Microsoft August Patch Tuesday fixes 90 critical flaws
Microsoft has closed out a heavy August Patch Tuesday release, delivering security updates that reach across the entire Windows estate and into the company’s cloud and developer platforms. The August 2026 update addresses more than 390 documented vulnerabilities, including 42 rated Critical, according to the Microsoft Security Response Center (MSRC) update guide. The patches cover Windows, Office, SharePoint, Exchange Server, .NET, Visual Studio Code, GitHub Copilot, Azure CycleCloud, Microsoft Teams, and even AMD silicon, making this one of the most expansive monthly security releases in recent memory.
The scale alone would be enough to demand attention, but this is not just a volume story. The update includes remote code execution fixes for some of the most sensitive infrastructure components an enterprise runs, including Windows DNS Server, Active Directory Certificate Services, DHCP Server, Routing and Remote Access Service, and Windows Secure Socket Tunneling Protocol. It also contains a long list of elevation of privilege fixes that target the second half of the attack chains that cybercriminals rely on after an initial foothold is established. For security teams, this is a patch Tuesday that should be treated as a priority event, not a routine monthly synchronization.
The Microsoft August Patch Tuesday breakdown: severity, scope, and affected products
Looking at the raw numbers, the August 2026 release is unusually large. The MSRC update guide lists more than 390 CVEs, with 42 rated Critical, roughly 350 rated Important, and one rated Moderate. The lone Moderate is CVE-2026-56179, a Windows Network Address Translation (NAT) spoofing vulnerability that Microsoft has judged to be a lower practical risk.
For administrators who only track Critical-severity bugs, this month’s release is a reminder that the Important bucket is not a place to procrastinate. Important-severity vulnerabilities are still security flaws that Microsoft deems serious enough to document, patch, and publish, and many of them are routinely incorporated into attack chains. A large share of the Important-rated issues in this release are local privilege escalation flaws, which are less glamorous than remote code execution but just as valuable to attackers who have already compromised an endpoint.
How many vulnerabilities did Microsoft fix in August 2026?
Microsoft fixed more than 390 vulnerabilities in the August 2026 Patch Tuesday release. The update includes 42 Critical-rated flaws, roughly 350 Important-rated flaws, and one Moderate-rated flaw. The patches cover Windows, Office, SharePoint Server, Exchange Server, .NET, Visual Studio Code, Azure CycleCloud, Microsoft Teams, and Microsoft Defender for Endpoint, among other products.
What are the most serious vulnerabilities in the August 2026 Patch Tuesday?
The most serious vulnerabilities include remote code execution flaws in Windows DNS Server, DHCP Server, Active Directory Certificate Services, Routing and Remote Access Service, Remote Desktop Client, Windows GDI+, and Microsoft QUIC. Critical elevation of privilege flaws also appear in Windows Key Guard and Windows GDI+. The Office and SharePoint product families account for a significant share of the Critical-rated updates, including multiple Excel and Word remote code execution flaws.
Network infrastructure under fire: DNS, DHCP, and server-side RCEs
Several of the most demanding fixes in this release are aimed at the kind of infrastructure that is often left untouched because patching it feels risky. Windows DNS Server is particularly prominent, with multiple Critical-severity remote code execution updates including CVE-2026-62817, CVE-2026-62820, CVE-2026-62878, and CVE-2026-65789. DNS servers are unique in that they are exposed to the network by design, and a successful compromise can give an attacker a foothold inside the perimeter or a way to redirect traffic. There are also several Important-rated Windows DNS elevation of privilege flaws in this release, along with a DNS Server remote code execution flaw tracked as CVE-2026-62787.
Windows DHCP Server is another focus. The update includes CVE-2026-62823, a Critical remote code execution vulnerability, as well as a series of Important-rated DHCP Server elevation of privilege and information disclosure flaws. DHCP servers are common targets because they often run on domain controllers in smaller and mid-sized organizations, and they process attacker-influenced network traffic continuously.
Active Directory Certificate Services also received a Critical remote code execution patch under CVE-2026-62818. AD CS is an increasingly attractive target for attackers because certificate misconfigurations and vulnerabilities can lead to domain escalation. A flaw that allows remote code execution in a certificate service is the kind of issue that red teams and threat actors will move quickly to exploit once details are public.
The update also addresses CVE-2026-62819, a Critical remote code execution flaw in Routing and Remote Access Service, and CVE-2026-62816, a Critical remote code execution vulnerability in the Windows Reliable Multicast Transport Driver. Microsoft QUIC appears both as a Critical remote code execution issue under CVE-2026-62815 and as an Important information disclosure flaw under CVE-2026-62898. Windows Secure Socket Tunneling Protocol is patched for a Critical remote code execution vulnerability under CVE-2026-62889, and Windows Deployment Services TFTP Server gets its own Critical remote code execution fix under CVE-2026-62893.
Below the Critical threshold, this release patches a broad set of network-facing components, including Windows LDAP, SMB Client and SMBv3 Server, TCP/IP, HTTP.sys, the RPC Runtime Library, and the Local Security Authority Server. Individually these are rated Important, but they operate in the network path and should not be treated as low priority. The overall pattern is clear: this month’s update is heavily weighted toward the protocols and services that quietly carry enterprise traffic.
Microsoft Office and SharePoint: a document-format hazard zone
The Office family is a substantial part of this release, and the volume of updates is striking. Microsoft Excel alone accounts for more than 20 CVEs, with remote code execution fixes appearing across dozens of file-handling paths. Three Excel RCE flaws are rated Critical: CVE-2026-68816, CVE-2026-68804, and CVE-2026-68794. The remaining Excel issues are distributed between Important-rated remote code execution and information disclosure vulnerabilities, covering the usual range of malformed files and crafted content.
Microsoft Word is similarly active, with Critical remote code execution patches under CVE-2026-64907, CVE-2026-63525, and CVE-2026-63518, along with a series of Important-rated Word RCE and information disclosure fixes. PowerPoint appears mostly on the information disclosure side, while Microsoft Access receives several Important-rated remote code execution patches. The Microsoft Office Graphics Component is a recurring trouble spot, with Critical RCE fixes under CVE-2026-66807, CVE-2026-65664, CVE-2026-63526, CVE-2026-63519, and CVE-2026-63513. Because the graphics engine is shared across Office applications, a single vulnerable code path can expose Word, Excel, PowerPoint, and other document workflows at once.
SharePoint Server also takes up a large part of the release. The most serious items are CVE-2026-65665, a Critical remote code execution vulnerability, and CVE-2026-64921 and CVE-2026-62827, both Critical elevation of privilege flaws. The update also includes numerous Important-rated SharePoint Server issues covering spoofing, tampering, information disclosure, and remote code execution. SharePoint is an attractive target because it is a server-side repository of documents and collaboration data, and it often runs with a highly privileged service account. A successful exploit in SharePoint can give an attacker access to sensitive enterprise documents or provide a bridge to the underlying Microsoft 365 environment.
The practical takeaway for defenders is that document-borne attacks remain one of the most reliable ways into an organization. Many of the Office RCEs in this release can be triggered by opening a crafted file, and some may be reachable through the preview pane. Even with Protected View and application sandboxing in place, the number of fixes here suggests that the document-processing pipeline still represents a wide and exposed attack surface.
Elevation of privilege: the quiet backbone of the release
As is typical for a modern Patch Tuesday, elevation of privilege dominates the list by sheer volume. Windows Installer alone appears multiple times, with Important-rated EoP patches under CVE-2026-70347, CVE-2026-70346, CVE-2026-70345, CVE-2026-70344, and several follow-on CVEs. The Windows kernel, Win32k, and the Windows Telephony Service each show up repeatedly in the EoP column. So do Windows DNS, DHCP Server, HTTP.sys, Kerberos, NTFS, the Cloud Files Mini Filter Driver, the Desktop Window Manager, and the Common Log File System Driver.
Two EoP bugs stand out because Microsoft rated them Critical. CVE-2026-66799 is an elevation of privilege vulnerability in Windows Key Guard, and CVE-2026-62890 is an elevation of privilege flaw in Windows GDI+. EoP issues are rarely wormable on their own, but they are the standard second stage in an attack: an attacker who gains code execution as a normal user through a phishing email or a browser exploit needs an EoP bug to reach SYSTEM or administrator privileges. The density of EoP fixes in this release is a reminder that endpoint hardening is never finished.
The Windows Telephony Service deserves particular mention because Microsoft patched eight separate EoP vulnerabilities in that component. Telephony services run by default in many Windows configurations, and a single vulnerable service that yields SYSTEM is enough to undermine an entire endpoint. The same logic applies to the repeated Windows Installer and Win32k fixes: these are well-trodden privilege escalation targets for attackers who have already breached the user context.
Developer tools, cloud services, and the AI surface
Beyond the core Windows and Office releases, the August 2026 update shows how much of Microsoft’s security burden now sits in developer tools and cloud services. Visual Studio Code receives multiple remote code execution and security feature bypass patches, including CVE-2026-70336, CVE-2026-69320, CVE-2026-69306, and CVE-2026-69278. GitHub Copilot and Visual Studio Code are the subject of an Important elevation of privilege issue under CVE-2026-70335. The Visual Studio Code Python Extension is also patched for a security feature bypass under CVE-2026-54981.
PowerShell appears with a remote code execution flaw under CVE-2026-70337, a security feature bypass under CVE-2026-70338, an elevation of privilege issue under CVE-2026-59119, and an information disclosure flaw under CVE-2026-58612. .NET and .NET Framework receive a broad set of updates covering remote code execution, elevation of privilege, denial of service, information disclosure, and security feature bypass. Power BI gets an Important remote code execution patch under CVE-2026-65811.
The cloud and collaboration side is also well represented. Azure CycleCloud has both an elevation of privilege flaw and an information disclosure flaw. Microsoft Entra Connect receives an elevation of privilege patch, and Azure Storage Explorer is updated for an EoP issue. Microsoft Teams appears with remote code execution, spoofing, and information disclosure fixes across iOS and Android. Microsoft OneDrive for macOS has an elevation of privilege patch, and Microsoft Defender for Endpoint for Mac receives an information disclosure fix. Microsoft Dynamics 365 On-Premises is patched for both remote code execution and information disclosure vulnerabilities.
It is notable how much of this release targets non-Windows platforms and AI-adjacent workloads. CoPilot Chat appears with a security feature bypass vulnerability under CVE-2026-65675. The inclusion of GitHub Copilot, CoPilot Chat, Visual Studio Code, and the Python Extension is a clear signal that Microsoft’s threat modeling has expanded well beyond the traditional OS and office productivity surface. Organizations that have deployed these tools need to include them in the patch management scope, because attackers are actively probing development environments and AI tooling for entry points.
The AMD Zen connection: microarchitectural disclosure arrives in the Windows patch queue
One of the more distinctive entries in this release is a pair of information disclosure vulnerabilities related to AMD Zen processors: CVE-2026-59131 and CVE-2026-59130. These are hardware-level flaws that Microsoft is addressing through Windows updates, a pattern that has become more common since the Spectre and Meltdown era.
The presence of AMD-specific CVEs in a Microsoft Patch Tuesday release shows how closely operating systems and silicon vendors now cooperate on hardening. The exact details of these vulnerabilities are not fully described in the MSRC listing, but information disclosure flaws tied to CPU internals can involve speculative execution, cache timing, or other microarchitectural side channels. For security teams running AMD-based infrastructure, these updates are worth tracking even though the severity rating is Important. Hardware-level mitigations often require both a firmware update and an OS update, so the Windows patch is only part of the equation.
How to prioritize the August 2026 patches
With more than 390 vulnerabilities to consider, no security team should approach this release as a single undifferentiated list. The first priority should be internet-facing and infrastructure services: Windows DNS Server, DHCP Server, Active Directory Certificate Services, RRAS, SSTP, and the Remote Desktop Client. These are the components most likely to be reachable by an attacker without credentials or to be involved in domain-wide compromise. The DNS Server RCE patches should be moved to the top of the queue in any organization that runs Windows DNS, and the AD CS patch under CVE-2026-62818 deserves a similarly aggressive timeline.
The second priority is the Office family. Given how many Excel, Word, PowerPoint, Access, and Graphics Component vulnerabilities are being fixed, users should receive updated Office builds as quickly as possible. Email and document delivery remain the most common infection vector for most organizations, and the difference between patching Office in days versus weeks can be the difference between a contained incident and a full breach.
For endpoints, the sheer number of elevation of privilege fixes means that full operating system patching is essential. A defender who only installs Critical-rated updates will miss most of this release, since the bulk of the Windows kernel, Win32k, Installer, Telephony Service, and driver fixes are rated Important. That said, testing is still necessary. Some of these components are sensitive, and a flawed update can disrupt authentication, networking, or line-of-business applications. The MSRC update guide provides the full list of CVEs with severity ratings, and administrators should use it to build a staged deployment plan.
Finally, this release should push organizations to expand their patching scope beyond the traditional desktops and servers. Visual Studio Code, GitHub Copilot, PowerShell, .NET, Power BI, Azure CycleCloud, Microsoft Teams, OneDrive, Defender for Endpoint for Mac, and even CoPilot Chat are all now part of the monthly update cadence. A robust asset inventory that includes developer workstations, cloud services, and AI tools is no longer optional. It is the foundation of any realistic Patch Tuesday strategy.
The August 2026 release is a vivid reminder that the modern attack surface is broader than any single product category. Microsoft has patched everything from CPU microarchitectural flaws to document parsers to AI assistant security feature bypasses, and the volume is unlikely to shrink in the coming months. The organizations that consistently treat Patch Tuesday as a formal, well-tested process are the ones that will stay ahead of attackers who are already scanning for unpatched systems the moment this update goes public.
