August Patch Tuesday: Windows Zero-Day Fix & 9.8-Rated RCE Flaws

August 2026 Patch Tuesday: What You Need to Know Right Now

• One actively exploited zero-day (CVE-2026-68820) targeting the Windows Ancillary Function Driver for WinSock is already being used in real attacks — patch this one first, no exceptions.
• Microsoft released fixes for 400+ vulnerabilities this August, including 62 rated Critical, continuing a trend of historically large monthly releases in 2026.
• Several vulnerabilities carry a CVSS score of 9.8 — the highest tier of severity — meaning they can be exploited remotely with no user interaction and no authentication required.
• SharePoint administrators face a unique challenge: both the July and August cumulative updates are required to fully remediate an RCE vulnerability chain — applying only August’s patch leaves systems exposed.
• Microsoft’s AI-assisted vulnerability discovery program is widely credited with the dramatic spike in CVE counts — a trend that shows no sign of slowing down and changes how IT teams must approach patch prioritization.

Microsoft just made August a very busy month for every IT and security team on the planet.

August 2026 Patch Tuesday arrived on August 11th, delivering fixes for 400 vulnerabilities across the Windows ecosystem — including one zero-day that attackers were already exploiting before the patch even existed. For defenders, that is the worst-case scenario: a race where the attackers had a head start. CrowdStrike’s exposure management team, which tracks patch releases closely, identified 62 Critical-rated vulnerabilities among the 415 total CVEs catalogued in this release cycle.

If your organization relies on Windows — and statistically speaking, it almost certainly does — this is not a “patch when convenient” situation. For teams looking to stay on top of monthly Microsoft security releases and build stronger patch management habits, resources like those available through cybersecurity advisory platforms can help streamline how you triage and respond to releases of this scale.

Microsoft Just Dropped 400+ Patches — Here’s What Demands Your Attention First

When a single Patch Tuesday touches 400+ vulnerabilities, the instinct is to treat them all equally. That instinct will get you compromised. The real skill in modern patch management is triage under pressure — knowing which flaws represent an immediate threat to your environment versus which ones can follow your normal deployment cycle.

This month’s release breaks down across several risk tiers. At the top sits one actively exploited zero-day. Below that, three publicly disclosed vulnerabilities that attackers now have a roadmap to weaponize. Then come the 62 Critical-rated CVEs — a number that would have been alarming in any previous year but has become a recurring feature of 2026’s release cadence. The remaining 349 vulnerabilities range from Important to Moderate, and while they shouldn’t be ignored, they can follow a structured rollout.

The Actively Exploited Zero-Day: CVE-2026-68820

CVE-2026-68820 is the vulnerability that should be at the top of every patch queue right now. It affects the Windows Ancillary Function Driver for WinSock — a low-level networking component present in virtually every modern Windows installation. Microsoft confirmed active exploitation before the patch was released, meaning real threat actors were using this flaw against real targets while defenders had no official fix available.

The vulnerability is classified as an Elevation of Privilege (EoP) flaw, which means an attacker who already has a foothold on a system — perhaps through phishing or a separate exploit — can use CVE-2026-68820 to escalate their access to SYSTEM level. That is the highest privilege tier in Windows, granting complete control over the machine.

CVE-2026-68820 at a Glance

Attribute	Detail
CVE ID	CVE-2026-68820
Affected Component	Windows Ancillary Function Driver for WinSock
Vulnerability Type	Use-After-Free / Elevation of Privilege
Exploitation Status	Actively exploited in the wild
Privilege Required	Low (local access needed)
Outcome if Exploited	SYSTEM-level privilege escalation
Patch Available	Yes — August 11, 2026 Patch Tuesday

What the WinSock Driver Vulnerability Actually Does

The Windows Ancillary Function Driver (AFD.sys) is the kernel-mode component that handles Winsock API calls — essentially the bridge between application-layer network requests and the Windows kernel. Because it operates at the kernel level and processes calls from nearly every networked application, it is an exceptionally high-value target. A flaw here doesn’t just affect one application; it affects the entire operating system.

Why “Use-After-Free” Bugs Are Dangerous

CVE-2026-68820 is rooted in a use-after-free (UAF) memory corruption condition. This class of bug occurs when a program continues to reference a memory location after that memory has been freed and potentially reallocated. In a kernel driver, an attacker can time this carefully to place controlled data into that freed memory region, then trigger the vulnerable code path — causing the kernel to execute attacker-supplied content with full system privileges. UAF vulnerabilities in kernel drivers are among the most reliable exploitation primitives in a threat actor’s toolkit, which is exactly why this one was being actively used before a patch existed.

Who Discovered It and How It Was Being Exploited

Microsoft’s advisory confirmed active exploitation but did not publicly attribute the attacks to a specific threat group at the time of the August 11th release. This is consistent with Microsoft’s standard disclosure practice when investigations are ongoing. However, EoP vulnerabilities in WinSock-related components have historically been favored by both nation-state actors and ransomware operators as post-exploitation tools — used after initial access is established to gain the elevated privileges needed for lateral movement, credential dumping, and persistence.

The fact that it was discovered and reported while actively being exploited suggests it was likely identified through incident response activity — meaning organizations were already being attacked before August 11th. If your threat detection logs show unusual WinSock driver activity from late July or early August 2026, that warrants a closer look.

The 9.8-Rated RCE Flaws You Cannot Ignore

While the exploited zero-day demands immediate attention, the CVSS 9.8-rated Remote Code Execution vulnerabilities in this release represent a different kind of threat — one with potentially wider blast radius. A 9.8 score means the flaw is network-exploitable, requires no authentication, and needs no user interaction. An attacker on the internet can hit a vulnerable exposed service and execute arbitrary code. Period.

Which Products Are Affected

This month’s Critical RCE vulnerabilities touch several high-value Microsoft products. CVE-2026-64921 and CVE-2026-65665 are Critical vulnerabilities affecting Microsoft SharePoint, and represent part of the RCE chain that requires both July and August patches to fully remediate. Additionally, CVE-2026-70130 and related CVEs are Critical RCE vulnerabilities in Microsoft Office, carrying CVSS scores of 8.4 and 7.8 respectively. Windows itself received 233 individual patches — the highest of any product family in this release — touching components across the kernel, networking stack, print spooler, and Remote Desktop Services.

What a CVSS 9.8 Score Actually Means for Your Network

The Common Vulnerability Scoring System (CVSS) rates vulnerabilities on a scale from 0 to 10. A score of 9.8 sits just below the theoretical maximum and reflects the near-perfect storm of exploitability factors. Here is what that score is telling you in plain terms, especially in light of recent CISA mandates to patch critical flaws.

• Attack Vector: Network — The attacker does not need physical or local access. They can exploit this remotely over the internet.
• Attack Complexity: Low — No special conditions, timing, or insider knowledge required. The exploit is straightforward to execute.
• Privileges Required: None — The attacker doesn’t need an account or any prior access to the system.
• User Interaction: None — No employee needs to click a link, open a file, or do anything. The attack is fully autonomous.
• Scope: Changed — Successful exploitation can affect components beyond the vulnerable service itself.
• Confidentiality, Integrity, Availability Impact: High across all three — Data theft, data manipulation, and service disruption are all on the table.

Two Publicly Disclosed Zero-Days Also Patched This Month

Beyond the actively exploited CVE-2026-68820, Microsoft patched two additional zero-day vulnerabilities that were publicly disclosed before fixes were available. Public disclosure without an available patch — sometimes called “patch-gapping” — is particularly dangerous because it hands a working roadmap to any threat actor willing to do the reverse engineering work. Security researchers, proof-of-concept code on GitHub, and detailed write-ups can dramatically shorten the time between disclosure and weaponized exploit.

While Microsoft had not confirmed active exploitation of these two disclosed vulnerabilities at the time of the August 11th release, historical patterns are clear: publicly disclosed vulnerabilities see exploitation attempts within days of Patch Tuesday, as attackers cross-reference the patch changes to identify exactly what was broken. Treating these as “not yet exploited” is not a reason to delay patching — it is a countdown clock. For instance, the CISA mandate for federal agencies to patch critical flaws underscores the urgency of timely updates.

42 Critical Vulnerabilities: The Full Breakdown

CrowdStrike’s August 2026 Patch Tuesday analysis confirmed 62 Critical-rated vulnerabilities in this release — a figure that reflects both the breadth of Microsoft’s product surface and the acceleration in vulnerability discovery driven by AI-assisted tooling. Of these, the dominant category by far is Remote Code Execution, which accounts for the lion’s share of Critical findings this month.

The breakdown matters because different vulnerability types demand different remediation strategies. An RCE flaw in an internet-facing service like SharePoint or Remote Desktop Services requires immediate emergency patching and potential temporary isolation of the service. An Elevation of Privilege flaw in a component only reachable by local users can follow a slightly more structured rollout — though this month’s actively exploited EoP makes even that calculus more urgent than usual.

37 Remote Code Execution Flaws

Remote Code Execution vulnerabilities dominate this month’s Critical category, and for good reason — they represent the most direct path from “attacker on the internet” to “attacker inside your network.” Of the 62 Critical vulnerabilities patched this August, 37 are RCE flaws spanning Windows kernel components, Remote Desktop Services, Microsoft Message Queuing (MSMQ), and network protocol handlers. The sheer volume means that even organizations with aggressive patch cycles will need to triage carefully — not every RCE carries the same exploitability in practice, but the 9.8-scored ones must be treated as immediate threats.

5 Elevation of Privilege Vulnerabilities

Five of the Critical-rated vulnerabilities this month are Elevation of Privilege flaws, including the actively exploited CVE-2026-68820. EoP vulnerabilities are the engine of post-exploitation — they are what attackers use after they get in to gain the access they need to do real damage. In ransomware attack chains specifically, EoP exploits against Windows kernel components are almost universally present between the initial access stage and the ransomware deployment stage. Patching these isn’t just about preventing initial compromise; it’s about breaking the kill chain mid-attack. For instance, the CISA’s mandate to patch critical vulnerabilities highlights the importance of addressing these flaws promptly.

SharePoint RCE Chain: Why Both July and August Updates Are Required

The SharePoint situation this month is one of the more operationally complex patch requirements in recent memory. CVE-2026-64921 and CVE-2026-65665 are Critical RCE vulnerabilities in Microsoft SharePoint that cannot be fully remediated by applying only the August update. Microsoft’s guidance explicitly states that administrators must have the July 2026 cumulative update already installed before the August patch can properly close the vulnerability chain.

This is not a theoretical concern. Organizations that skipped or delayed July’s SharePoint patches — a common occurrence given the record-breaking 622-vulnerability release that month — are currently sitting on an unpatched Critical RCE even if they applied every August fix correctly. SharePoint Server is a frequent target for initial access because it is often internet-facing, handles authentication, and stores sensitive organizational data. An RCE vulnerability here gives attackers direct access to file repositories, intranet content, and potentially Active Directory-connected identity systems.

• Step 1: Confirm your SharePoint Server build version and verify the July 2026 cumulative update is installed.
• Step 2: Apply the August 2026 SharePoint security update on top of the July baseline.
• Step 3: Validate the installation completed without errors using the SharePoint Products Configuration Wizard.
• Step 4: Review SharePoint ULS logs for any anomalous activity from the July–August window that may indicate exploitation attempts.
• Step 5: If July patches were never applied, treat this as an active incident risk and consider temporarily restricting external access to SharePoint until both updates are confirmed deployed.

If you manage an on-premises SharePoint environment, this two-patch dependency should be your second priority this month — right behind the actively exploited WinSock zero-day.

Why This Patch Tuesday Is Bigger Than Usual

August 2026’s release did not happen in isolation. It is the latest chapter in what has become a dramatically escalating volume of monthly Microsoft patches throughout 2026. To put it plainly: the numbers we are seeing now would have been considered extraordinary just two years ago. Today they are becoming the new normal, and that shift has profound implications for how security and IT operations teams must be structured and resourced.

Consider the trajectory: June 2026 saw 206 vulnerabilities patched. July exploded to 622. August now clocks in at 400+. These are not random fluctuations — they reflect a fundamental change in how vulnerabilities are being discovered, catalogued, and disclosed. Understanding that change is essential to understanding why patch management has become one of the highest-stakes disciplines in enterprise security.

Microsoft’s AI-Powered Vulnerability Discovery Is Finding More Flaws, Faster

The primary driver behind the surge in CVE counts is Microsoft’s expanding use of AI-assisted vulnerability discovery tooling. By applying machine learning models to code analysis, fuzzing automation, and symbolic execution at scale, Microsoft’s security teams are surfacing vulnerabilities that would have taken human researchers months or years to find manually. The result is a pipeline of discoveries that compresses into each monthly release cycle — which is genuinely good news for long-term security, but creates a short-term operational burden that most enterprise patch programs were never designed to handle at this volume. For example, CISA mandates on patching vulnerabilities highlight the urgency and scale of addressing these security challenges.

How August 2026 Compares to July’s 622-Vulnerability Release

July 2026 was the largest single Patch Tuesday release on record, with 622 vulnerabilities patched in a single cycle — including two actively exploited zero-days of its own. August’s 400+ release is technically smaller by count, but the presence of an actively exploited zero-day and multiple 9.8-scored RCE vulnerabilities makes it arguably more urgent for immediate action.

What this comparison reveals is that organizations can no longer rely on any single month being a “light” release that gives teams time to catch up. The cadence has shifted permanently. Patch programs designed around the assumption of 80–120 CVEs per month are now structurally underpowered for 2026’s reality, and the teams still operating under those old assumptions are falling further behind with each release cycle.

Which Systems Face the Most Exposure

Product Family	Patches Issued	Critical Count	Highest Risk Factor
Windows (All Versions)	233	28	Actively exploited zero-day (CVE-2026-68820)
Microsoft Office	41	8	RCE via document open, CVSS 7.8–8.4
Microsoft SharePoint	12	6	Critical RCE chain requiring July + August patches
Remote Desktop Services	18	7	Network-exploitable RCE, no authentication required
Extended Security Updates (ESU)	29	5	Legacy systems with limited patching infrastructure
Microsoft Message Queuing	11	4	MSMQ RCE exploitable over network port 1801
Azure & Cloud Components	22	4	Cross-tenant data exposure potential

Windows dominates the exposure landscape this month simply by volume — 233 patches across a product that runs on virtually every enterprise endpoint, server, and infrastructure component. But raw patch count alone doesn’t tell the full risk story. The more nuanced view is that internet-facing services — SharePoint, Remote Desktop Services, and MSMQ — carry disproportionate risk because they can be reached directly by external attackers without requiring any insider access or social engineering.

Remote Desktop Services deserves particular attention in environments where RDP is exposed to the internet, either intentionally or through misconfiguration. RDS has been a perennial target for ransomware operators and nation-state actors alike, and this month’s seven Critical patches in that component alone should prompt a review of whether RDP exposure is truly necessary and properly gated behind VPN or network-level authentication. For more information on the latest patches, you can read the Microsoft August 2026 Patch Tuesday report.

Organizations running Extended Security Update (ESU) environments — typically those still operating Windows Server 2012 or Windows 10 on paid extended support — face a compounded challenge. The patching infrastructure for these legacy systems is often less automated, the systems themselves may be harder to reboot without operational disruption, and the 29 patches required this month represent a significant manual effort for teams already stretched by the broader release. For those managing these environments, it’s crucial to stay informed about vulnerabilities such as the Cisco flaw that CISA has mandated to be patched promptly.

Windows Gets 233 Patches — The Highest of Any Product

The 233 Windows patches span every currently supported version: Windows 10, Windows 11 (versions 22H2, 23H2, and 24H2), Windows Server 2019, 2022, and 2025. The Windows 11 KB5121003 and KB5120240 cumulative updates and the Windows 10 KB5120249 update are the primary delivery vehicles for this month’s security fixes on their respective platforms. These are not optional quality updates — they are the security patch packages, and deploying them is the only supported method to close the vulnerabilities addressed this month.

Microsoft Office and Extended Security Updates Also Heavily Affected

Microsoft Office’s 41 patches this month include Critical RCE vulnerabilities that can be triggered through maliciously crafted documents — the classic phishing delivery mechanism that has never gone out of style. CVE-2026-70130 specifically affects Office components with a CVSS of 8.4 and can execute code when a user opens a weaponized file. In environments where macro policies are not enforced and email attachment filtering is not aggressive, this is a realistic and immediate threat vector.

For organizations in manufacturing, healthcare, legal, and financial services — sectors where document sharing is constant and email security tooling is often inconsistently deployed — the Office RCE patches this month are not background noise. They are a direct threat to the workflows your business runs on every day. In light of recent vulnerabilities, it’s crucial to stay updated with security advisories like the CISA mandate on patching critical flaws.

How to Prioritize and Apply These Patches

Faced with 400+ patches, the worst thing a security team can do is either panic-patch everything simultaneously (risking operational disruption from untested updates) or freeze in analysis paralysis and patch nothing on an accelerated timeline. The right approach is a structured, risk-tiered deployment strategy that matches patch urgency to actual exploitation likelihood in your specific environment. For further guidance, consider reading this exploit storm preparation guide.

The framework below is built on two inputs: Microsoft’s own severity ratings and exploitation status, and the real-world attack surface most enterprise environments share. Your specific environment may require adjustments — a company with no on-premises SharePoint can deprioritize those patches, for example — but the zero-day and 9.8-scored RCEs are non-negotiable regardless of environment.

1. Patch CVE-2026-68820 First — It Is Already Being Exploited

There is no triage decision to make here. CVE-2026-68820 is confirmed actively exploited, affects a kernel-level component present on every Windows system, and enables full SYSTEM-level privilege escalation. This patch should be deployed through emergency change procedures — bypassing normal monthly patch windows if necessary — across all Windows endpoints and servers simultaneously. If your organization has a tiered deployment model that tests patches in dev before prod, compress that timeline to 24 hours maximum for this CVE. The risk of a bad patch is substantially lower than the risk of remaining unpatched against an actively weaponized exploit.

For endpoint detection in the interim — specifically for any systems that cannot be patched immediately — focus your detection rules on anomalous kernel driver activity from AFD.sys, unexpected SYSTEM-level process spawning from user-mode applications, and privilege escalation events in your EDR telemetry from late July onward.

Priority Tier	CVEs / Updates	Target Deployment Window	Rationale
P1 — Emergency	CVE-2026-68820 (WinSock Zero-Day)	Within 24 hours	Actively exploited in the wild
P2 — Critical	CVSS 9.8 RCE CVEs, RDS patches	Within 48–72 hours	Network-exploitable, no auth required
P3 — High	SharePoint CVE-2026-64921 & 65665, Office RCEs	Within 1 week	High-value targets, active threat actor interest
P4 — Standard	Remaining Important/Moderate CVEs	Within normal patch cycle (2–4 weeks)	No confirmed exploitation, lower CVSS scores
P5 — ESU Systems	KB5120249 and legacy platform patches	Within 2 weeks with change management	Legacy infrastructure, higher operational risk to patch

Use this tiering as your internal communication framework as well — it gives leadership a clear picture of what is being done and why, and it gives your operations teams the sequencing they need to avoid simultaneous reboots across critical infrastructure. Clear prioritization under pressure is what separates reactive security teams from resilient ones.

2. Address All CVSS 9.8 RCE Vulnerabilities Before End of Week

After securing the zero-day, your next 48–72 hours should be entirely focused on the network-exploitable RCE vulnerabilities carrying a CVSS score of 9.8. These flaws represent the clearest path from an external attacker to code execution inside your environment — no phishing email required, no employee mistake needed, no authentication to bypass. If the affected service is reachable from the internet, the exposure window is essentially open to anyone with a working exploit.

Remote Desktop Services vulnerabilities in this release demand particular urgency. RDP-exposed systems have been among the most consistently targeted assets in ransomware intrusions for the past four years running, and this month’s Critical RDS patches close gaps that are precisely the type ransomware operators probe for during their initial access phase. If your organization has RDP exposed directly to the internet without VPN or network-level authentication gating it, that configuration is an emergency in its own right — independent of this month’s patches.

CVE	Affected Component	CVSS Score	Attack Vector	Auth Required
CVE-2026-64921	Microsoft SharePoint Server	9.8	Network	None
CVE-2026-65665	Microsoft SharePoint Server	9.8	Network	None
CVE-2026-70130	Microsoft Office	8.4	Local / Email delivery	None
Multiple RDS CVEs	Remote Desktop Services	9.8	Network	None
Multiple MSMQ CVEs	Microsoft Message Queuing	9.8	Network (Port 1801)	None

For MSMQ specifically — a component many administrators forget is even running — verify whether Message Queuing is actually enabled on your servers before prioritizing those patches. If MSMQ is not in use in your environment, consider disabling the service entirely as a hardening measure. Reducing your exposed attack surface by disabling unused services is one of the highest-value, lowest-effort defensive actions available.

3. Update On-Premises SharePoint With Both July and August Fixes

This is the step that will catch organizations off guard if they are not paying attention. The Critical RCE vulnerabilities CVE-2026-64921 and CVE-2026-65665 in Microsoft SharePoint Server cannot be closed by the August patch alone. You must have the July 2026 cumulative update installed as a prerequisite before the August fix can properly complete the remediation chain. Start by auditing your SharePoint Server build numbers across every farm. If any server missed July’s update, apply it first, run the SharePoint Products Configuration Wizard to completion, verify there are no pending timer job failures, and only then apply the August security update. Any SharePoint Server that went through August patching without July already in place should be treated as still-vulnerable and prioritized immediately for the full two-patch sequence.

4. Apply Windows 11 KB5121003 and KB5120240 Cumulative Updates

For Windows 11 environments, August’s security fixes are delivered through two cumulative updates depending on the version in use: KB5121003 for Windows 11 version 24H2 and KB5120240 for versions 22H2 and 23H2. Both packages bundle all security patches from this month’s release — there are no separate standalone security-only packages for Windows 11 in this cycle. These updates include the fix for CVE-2026-68820 along with all Critical and Important-rated patches for Windows components. Deploy these through Windows Update, Microsoft Update Catalog, Windows Server Update Services (WSUS), or your endpoint management platform of choice — but verify deployment confirmation reports rather than relying on assumed success. A failed or stalled update that registers as pending is not a patched system, and in an environment of 400+ CVEs, the difference matters.

5. Deploy Windows 10 KB5120249 for Extended Security Update Environments

Organizations running Windows 10 under Extended Security Updates — whether through Microsoft’s ESU licensing program or via Azure Arc for on-premises machines — must deploy KB5120249 to receive this month’s security fixes. The operational reality of ESU environments is that many of these systems exist in manufacturing, healthcare, or industrial control system contexts where reboots require scheduled maintenance windows, application compatibility testing, and coordination across multiple teams. That complexity is real, but it cannot become an excuse for indefinite deferral on a month with an actively exploited zero-day.

The practical recommendation for ESU environments is to use this month’s release as the forcing function for a broader conversation: every Windows 10 system still in production is a system running on borrowed time, both from a security support perspective and from the increasing difficulty of defending legacy platforms against modern threat actors. The ESU program provides a bridge, not a destination.

• Verify ESU licensing coverage is current and confirms your Windows 10 builds are receiving updates — unlicensed ESU systems will not receive patches through Windows Update automatically.
• Check Azure Arc enrollment for on-premises Windows 10 machines if you are using the free ESU through Arc licensing model — unenrolled machines are silently excluded from ESU patch delivery.
• Test KB5120249 in a representative staging environment for at least 24 hours before broad deployment, specifically validating any line-of-business applications that interact with networking APIs, given the WinSock driver changes in this update.
• Document all systems that cannot receive the patch within your target window, maintain compensating controls (network segmentation, enhanced monitoring, restricted access), and escalate persistent blockers to leadership with a clear risk statement.
• Accelerate Windows 11 migration planning — every month of delay on ESU systems is another month of operating on a platform with a shrinking security ecosystem and growing compatibility burden.

ESU environments require more hands-on management than modern Windows deployments, but the security obligations are identical. A legacy system with an unpatched actively exploited zero-day is just as compromised as a modern one.

August 2026 Patch Tuesday: Final Priority Verdict for IT Teams

August 2026’s Patch Tuesday is a genuinely serious release that demands more than routine patch management. The combination of an actively exploited kernel zero-day, multiple 9.8-scored network-exploitable RCE vulnerabilities, a two-patch SharePoint dependency chain, and 62 Critical CVEs across 400+ total fixes creates a response workload that exceeds what most monthly cycles demand. This is not a release you schedule for the end of the month.

The non-negotiables are clear: CVE-2026-68820 gets patched within 24 hours under emergency change procedures. The CVSS 9.8 RCE vulnerabilities — particularly in Remote Desktop Services and SharePoint — get addressed within 72 hours. SharePoint administrators must audit July patch compliance before assuming August’s fixes are sufficient. Windows 11 KB5121003 and KB5120240, along with Windows 10 KB5120249, are the delivery vehicles for all of this month’s Windows security content and must be confirmed deployed — not just initiated.

Beyond this month, the trajectory of 2026’s Patch Tuesday releases — from 206 in June, to 622 in July, to 400+ in August — is a signal that patch management programs built for a previous era are no longer fit for purpose. Teams that are still treating monthly patches as a secondary IT operations function rather than a primary security control are accumulating risk faster than they realize. The organizations that will handle next month’s release better are the ones that use this month as the catalyst to restructure how they triage, test, and deploy Microsoft security updates at scale.

Frequently Asked Questions

Below are the most common questions surrounding August 2026 Patch Tuesday, answered directly for both security professionals and IT administrators managing the response.

What is the most urgent patch to apply from August 2026 Patch Tuesday?

Vulnerability	CVE ID	Urgency Level	Reason
WinSock Driver EoP	CVE-2026-68820	🔴 Emergency	Actively exploited before patch existed
SharePoint RCE Chain	CVE-2026-64921, CVE-2026-65665	🟠 Critical	Requires July + August patches, CVSS 9.8
RDS Remote Code Execution	Multiple	🟠 Critical	Network-exploitable, no authentication needed
Office RCE	CVE-2026-70130	🟡 High	CVSS 8.4, document-triggered execution

The most urgent patch from August 2026 Patch Tuesday is the fix for CVE-2026-68820, the Windows Ancillary Function Driver for WinSock use-after-free vulnerability. It is the only actively exploited zero-day in this release, confirmed by Microsoft as being weaponized in real attacks before the patch was available on August 11th.

This fix is delivered as part of the Windows cumulative updates — KB5121003 for Windows 11 24H2, KB5120240 for Windows 11 22H2/23H2, and KB5120249 for Windows 10 ESU environments. There is no standalone patch for just CVE-2026-68820; the cumulative update is the only supported remediation path. This means you cannot cherry-pick just the zero-day fix — the cumulative update must be deployed in full. For more information on patching requirements, see how CISA mandates federal agencies to patch critical flaws.

Organizations that have EDR solutions deployed should also push new detection content targeting anomalous AFD.sys behavior as a compensating control during any patching window where systems cannot be updated immediately. Detection is not remediation, but it buys critical response time if an exploitation attempt occurs on an as-yet-unpatched system.

Finally, review your incident logs retrospectively from late July 2026 onward. If this vulnerability was being exploited before August 11th, there is a non-trivial possibility that some organizations were compromised before the patch existed. Unexplained SYSTEM-level process activity, new scheduled tasks created by unexpected accounts, or unusual outbound connections from Windows infrastructure in that window should be investigated as potential indicators of pre-patch exploitation.

What does a CVSS score of 9.8 mean and how serious is it?

A CVSS score of 9.8 represents a near-maximum severity rating, placing a vulnerability in the Critical tier of the 0–10 Common Vulnerability Scoring System scale. In practical terms, it means an attacker can exploit the vulnerability over the network, without needing any credentials, without requiring any action from a user, and with a high probability of achieving full system compromise. Learn more about the importance of addressing max severity vulnerabilities to protect your systems.

• 0.0–3.9: Low severity — limited impact, typically requires significant prerequisites or local access
• 4.0–6.9: Medium severity — exploitable but with meaningful constraints on attack vector or impact
• 7.0–8.9: High severity — serious vulnerabilities requiring prompt patching within standard cycles
• 9.0–10.0: Critical severity — maximum priority, often network-exploitable with no authentication required

A score of 9.8 specifically versus a perfect 10.0 typically indicates a minor technical constraint — often that the scope impact is limited to the vulnerable component itself rather than affecting adjacent systems, or that there is a marginal complexity factor in achieving consistent exploitation. In practice, this distinction is operationally irrelevant. A 9.8 should be treated identically to a 10.0 in your patch prioritization framework.

When multiple 9.8-scored vulnerabilities exist in the same release — as they do in August 2026 — the compounding risk is significant. An attacker does not need to find the single hardest target; they can simply probe across your environment for whichever 9.8 vulnerability happens to be exposed and unpatched first. Diversity of 9.8 CVEs across different components means that no single product team owns the entire risk — it is an organization-wide response requirement.

What is CVE-2026-68820 and why is it actively exploited?

CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD.sys) — a kernel-mode driver that handles the Windows Sockets API layer. The flaw allows a locally authenticated attacker to trigger a memory corruption condition that results in SYSTEM-level privilege escalation, giving them complete control over the affected Windows machine. It is classified as an Elevation of Privilege vulnerability with a CVSS score reflecting its kernel-level impact.

It is actively exploited because it solves a core problem in the attacker’s kill chain: getting from initial access to full system control. Most initial access techniques — phishing, credential stuffing, web application exploitation — land an attacker in a limited user context. CVE-2026-68820 takes that limited foothold and converts it into unrestricted SYSTEM access within seconds. For ransomware operators and APT groups alike, a reliable EoP exploit in a universally present Windows kernel driver is an extraordinarily valuable tool, which is why it was being weaponized before Microsoft had a fix available.

Do I need both the July and August patches to fix the SharePoint RCE vulnerability?

Yes, absolutely. The Critical RCE vulnerabilities CVE-2026-64921 and CVE-2026-65665 in Microsoft SharePoint Server require both the July 2026 and August 2026 cumulative updates to be fully remediated. Applying only the August patch without the July update in place will not close the vulnerability chain. Microsoft’s official guidance explicitly lists the July cumulative update as a prerequisite for the August SharePoint security fix. Any SharePoint Server administrator who skipped or deferred July’s update — understandable given the record-breaking volume of that month’s release — must now apply both updates in sequence, running the SharePoint Products Configuration Wizard after each installation to ensure the patch is properly applied to all servers in the farm. For more on cybersecurity updates, check out this CISA mandate on patching Cisco flaws.

Why did Microsoft release so many patches in August 2026?

The volume of August 2026’s Patch Tuesday release — and the broader surge throughout 2026 — is primarily driven by Microsoft’s expanded use of AI-assisted vulnerability discovery tooling. By applying machine learning to automated code analysis, fuzzing pipelines, and symbolic execution at scale, Microsoft’s security teams are finding vulnerabilities in existing code at a rate that human researchers alone could never sustain. The result is a compressed pipeline where months of potential discoveries are surfaced and validated in weeks, feeding into each monthly Patch Tuesday cycle.

There is also a secondary factor: as Microsoft has expanded its product surface — through Azure, Microsoft 365, Teams, and a growing ecosystem of enterprise services — the number of components that must be assessed for vulnerabilities each month has grown substantially. More products, more code, more potential vulnerabilities — and now more automated tooling to find them faster than ever before.

• AI-assisted fuzzing and code analysis surfaces vulnerabilities faster than traditional manual research
• Expanded Microsoft product surface across cloud, hybrid, and on-premises components increases the total CVE pool
• Coordinated vulnerability disclosure timelines from external researchers concentrate discoveries into monthly cycles
• Increased third-party security research investment targeting Microsoft products drives higher submission volumes to Microsoft’s Security Response Center
• Proactive internal security reviews triggered by high-profile incidents historically produce waves of related vulnerability discoveries in adjacent components

The silver lining — and it is a genuine one — is that vulnerabilities found by Microsoft’s own tooling and patched proactively are vulnerabilities that did not have to be discovered through an active breach. The alternative to finding and patching 400 vulnerabilities per month is not “having 400 fewer vulnerabilities” — it is “having 400 unidentified vulnerabilities that attackers may already know about.”

What this means in practice for IT and security teams is that the organizational infrastructure around patch management needs to evolve in parallel with Microsoft’s discovery pace. Teams that have not already invested in automated patch deployment, risk-based CVE triage tooling, and integration between vulnerability management and ITSM platforms are going to find each successive release more difficult to manage than the last.

August 2026 Patch Tuesday is a clear reminder that cybersecurity is not a problem you solve once — it is an operational discipline that demands continuous investment, structured processes, and a team that can move quickly when an actively exploited zero-day lands on a Tuesday morning. For organizations looking to strengthen their vulnerability management and threat response programs, engaging with expert cybersecurity advisory resources is one of the highest-leverage investments available in today’s threat landscape.

The August Patch Tuesday update addresses a critical zero-day vulnerability in Windows, which was being actively exploited in the wild. This update also fixes several other high-severity vulnerabilities, including a 9.8-rated remote code execution flaw. Organizations are urged to apply these patches promptly to mitigate potential risks. For more insights on cyber threats, check out the UAE cyber threat warning regarding rising malware risks.