Rapid7 disclosed CVE-2026-55040, a flaw in SharePoint's JWT token validation that lets an unauthenticated attacker who knows a target's Active Directory SID or User Principal Name forge a token the server accepts. The companion flaw shipped in this release as CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services that yields code execution with the privileges of the SharePoint service account. Chained, the two give unauthenticated remote code execution against self-hosted SharePoint Server 2016, 2019, and Subscription Edition; the fixes shipped as KB5002893, KB5002894, KB5002896, KB5002905, and KB5002906. SharePoint Online through Microsoft 365 is patched by Microsoft server-side.

What is LegacyHive, and is it fixed now?

LegacyHive is the Windows User Profile Service flaw publicly disclosed in July, patched in this release as CVE-2026-62832. The bug is an improper-link-resolution (link following) issue: by abusing how the service resolves links when loading profile hives, a regular non-admin user could mount another user's registry hive in full access mode and read or modify it, including stored secrets. ACROS Security shipped free unofficial micropatches through its 0patch service in the interim; the official fix in this month's cumulative update replaces that stopgap once the machine reboots.

We still have Windows 10 machines. Did we get any of these fixes?

Only if those machines are enrolled in Extended Security Updates. This month's Windows 10 fix, KB5120249 (builds 19045.7663 and 19044.7663), shipped only to ESU-enrolled devices. A Windows 10 machine without ESU received nothing from this release, the actively exploited zero-day included, and keeps falling further behind every month. If you still run Windows 10 in the business, confirm ESU enrollment as a bridge or, better, plan the upgrade or replacement now.

What order should a small business patch in?

Install the cumulative update and reboot everywhere; that single step covers the exploited zero-day and the bulk of the release. If some machines have to go first: self-hosted SharePoint servers (the completed CVE-2026-55040 plus CVE-2026-63520 chain needs no credentials), then domain controllers and any Windows server running the DNS role (CVE-2026-62878 is a wormable CVSS 9.8), then on-premises Exchange (CVE-2026-62911), then workstations. Verify Windows 11 machines land on build 26100.9168 or 26200.9168 and ESU-enrolled Windows 10 machines on 19045.7663, because an installed-but-not-rebooted patch protects nothing.

Sources: BleepingComputer · Zero Day Initiative · Rapid7 · LegacyHive patches · Lansweeper · KB5121003 · KB5120249 · Help Net Security

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.