August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs

CrowdStrike’s analysis of Microsoft’s August 2026 Patch Tuesday reports 415 patched vulnerabilities, including one actively exploited zero-day, three publicly disclosed zero-days, and 62 Critical issues. Elevation of privilege vulnerabilities accounted for the largest share of fixes, followed by remote code execution and information disclosure flaws, with Windows, Extended Security Updates, and Microsoft Office receiving the highest numbers of patches. The exploited zero-day, CVE-2026-68820, affects the Windows Ancillary Function Driver for WinSock and could enable a local attacker to gain SYSTEM privileges, while publicly disclosed flaws affect the Windows User Profile Service, Windows kernel, and Container Isolation FS Filter Driver. High-priority Critical vulnerabilities include unauthenticated remote code execution flaws in Microsoft QUIC, Windows Deployment Services, DNS Server, iSCSI Target Service, DHCP Server, Active Directory Certificate Services, and several remote-access components, alongside file-based Office vulnerabilities that may be triggered by opening malicious documents. The release also covers severe cloud-service and identity issues across Microsoft Teams, Azure SQL Database, Azure Service Bus, Entra services, Microsoft 365 Admin Center, SharePoint Online, Azure Kubernetes Service, and Copilot Cowork, though Microsoft has already mitigated some cloud-hosted vulnerabilities. CrowdStrike advises organizations to prioritize applicable updates, assess exposed services and privileged systems, and maintain broader mitigation and monitoring plans for vulnerabilities that cannot be immediately patched.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.