Microsoft’s August update fixes a Windows flaw that’s already being attacked
As part of August’s Patch Tuesday, Microsoft released security updates that address 398 new vulnerabilities. Alongside Windows and Office, other products and services are also affected: Teams, Exchange Server, Hyper-V, Windows Defender, Visual Studio, and Microsoft’s cloud services.
Microsoft classifies 42 of the vulnerabilities as critical. Among the remainder, all but one are classified as high risk. One Windows flaw is already being exploited in the wild, while two vulnerabilities were already publicly known beforehand.
The next scheduled Patch Tuesday will be on September 8th, 2026.
Windows security updates
A large number of the vulnerabilities—over 200 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates. Windows 10’s support officially ended in October 2025, but those enrolled in the Extended Security Updates (ESU) program continue to receive security updates until October 2027.
Attacks on Winsock
The only Windows security vulnerability in this month’s update that’s already being exploited in the wild is the use-after-free (UAF) vulnerability CVE-2026-68820, in the Windows auxiliary function driver for Winsock. Attackers can gain elevated privileges, allowing them to execute code with system privileges. To do this, they must combine this exploit with another remote code execution (RCE) vulnerability.
Critical Windows vulnerabilities
Microsoft has classified 18 Windows security vulnerabilities as critical. These include, for example, the RCE vulnerability CVE-2026-62878 in the Windows DNS server. If successful, the buffer overflow can be exploited to execute code with elevated privileges without user interaction.
The UAF vulnerability CVE-2026-62893 in the Trivial File Transfer Protocol (TFTP) server of Windows Deployment Services could be exploited via UDP port 69 to inject and execute code without user interaction. The flaw stems from actions being performed on an object without first checking whether the object in question actually exists.
The RCE vulnerability CVE-2026-62815 in Quick UDP Internet Connections (QUIC) can also be used to execute injected code without user interaction. Although only classified as high risk, it also contains the RCE vulnerability CVE-2026-59124. But since Microsoft’s High Performance Computing (HPC) Pack isn’t enabled by default, the vulnerability isn’t considered critical—even if attackers could use it to execute injected code.
Tip: Whether you keep your Windows up to date, you need proper antivirus protections if you want your PC to remain secure and private. Check out our picks for the best antivirus software for Windows as well as best VPN services to stay ahead of security problems.
Microsoft Office security updates
Microsoft has fixed 128 security vulnerabilities in its Office products. These include 22 RCE vulnerabilities classified as critical, five of which are in the Office graphics component. With critical RCE vulnerabilities in Office, the preview pane is often the attack vector—a user doesn’t need to actually open a file with Office for an attack to succeed.
RCE vulnerabilities classified as high risk can be exploited if a user opens a malicious Office file in a vulnerable Office product (open-and-own).
Exchange Server security updates
Microsoft has fixed seven security vulnerabilities in Exchange Server.
The elevation of privilege (EoP) vulnerability CVE-2026-62911 is classified as critical, and the exploitability of this flaw was successfully demonstrated in May at the Pwn2Own hacking competition in Berlin. An attacker can bypass user authentication and take control of all email accounts, send and receive emails, and download attachments.
The remaining six vulnerabilities are classified as high risk, including the RCE vulnerability CVE-2026-62913.
Microsoft Edge security updates
The latest security update to Edge 151.0.4129.78 is dated August 10th and is based on Chromium 151.0.7922.109. It addresses 41 Chromium vulnerabilities, which aren’t included in the total number of vulnerabilities mentioned above. The next Chrome/Chromium update, which addresses five vulnerabilities, is due out this week.
