August 2026 Patch Tuesday: 421 CVEs to Prioritize

Microsoft’s August 2026 Patch Tuesday release covers 421 CVEs across Windows, Office, Azure, Exchange Server, SharePoint Server, Developer Tools, and Microsoft Defender. Two vulnerabilities stand out on the radar for immediate attention: one with confirmed exploitation in the wild, and one that's publicly known. Two republished non-Microsoft CVEs affecting Windows TPM are also flagged. Here's our take on where to focus first.

Microsoft Patch Breakdown for August 2026

As we see most months, Windows accounts for the largest share of this release, with 236 vulnerabilities addressed across 32 distinct updates. Office and Office 2016 each carry 98 vulnerabilities, reflecting the same underlying set of issues delivered through two different servicing models — cumulative updates for currently supported Office versions and individual updates for Office 2016. SharePoint Server and Developer Tools round out the list with the next-largest vulnerability counts, at 30 and 26 respectively.

Here's the release break down:

When we dig into where this month's exposure actually sits, it's a familiar set of areas: core Windows networking and driver components (DNS Server, DHCP Server, RRAS, SSTP, RMCAST, Telephony Service, Win32k), Office document-handling components (Word, Excel, PowerPoint, Access, and the shared Graphics Component), and collaboration platforms (SharePoint Server and Exchange Server). We're also seeing a meaningful concentration of fixes in Developer Tools and .NET this month, which is worth flagging if your organization runs internal build or CI/CD infrastructure.

Because Office and Windows together account for over three-quarters of this month's addressed vulnerabilities, we'd expect the bulk of patch validation effort to land on endpoint and productivity workloads rather than server infrastructure — though the server-side fixes in SharePoint, Exchange, and core Windows networking services carry outsized risk given their network-facing nature.

Zero-Day and Exploitation More Likely Vulnerabilities

Every month, we pay close attention to CVEs where Microsoft's own signals — publicly known details or confirmed exploitation — indicate real-world risk is outpacing the CVSS-driven severity score. This month, two vulnerabilities fall into that category:

CVE-2026-68820 has confirmed active exploitation, and CVE-2026-62832 is publicly known, meaning technical details are already available that could accelerate exploit development. Both are elevation-of-privilege vulnerabilities rated Important rather than Critical — a good reminder that we don't rely on severity ratings alone to gauge urgency. These two vulnerabilities belong at the top of this month's patch queue regardless of their CVSS-driven label.

Critical Vulnerabilities in August 2026

Our review of this release identifies 43 vulnerabilities rated Critical, the large majority of which are remote code execution (RCE) flaws. Several affect network-facing infrastructure that we commonly see exposed within, or at the edge of, enterprise networks:

The remaining Critical-rated CVEs we're tracking are concentrated in Microsoft Office (Word, Excel, and the shared Graphics Component), which sees more than a dozen Critical RCE vulnerabilities this month. Because several of these flaws affect services that are frequently exposed to untrusted networks — DNS, RRAS, and DHCP in particular — we'd treat patch validation and deployment for domain controllers, edge servers, and remote access infrastructure as a top priority.

How to Prioritize August 2026 Patches

With 421 CVEs to work through, a risk-based approach is essential. Here's how we'd recommend triaging this month's release.

Patch Within 72 Hours

• Windows DNS Server, DHCP Server, RRAS, SSTP, and RMCAST — Critical RCE flaws in network-facing services

• Active Directory Certificate Services (AD CS) and Microsoft QUIC — Critical RCE affecting identity and transport infrastructure

• CVE-2026-68820 (WinSock AFD) and CVE-2026-62832 (User Profile Service) — actively exploited and publicly known, respectively

• SharePoint Server and Exchange Server — Critical vulnerabilities in collaboration platforms with internet-facing deployments

• Remote Desktop Client and iSCSI Target Service — Critical RCE relevant to remote access and storage infrastructure

Patch Within 1-2 Weeks

• Microsoft Office (Word, Excel, PowerPoint, Access) — high-volume Critical and Important RCE vulnerabilities requiring user interaction

• Developer Tools and .NET — relevant to internal build, CI/CD, and application infrastructure

• Windows Kernel, Win32k, NTFS, and Telephony Service — Important-rated vulnerabilities with broad footprint across endpoints

Regular Patch Cycle

• Lower-severity Windows components affecting less commonly exposed services

• Vulnerabilities requiring local access or non-default configurations

• Systems with compensating controls already in place (network segmentation, restricted access, EDR coverage)

Notable Non-Microsoft CVEs Republished

Both republished CVEs affect Windows TPM (Trusted Platform Module) implementations and are tracked under MITRE rather than Microsoft's own CNA. Neither currently has documented workarounds or mitigations, which makes timely patch application the primary remediation path once vendor updates are available. As we note every month these come up, we'd recommend treating third-party and firmware-adjacent components like TPM stacks as part of the same vulnerability-management workflow you use for OS-level patches, rather than as a separate, lower-priority track.

How Splashtop AEM Can Help

With 421 CVEs to sort through this month, manually triaging risk across every endpoint isn't realistic. That's exactly the gap Splashtop AEM (Autonomous Endpoint Management) is built to close:

• Identify Risk Quickly: Get centralized visibility into endpoint vulnerabilities, patch status, and software/hardware inventory, so you know where you're exposed before you start patching.

• Prioritize Critical Updates: AI-powered CVE insights surface which vulnerabilities matter most for your environment — including Critical-severity issues and CVEs with confirmed or likely exploitation — so effort goes where risk is highest first.

• Patch Faster: Automate patch policies and deploy updates to operating systems and third-party software in real time, with visibility into success and failure at every step.

• Strengthen Existing Workflows: Layer faster remediation and better visibility instead of manual patching or alongside Microsoft Intune.

Try Splashtop AEM Free

A single Patch Tuesday can take weeks to fully remediate without the right tooling — and by the time it's done, the next release is already on the way. With Splashtop AEM, you can:

• Detect vulnerable endpoints across your environment

• Prioritize critical CVEs based on real exploitation risk

• Automate patch deployment for Windows, Office, and third-party applications

• Monitor patch success and failure from a single dashboard

• Strengthen security across distributed and remote environments