August’s Patch Tuesday release from Microsoft is significant with a total of 751 fixes, among which 108 are classified as critical. Notably, an elevation of privilege vulnerability in the Windows WinSock driver (CVE-2026-68820) has already been exploited. Additionally, two more vulnerabilities (CVE-2026-62832 and CVE-2026-72971) were disclosed but not yet exploited.
This security update is crucial for the Windows, Office, and Exchange products, with no updates for SQL Server mentioned for this month. Several critical issues were reported, particularly affecting server roles, including Windows DNS and DHCP servers, which pose significant risks with multiple critical remote code execution (RCE) flaws. The recommended testing should prioritize printing, fonts, and the Remote Desktop client, and include checks for the exploited flaw in afd.sys.
For known issues, both the client and server-side updates were released without any documented problems, although this could change as users may discover issues post-deployment. Previous known issues are resolved.
Between July and August, the Microsoft Security Response Center (MSRC) has revised 534 Common Vulnerabilities and Exposures (CVEs), mostly in Edge and standard updates for internal Microsoft products requiring user action. The bulk of these changes involved storage, identity, developer runtimes, and file-sharing systems.
Microsoft provided no service or enforcement deadlines for August, but critical dates are approaching for several Microsoft products, marking the end of support for some systems like Windows 10 LTSB and Office LTSC 2021. Windows Server 2022 will also enter extended support, reinforcing the need for timely updates.
This month saw significant updates in various areas:
- Windows: A total of 233 CVEs were addressed with a concentrated focus on elevation of privilege vulnerabilities, particularly impacting the DHCP and DNS services.
- Office: 120 vulnerabilities were identified, especially affecting Office applications and SharePoint Server, prompting immediate updates to prevent RCE risks.
- Exchange: On-premises Exchange Server received updates for seven vulnerabilities, stressing the importance of timely installations as it interfaces directly with the internet.
For those managing updates in development environments, 23 CVEs concerning .NET and Visual Studio tools need attention alongside the more pressing updates in Windows and Office.
Lastly, Adobe issued a critical emergency fix for a severe flaw enabling unauthorized remote code execution, further emphasizing the importance of patch management across various software ecosystems.
Ensure to monitor the Microsoft Security Update Guide for the latest information and best practices related to these updates.