The August 2026 Security Update Review

I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “new normal”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, but still huge by historical standards. Take a break from your regularly scheduled activities as we let’s take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.Adobe Patches for August 2026For the first part of the August release, Adobe released five bulletins addressing 51 unique CVEs in Adobe ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic.Here’s this month’s overview table: Adobe Patches for August 2026 Adobe Patches for August 2026 Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority APSB26-90 Adobe ColdFusion 15 Critical 10.0 No 1 APSB26-123 Adobe Campaign Classic 3 Critical 10.0 No 1 APSB26-92 Adobe Commerce 7 Critical 9.1 No 2 APSB26-94 Adobe Lightroom Classic 11 Critical 8.6 No 3 APSB26-111 Content Credentials SDK 15 Critical 7.5 No 3 TOTAL 5 bulletins 51 If you’re running Campaign Classic, that’s your priority. Not only is it a deployment priority of 1, but it also contains two different CVSS 10 bugs and supersedes the patch that was just released on August 3. ColdFusion is also deployment priority 1 and also contains a CVSS 10 bug. Adobe Commerce rates a priority 2 with code execution bugs as high as CVSS 9.1. The patches for Lightroom Classic and Content Credentials SDK are packed with CVEs, but only rate a deployment priority of 3.None of the Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.Microsoft Patches for August 2026There are a couple of things to point out right at the beginning. Again, counting is difficult due to the size, but I see 398 new CVEs to go along with the other updates documented this month. However, there is only one listed being under active attack, so we’ve got that going for us, which is nice. The release impacts Windows and Windows components, Office and Office Components, AMD Zen, Azure and Azure Components, GitHub Copilot, Windows Defender, Exchange Server, SharePoint, OneDrive for macOS, Teams, Power BI, .NET and Visual Studio, DHCP Server and Client, DNS Server, and Windows TPM. Minecraft is absent from this release.  All told, there are 62 rated Critical, one rated Moderate, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program.This volume of updates indeed seems to be the new normal – at least for now. What is interesting is that, while there is an explosion of bugs being reported (and fixed), there has been no equivalent increase in the number of bugs being actively exploited, at least as 0-days.Again, we’ll start with the bug under active attack and move on from there. -              CVE-2026-68820 - Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityThis bug allows attackers to execute code at SYSTEM level. Bugs of this type are often paired with code execution bugs to take over a system, often through phishing or ransomware. One nitpick here: Microsoft lists the Exploit Code Maturity in the CVSS as “Unproven” but calls this out as actively exploited. Somewhere, that math ain’t mathing.-              CVE-2026-62878 - Windows DNS Server Remote Code Execution VulnerabilityThere are several DNS-related patches this month, but this one stands out by far. It allows a remote, unauthenticated attacker to execute code with elevated privileges without user interaction. It’s a good ol’ fashioned stack-based buffer overflow that ends up wormable. Microsoft states exploitation is less likely, but I wouldn’t count on that. I suggest testing and deploying this one quickly, especially to your Internet-facing DNS servers. -              CVE-2026-62893 - Windows Deployment Services TFTP Server Remote Code Execution VulnerabilityThis bug came through the ZDI program and allows for code execution without user authentication or user interaction. TFTP has no auth mechanism and is available remotely vid UDP port 69. Any WDS server serving Windows Imaging Format (WIM) files via TFTP (the standard PXE boot scenario) is vulnerable. The issue results from the lack of validating the existence of an object prior to performing operations on the object. UDP port 69 should be blocked at your perimeter, but this could easily be used by attackers for lateral movement within an enterprise. Again, test and deploy this one quickly if you’re using WDS for deployments in your enterprise. -              CVE-2026-62815 - Microsoft QUIC Remote Code Execution VulnerabilityHere we have another remote, unauthenticated code execution bug that doesn’t require user interaction. This one is in the QUIC component. If you aren’t familiar with it, QUIC is an IETF-standardized transport protocol that runs over UDP instead of TCP, and it's the foundation for HTTP/3. Roughly 13.5 million websites rely on it. If you are one of those millions, test and deploy this patch rapidly. -              CVE-2026-59124 - Microsoft High Performance Computing (HPC) Pack Remote Code Execution VulnerabilityDon’t let the Important severity rating fool you; this is still a CVSS 9.8 bug. It gets knocked down since HPC isn’t on by default. However, it’s a hugely growing segment, and this is another remote, unauthenticated code execution bug that does not require user interaction. It might not be applicable to everyone, but if you’re using HPC in your environment, this is not one to sleep on, especially since Microsoft lists this as “exploitation more likely”. -              CVE-2026-62911 - Microsoft Exchange Server Elevation of Privilege VulnerabilityThere are several Exchange bugs in this release, but this one really stands out. It could allow a privilege escalation via an authentication bypass. If successful, an attacker could “take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.” This bug was one of the ones demonstrated at Pwn2Own Berlin, so ignore Microsoft’s exploitability and Exploit Code Maturity ratings. We handed them working exploits, so this is a real threat. As always, test out those Exchange updates before deploying, but don’t hurry up and schedule that downtime for your upgrade. Here’s the full list of CVEs released by Microsoft for August 2026: CVE Title Severity CVSS Public Exploited Type CVE-2026-68820 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No Yes EoP CVE-2026-62832 Windows User Profile Service Elevation of Privilege Vulnerability Important 7.8 Yes No EoP CVE-2026-49163 ** Application Insights Profiler Elevation of Privilege Vulnerability Critical 8.8 No No EoP CVE-2026-50481 ** Azure Active Directory Elevation of Privilege Vulnerability Critical 9.9 No No EoP CVE-2026-68823 ** Azure Confidential Ledger Remote Code Execution Vulnerability Critical 9.1 No No RCE CVE-2026-62869 ** Azure Entra ID Spoofing Vulnerability Critical 8.8 No No Spoofing CVE-2026-56161 ** Azure Logic Apps Information Disclosure Vulnerability Critical 9.6 No No Info CVE-2026-50515 ** Azure Service Bus Remote Code Execution Vulnerability Critical 9.9 No No RCE CVE-2026-56162 ** Azure SQL Database Elevation of Privilege Vulnerability Critical 10 No No EoP CVE-2026-63522 ** Azure SQL Database Elevation of Privilege Vulnerability Critical 7.8 No No EoP CVE-2026-62836 ** Azure SQL Managed Instance Elevation of Privilege Vulnerability Critical 8.7 No No EoP CVE-2026-62830 ** Azure SRE Agent Elevation of Privilege Vulnerability Critical 9.9 No No EoP CVE-2026-62873 ** Microsoft 365 Admin Center Elevation of Privilege Vulnerability Critical 9.8 No No EoP CVE-2026-50516 ** Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability Critical 9.4 No No EoP CVE-2026-59115 ** Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability Critical 9.9 No No EoP CVE-2026-68794 Microsoft Excel Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-68804 Microsoft Excel Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-68816 Microsoft Excel Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-62911 Microsoft Exchange Server Elevation of Privilege Vulnerability Critical 8 No No EoP CVE-2026-63513 Microsoft Office Graphics Component Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63519 Microsoft Office Graphics Component Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63526 Microsoft Office Graphics Component Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-65664 Microsoft Office Graphics Component Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-66807 Microsoft Office Graphics Component Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63515 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63532 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64898 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64903 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64909 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64910 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64911 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-65657 Microsoft Office Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-70130 Microsoft Office Remote Code Execution Vulnerability Critical 8.4 No No RCE CVE-2026-70332 ** Microsoft Office SharePoint Spoofing Vulnerability Critical 9.6 No No Spoofing CVE-2026-63518 Microsoft Office Word Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63525 Microsoft Office Word Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-64907 Microsoft Office Word Remote Code Execution Vulnerability Critical 7.8 No No RCE CVE-2026-63508 ** Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability Critical 10 No No EoP CVE-2026-59118 ** Microsoft Power Apps Elevation of Privilege Vulnerability Critical 9.3 No No EoP CVE-2026-65668 ** Microsoft Purview eDiscovery Elevation of Privilege Vulnerability Critical 8.8 No No EoP CVE-2026-62815 Microsoft QUIC Remote Code Execution Vulnerability Critical 9.8 No No RCE CVE-2026-62827 Microsoft SharePoint Server Elevation of Privilege Vulnerability Critical 8.8 No No EoP CVE-2026-64921 Microsoft SharePoint Server Elevation of Privilege Vulnerability Critical 8.8 No No EoP CVE-2026-65665 Microsoft SharePoint Server Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62896 ** Microsoft Teams Elevation of Privilege Vulnerability Critical 9.6 No No EoP CVE-2026-65667 ** Microsoft Teams Elevation of Privilege Vulnerability Critical 10 No No EoP CVE-2026-62918 ** Microsoft Teams Spoofing Vulnerability Critical 7.5 No No Spoofing CVE-2026-62824 Remote Desktop Client Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62818 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62893 Windows Deployment Services TFTP Server Remote Code Execution Vulnerability Critical 9.8 No No RCE CVE-2026-66802 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-62823 Windows DHCP Server Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62817 Windows DNS Server Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62820 Windows DNS Server Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-62878 Windows DNS Server Remote Code Execution Vulnerability Critical 9.8 No No RCE CVE-2026-65789 Windows DNS Server Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-62890 Windows GDI+ Elevation of Privilege Vulnerability Critical 7.8 No No EoP CVE-2026-62822 Windows GDI+ Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-65791 Windows iSCSI Target Service Remote Code Execution Vulnerability Critical 9.8 No No RCE CVE-2026-66799 Windows Key Guard Elevation of Privilege Vulnerability Critical 7.8 No No EoP CVE-2026-62816 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability Critical 8.8 No No RCE CVE-2026-62819 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-62889 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability Critical 8.1 No No RCE CVE-2026-70354 .NET Core Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-62901 .NET Denial of Service Vulnerability Important 7.5 No No DoS CVE-2026-58641 .NET Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62871 .NET Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62886 .NET Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62909 .NET Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62872 .NET Framework Elevation of Privilege Vulnerability Important 8.8 No No EoP CVE-2026-65810 .NET Framework Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62897 .NET Framework Remote Code Execution Vulnerability Important 7 No No RCE CVE-2026-62900 .NET Information Disclosure Vulnerability Important 5.9 No No Info CVE-2026-62902 .NET Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62899 .NET Security Feature Bypass Vulnerability Important 5.9 No No SFB CVE-2026-65777 Active Directory Security Feature Bypass Vulnerability Important 5.3 No No SFB CVE-2026-59130 AMD Zen Information Disclosure Vulnerability Important 5.6 No No Info CVE-2026-59131 AMD Zen Information Disclosure Vulnerability Important 5.6 No No Info CVE-2026-62898 Microsoft QUIC Information Disclosure Vulnerability Important 7.5 No No Info CVE-2026-61357 Application Information Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70340 Azure CycleCloud Elevation of Privilege Vulnerability Important 8.1 No No EoP CVE-2026-65806 Azure CycleCloud Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability Important 7.2 No No EoP CVE-2026-57104 Azure Storage Explorer Elevation of Privilege Vulnerability Important 8.8 No No EoP CVE-2026-62892 Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65675 CoPilot Chat Security Feature Bypass Vulnerability Important 7.1 No No SFB CVE-2026-65786 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65787 Desktop Window Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65788 Desktop Window Manager Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-70335 GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-64906 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64908 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64912 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64914 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64919 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64920 Microsoft Access Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-59136 Microsoft COM for Windows Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-54123 Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62698 Microsoft Digest Authentication Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-66301 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-65815 Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-40375 Microsoft Dynamics Business Central Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-65673 Microsoft Entra Connect Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-68797 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-68799 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-68802 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-68808 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-68813 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70318 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70327 Microsoft Excel Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-70328 Microsoft Excel Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-65807 Microsoft Excel Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-68793 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68795 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68796 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68798 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68800 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68801 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68803 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68805 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68806 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68807 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68810 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68811 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68812 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68814 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68815 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-68817 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-62912 Microsoft Exchange Server Denial of Service Vulnerability Important 6.5 No No DoS CVE-2026-62910 Microsoft Exchange Server Elevation of Privilege Vulnerability Important 7.2 No No EoP CVE-2026-65813 Microsoft Exchange Server Elevation of Privilege Vulnerability Important 6.5 No No EoP CVE-2026-62913 Microsoft Exchange Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-62915 Microsoft Exchange Server Security Feature Bypass Vulnerability Important 6.5 No No SFB CVE-2026-62914 Microsoft Exchange Server Spoofing Vulnerability Important 7.3 No No Spoofing CVE-2026-59133 Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability Important 8.8 No No EoP CVE-2026-59124 Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability Important 9.8 No No RCE CVE-2026-62784 Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-68792 Microsoft Office Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62842 Microsoft Office Graphics Component Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63517 Microsoft Office Graphics Component Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-66809 Microsoft Office Graphics Component Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63524 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63529 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-64899 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70314 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70315 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70317 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70323 Microsoft Office Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63533 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64904 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-65656 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-65661 Microsoft Office Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-57105 Microsoft Office SharePoint Spoofing Vulnerability Important 8 No No Spoofing CVE-2026-70306 Microsoft Office SharePoint Spoofing Vulnerability Important 9.3 No No Spoofing CVE-2026-63521 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63528 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63530 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63531 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-64917 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-66806 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-66810 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70319 Microsoft Office Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-63527 Microsoft Office Word Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64905 Microsoft Office Word Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-64915 Microsoft Office Word Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-70311 Microsoft Office Word Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-65680 Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-70329 Microsoft Outlook Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-62882 Microsoft Outlook Spoofing Vulnerability Important 4.3 No No Spoofing CVE-2026-70313 Microsoft PowerPoint Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-70337 Microsoft PowerShell Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability Important 7.8 No No SFB CVE-2026-59138 Microsoft Remote Registry Service Denial of Service Vulnerability Important 6.5 No No DoS CVE-2026-61345 Microsoft Remote Registry Service Denial of Service Vulnerability Important 6.5 No No DoS CVE-2026-70324 Microsoft SharePoint Elevation of Privilege Vulnerability Important 8.8 No No EoP CVE-2026-70321 Microsoft SharePoint Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-70326 Microsoft SharePoint Server Elevation of Privilege Vulnerability Important 8.8 No No EoP CVE-2026-70355 Microsoft SharePoint Server Elevation of Privilege Vulnerability Important 7.3 No No EoP CVE-2026-62837 Microsoft SharePoint Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-63514 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-63520 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.1 No No RCE CVE-2026-64901 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-65658 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-65663 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-66805 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-66808 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-58639 Microsoft SharePoint Server Spoofing Vulnerability Important 6.5 No No Spoofing CVE-2026-62829 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-62839 Microsoft SharePoint Server Spoofing Vulnerability Important 6.5 No No Spoofing CVE-2026-62917 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-63516 Microsoft SharePoint Server Spoofing Vulnerability Important 6.5 No No Spoofing CVE-2026-64897 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-64900 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-64902 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-64916 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-64922 Microsoft SharePoint Server Spoofing Vulnerability Important 4.6 No No Spoofing CVE-2026-65660 Microsoft SharePoint Server Spoofing Vulnerability Important 6.5 No No Spoofing CVE-2026-63512 Microsoft SharePoint Server Tampering Vulnerability Important 6.5 No No Tampering CVE-2026-65767 Microsoft Teams for Android and iOS Spoofing Vulnerability Important 8.8 No No Spoofing CVE-2026-65769 Microsoft Teams iOS Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-65768 Microsoft Teams Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-66804 Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-59135 Microsoft Windows Search Component Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-65814 Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70310 Microsoft Word Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-58651 Microsoft Word Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-6726 * MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse Important 7.9 No No CVE-2026-6727 * MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability Important 5.9 No No CVE-2026-65811 Power BI Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-68809 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70312 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70316 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70320 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70322 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70325 Powerpoint Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-59119 PowerShell Elevation of Privilege Vulnerability Important 7.3 No No EoP CVE-2026-58612 PowerShell Information Disclosure Vulnerability Important 7.4 No No Info CVE-2026-65671 Remote Access API Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65672 Remote Access API Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-42976 Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-59134 Remote Desktop Client Remote Code Execution Vulnerability Important 7.5 No No RCE CVE-2026-61352 Remote Desktop Client Remote Code Execution Vulnerability Important 7.5 No No RCE CVE-2026-61363 Remote Desktop Client Remote Code Execution Vulnerability Important 7.5 No No RCE CVE-2026-54113 Remote Procedure Call Denial of Service Vulnerability Important 7.5 No No DoS CVE-2026-62781 RPC Runtime Library Remote Code Execution Vulnerability Important 8.1 No No RCE CVE-2026-59125 Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability Important 7 No No EoP CVE-2026-47285 Visual Studio Code Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-54981 Visual Studio Code Python Extension Security Feature Bypass Vulnerability Important 7.8 No No SFB CVE-2026-59113 Visual Studio Code Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-69320 Visual Studio Code Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-70336 Visual Studio Code Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-58650 Visual Studio Code Security Feature Bypass Vulnerability Important 7.8 No No SFB CVE-2026-69278 Visual Studio Code Security Feature Bypass Vulnerability Important 7.8 No No SFB CVE-2026-69306 Visual Studio Code Security Feature Bypass Vulnerability Important 8.2 No No SFB CVE-2026-62743 Win32k Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62746 Win32k Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62786 Win32k Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62798 Win32k Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-61358 Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-49179 Windows Active Directory Domain Services Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-61348 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-70307 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65778 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65779 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65780 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65781 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65782 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65783 Windows Autopilot Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62908 Windows Backup Engine Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61927 Windows Bind Filter Driver Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61934 Windows Bind Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62705 Windows Bind Filter Driver Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62722 Windows Bind Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62713 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62771 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62728 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62772 Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62775 Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-72971 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability Important 5.5 No No Tampering CVE-2026-61936 Windows Defender Firewall Service Security Feature Bypass Vulnerability Important 5.5 No No SFB CVE-2026-62710 Windows Device Association Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62747 Windows Device Association Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65785 Windows DHCP Client Denial of Service Vulnerability Important 6.5 No No DoS CVE-2026-62736 Windows DHCP Client Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62755 Windows DHCP Client Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61361 Windows DHCP Client Remote Code Execution Vulnerability Important 7 No No RCE CVE-2026-62761 Windows DHCP Server Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62776 Windows DHCP Server Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62803 Windows DHCP Server Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62807 Windows DHCP Server Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62812 Windows DHCP Server Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62714 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62715 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62716 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62718 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62720 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62742 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62745 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62814 Windows DHCP Server Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-61923 Windows Display Enhancement Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62769 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-62778 Windows DNS Elevation of Privilege Vulnerability Important 8.1 No No EoP CVE-2026-62881 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-62883 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-65795 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-65797 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-65798 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-65799 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-70304 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-70330 Windows DNS Elevation of Privilege Vulnerability Important 6.7 No No EoP CVE-2026-61920 Windows DNS Server Remote Code Execution Vulnerability Important 6.6 No No RCE CVE-2026-62787 Windows DNS Server Remote Code Execution Vulnerability Important 7.5 No No RCE CVE-2026-61932 Windows DWM Core Library Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62888 Windows DWM Core Library Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62894 Windows DWM Core Library Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61933 Windows DWM Core Library Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62703 Windows DWM Core Library Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-59128 Windows Encrypting File System (EFS) Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-59126 Windows Event Logging Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-59137 Windows Event Logging Service Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-61347 Windows Event Logging Service Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-61360 Windows GDI Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-65662 Windows GDI Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62709 Windows GDI+ Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62702 Windows Graphics Kernel Denial of Service Vulnerability Important 6.8 No No DoS CVE-2026-61346 Windows Graphics Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62774 Windows Graphics Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61928 Windows Hello Tampering Vulnerability Important 5.5 No No Tampering CVE-2026-62750 Windows HTTP Protocol Stack Tampering Vulnerability Important 6.5 No No Tampering CVE-2026-61937 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62735 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62739 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62741 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62753 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62811 Windows HTTP.sys Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61368 Windows Hyper-V Information Disclosure Vulnerability Important 5 No No Info CVE-2026-62740 Windows Imaging Component Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-54984 Windows Imaging Component Remote Code Execution Vulnerability Important 7.8 No No RCE CVE-2026-59127 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61925 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61938 Windows Installer Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62768 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65774 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70344 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70345 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70346 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-70347 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65681 Windows iSCSI Target Service Denial of Service Vulnerability Important 7.5 No No DoS CVE-2026-65796 Windows iSCSI Target Service Denial of Service Vulnerability Important 5.9 No No DoS CVE-2026-65679 Windows iSCSI Target Service Remote Code Execution Vulnerability Important 8.1 No No RCE CVE-2026-62752 Windows Kerberos Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62754 Windows Kerberos Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62766 Windows Kerberos Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62773 Windows Kerberos Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61929 Windows Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61930 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62708 Windows Kernel Elevation of Privilege Vulnerability Important 6.4 No No EoP CVE-2026-62737 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62749 Windows Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62780 Windows Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62788 Windows Kernel Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65773 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62785 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-62795 Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-62777 Windows License Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-50472 Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62738 Windows Management Instrumentation Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-70348 Windows Management Services Denial of Service Vulnerability Important 5.5 No No DoS CVE-2026-62717 Windows Message Queuing Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62719 Windows Message Queuing Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65790 Windows Message Queuing Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62688 Windows MIDI Service Module Elevation of Privileges Vulnerability Important 7.8 No No EoP CVE-2026-62693 Windows MIDI Service Module Elevation of Privileges Vulnerability Important 7 No No EoP CVE-2026-62707 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-56174 Windows Narrator Braille Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61366 Windows Network Connection Broker Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-68819 Windows Network File System Denial of Service Vulnerability Important 5.9 No No DoS CVE-2026-62700 Windows NTFS Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62797 Windows NTFS Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62880 Windows NTFS Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61350 Windows NTFS Information Disclosure Vulnerability Important 4.6 No No Info CVE-2026-62793 Windows NTFS Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62796 Windows NTFS Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-62887 Windows NTFS Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-65784 Windows NTFS Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-68821 Windows Package Manager Elevation of Privilege Vulnerability Important 7.3 No No EoP CVE-2026-62696 Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62751 Windows Projected File System Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62690 Windows Push Notifications Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62758 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62783 Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61918 Windows Remote Desktop Client Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-61921 Windows Remote Desktop Client Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-61924 Windows Remote Desktop Client Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-61356 Windows Remote Desktop Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61364 Windows Remote Desktop Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61365 Windows Remote Desktop Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61367 Windows Remote Desktop Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62692 Windows Remote Desktop Services Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62779 Windows Schannel Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62757 Windows Schannel Security Feature Bypass Vulnerability Important 5.3 No No SFB CVE-2026-61355 Windows Sensor Data Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62770 Windows Shell Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62799 Windows SMB Client Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62782 Windows SMB Client Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-65794 Windows SMB Client Information Disclosure Vulnerability Important 6.5 No No Info CVE-2026-62790 Windows SMBv3 Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-62800 Windows SMBv3 Server Remote Code Execution Vulnerability Important 8.8 No No RCE CVE-2026-61359 Windows Storage Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62695 Windows Storage Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-59132 Windows TCP/IP Denial of Service Vulnerability Important 7.5 No No DoS CVE-2026-62792 Windows TCP/IP Remote Code Execution Vulnerability Important 8.1 No No RCE CVE-2026-59122 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-61353 Windows Telephony Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62701 Windows Telephony Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62723 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62724 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62725 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62726 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62729 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62732 Windows Telephony Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62734 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62748 Windows Telephony Service Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62699 Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability Important 6.8 No No RCE CVE-2026-61926 Windows USB Driver Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62721 Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62711 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62712 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62733 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62876 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62877 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-62885 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65678 Windows Win32k Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-65775 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-65776 Windows Win32k Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-62730 Windows Wired AutoConfig Service Information Disclosure Vulnerability Important 5.5 No No Info CVE-2026-61349 Windows Work Folder Service Elevation of Privilege Vulnerability Important 7.8 No No EoP CVE-2026-61939 Winlogon Elevation of Privilege Vulnerability Important 7 No No EoP CVE-2026-56179 Windows Network Address Translation (NAT) Spoofing Vulnerability Moderate 8.3 No No Spoofing * Indicates this CVE had been released by a third party and is now being included in Microsoft releases.** Indicates this CVEs has already been resolved by Microsoft, and no further action is needed by the end user. As with last month, I’ll do my best to summarize everything else in this release, but assume there are details I miss that are relevant to your environment.Looking at the remaining Critical-rated patches, you are safe to ignore the scariest looking ones, including the CVSS 10’s. These have already been mitigated by Microsoft and do not count towards today’s total of 398. The iSCSI Target service, however, is a CVSS 9.8, but it’s not installed by default. Microsoft notes a DHCP Server heap overflow and a SharePoint deserialization bug are both listed as “exploitation more likely”. That SharePoint bug brought two EoP siblings along for the ride. And what would a Patch Tuesday be without Preview Pane exploit vectors in Office components? There are many in August, although there are a few Office bugs listed as Critical but without the Preview Pane vector. Odd. Then there’s the mid-tier pile no one is proud of, but everybody needs to patch anyway: AD CS, RRAS, SSTP, and a matched pair in Device Health Attestation, all leaning on higher attack complexity as their only saving grace. Consider this a coin flip, not a shield. The bug in RMCAST is unauthenticated but requires an adjacent attacker. The bug in Key Guard is a bit interesting, as it could lead to an attacker gaining Virtual Trust Level 1 (VTL1) privileges. The final Critical-rated bug is in the RDP client, but it requires a user to connect to a malicious RDP server.Moving on to the other code execution bugs, SharePoint alone accounts for seven of these, six of them the same deserialization-of-untrusted-data flaw repeated almost verbatim across different code paths, all needing only low-privilege auth and no interaction. The seventh is an input-validation miss that needs no auth at all, just a harder-to-pull-off attack chain. LDAP and SMBv3 each draw a matching pair of patches. The LDAP bugs are a heap overflow and a use-after-free, both needing a user to interact with something first; the SMBv3 pair is twin heap overflows. Visual Studio Code adds three of its own: missing authorization, OS command injection, and straight code injection, all requiring a user to open or run something. The AI-coding-tool-vuln-of-the-month tradition continues uninterrupted. The rest of the CVSS 8.1–8.8 tier is a grab bag with a common thread — LSASS and Exchange Server both go down to heap overflows with low-privilege access, Dynamics 365 On-Premises gets the SharePoint treatment (deserialization), and Active Directory Domain Services picks up a command-injection bug that needs a user's cooperation. Add one apiece for Teams, Power BI, Outlook, and a pair for Windows Media Foundation, plus a higher-complexity trio: RPC Runtime Library, Windows TCP/IP, and a second iSCSI Target Service bug. All needing unusual attack conditions to line up, which buys you a little time but not an excuse. Then the file-format mountain: seventeen Excel bugs, six in Access, four apiece in Office and Office Word, one plain Word, one PowerPoint, one .NET Core. Remote Desktop Client's other three bugs sit at a comparatively modest 7.5, but don't read too much comfort into that — all three need high attack complexity and user interaction, which is precisely the combination phishing campaigns are built to satisfy. Closing out RCE category, there are two more DNS Server bugs, a DHCP Client use-after-free needing local low-privilege access, a Universal Disk Format driver bug that requires physical media and a Windows Codecs Library.There are nearly 180 privilege escalation bugs fixed this month, and as usual, most simply lead to local attackers executing their code at SYSTEM-level privileges or administrative privileges, so there’s not much to add without further technical details about the bugs themselves. Believe it or not, that leaves only about 20 bugs to discuss. Access control keeps failing in the same places: SharePoint draws two EoPs, then contributes a third via server-side request forgery, and a fourth through cross-site scripting (XSS) that at least needs a user to click something first. Entra Connect adds a SQL injection, .NET Framework an incorrect-authorization bug, and Azure CycleCloud adds a missing-authorization flaw, That’s five different products with the same underlying lesson about checking who’s allowed to do what. Windows Telephony Service is the surprise repeat offender, landing four separate EoPs, but four bugs in one dusty legacy service in a single release is the kind of pattern that makes you wonder who's still dialing in. The rest is a genuine grab bag: Key Guard gets a heap overflow sitting on the trust chain below the OS, DHCP Client and Narrator Braille both fall to local low-privilege bugs, .NET picks up an uncaught exception that actually changes scope, .NET Framework adds a path-traversal bug requiring a click, GitHub Copilot and VS Code get an OS command injection needing the same, Azure Storage Explorer falls to XSS, Azure Monitor Agent and OneDrive for macOS both need high privileges just to start, which caps their real-world urgency, and Exchange Server closes it out with an SSRF bug whose blast radius Microsoft itself rates as confidentiality-only, no integrity or availability hit.There are 11 SFB bugs this month, all Important, none exploited or publicly disclosed. Visual Studio Code accounts for four, Python extension included: one fails open outright, the other three trip on bad authorization checks — all need a click, which is a low bar in a tool people click through constantly. PowerShell adds a code-injection bypass, and Copilot Chat gets one as well. Exchange Server and Windows Defender Firewall Service both via have missing authorization bugs. The .NET service has a bug via HTTP request smuggling, Active Directory via weak encryption, and Schannel via bad signature verification. In the low individual urgency category, both Schannel and AD have bugs with  “broken crypto trust” are worth a second look despite the low scores.Looking at the info disclosure bugs, and fortunately, the vast majority of these simply result in info leaks consisting of unspecified memory contents or memory addresses. There are few others of note. The CVSS 6.5 tier is the one with more bite: Windows DHCP Server alone accounts for eight of these, three more hit Remote Desktop Client, two hit SMB Client, two hit Excel, and singles land in PowerShell, .NET, Azure CycleCloud, two Dynamics products, SharePoint, Teams iOS, and VS Code. All are unauthenticated, network-reachable memory leaks, but DHCP Server picking up eight in one release is a pattern, not noise. Everything else sits at 5.5 or below and is almost entirely "leaks unspecified memory contents," differing mainly by which component leaks it. Office file formats dominate with roughly twenty bugs split across Excel, Word, Office generically, Office Graphics, and PowerPoint. Win32k contributes four, NTFS five, GDI/GDI+ three, Event Logging and WMI two apiece, DWM Core two, AMD Zen two. The remaining singles clear out fine during a normal patch cycle without special urgency.Moving on to spoofing patches for August, SharePoint dominates with eleven bugs, mostly stored XSS letting an authenticated attacker spoof content, plus a mixed bag of deserialization, code injection, SSRF, and credential exposure at the low end. Outside SharePoint, Teams for Android/iOS gets a high-CVSS (8.8) XSS bug. Exchange Server gets one too. Windows NAT has a scope-changing origin-validation flaw reachable from an adjacent network, and Outlook closes it out with a credential-exposure spoofing bug.There are 14 DoS bugs getting patched this month. NULL pointer dereferences dominate: TCP/IP, iSCSI Target Service, Windows Graphics Kernel, and Remote Registry Service (twice) all crash the same way, unauthenticated over the network. iSCSI Target Service adds a second DoS via heap overflow, with three hits total this release counting its RCE. Resource-exhaustion bugs cover .NET, RPC, DHCP Client, and Microsoft Identity - all unauthenticated, all just flood-and-crash. The rest need local or elevated access: Exchange Server, Windows Network File System, and path/link-resolution bug in Windows Management Services. In other words, nothing exotic. Just patch it in the normal cycle, with a nod to Remote Registry Service and iSCSI Target Service for repeat appearances.Finally, there are a handful of tampering bugs receiving patches this month. They start with SharePoint via incorrect authorization. The Windows HTTP Protocol Stack has a bug via a partial string comparison flaw reachable from an adjacent network, and Windows Hello via cleartext storage of sensitive data locally. The Hello one is the one worth a second glance. Biometric auth storing something in the clear isn't a great look, even at a modest 5.5.No new advisories are being released this month.Looking AheadThe next Patch Tuesday will be on September 8, just after Labor Day here is the US. I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!