Microsoft Patch Tuesday August 2026: Two Things to Apply First

This page is a monthly summary that pulls, from Microsoft's regular security updates (known as Patch Tuesday), just the answer to one question for corporate IT teams: "what should we apply first this month?" Rather than covering everything, it narrows to the flaws with high exploitation risk, wide reach, and no room to defer, and assigns a priority. Bookmark it and check back each month.

This edition covers August 2026 (released August 11). The totals differ by source: Tenable counts 398, SecurityWeek 421, and BleepingComputer about 400. Either way, around 400 fixes makes this one of the larger months in recent memory.

Two things lead the list. One is a DNS server flaw that can be exploited over the network with no login (severity 9.8). The other is a privilege escalation already being used in real attacks (severity 7.0), for which the U.S. government set an August 25 remediation deadline. Why the lower number ranks alongside the higher one is explained below.

What to apply first this month (August 2026)

Priority here is set by whether exploitation needs a login, how widely the product is deployed internally, and whether attacks have already started. It is deliberately not sorted by severity score. A 9.8 is irrelevant to an organization that never enabled the feature, and a 7.0 goes first if it is actually being exploited.

Top pick 1: unauthenticated DNS server takeover (CVE-2026-62878, 9.8)

This leads the month. CVE-2026-62878, severity 9.8. The DNS server role in Windows Server can be made to run code over the network with no login at all. The mechanism is a stack-based buffer overflow (CWE-121) — the classic pattern of sending more data than expected and hijacking the processing that follows.

DNS is what every machine on the network asks when it needs to turn a name into an address. It is something nearly every endpoint talks to constantly and automatically, and it frequently runs on a domain controller. Zero Day Initiative called it wormable in its monthly review and singled it out for first testing and deployment. Wormable means a compromised server can attack the next one by itself, spreading without a human driving it.

The affected range is broad — Windows Server 2012 onward — and no exploitation has been observed as of August 12. Which is precisely why it should be closed before any starts. DNS also saw CVE-2026-62817 (8.8) and CVE-2026-62820 (8.1) fixed this month. If you run your own DNS servers, start here.

Top pick 2: the only flaw already under attack (CVE-2026-68820, 7.0)

Of roughly 400 fixes this month, exactly one is confirmed to be under active exploitation. CVE-2026-68820, severity 7.0. The driver Windows uses underneath its networking stack has a use-after-free flaw (CWE-416): memory that was released gets used again.

Exploitation assumes the attacker can already run something on that machine, so this is not a flaw that gets you taken over out of nowhere. But when it works, the attacker holds SYSTEM — the machine's highest privilege. It is not the way in; it is how you take everything once you are in. CISA added it to its catalog of actively exploited vulnerabilities on August 11 and set an August 25 deadline for federal agencies (you can track additions to that catalog here).

Who is using it is public too. According to analysis by Check Point, a North Korea-linked group deployed it through a campaign built on fake job offers. Targets were concentrated in defense and aerospace, with organizations in France, Germany, India, and Brazil named. In the observed attacks, the machines targeted were current-generation Windows 11 builds (26100 and 26200).

One detail causes confusion. Microsoft's own record still carries a marker meaning "exploitation unproven", even though the same record says the flaw is exploited. Zero Day Initiative flagged the contradiction. Read the "exploited" flag, not the severity math.

High: SharePoint again, 29-30 fixes, plus a chain that removes the login requirement

On-prem SharePoint Server received 29 fixes (Tenable's count) or 30 (SecurityWeek's) this month. Three are rated most severe: only CVE-2026-65665 is remote code execution, while CVE-2026-62827 and CVE-2026-64921 are privilege escalation. All three are 8.8 and require a login.

The combination is what to watch. According to Rapid7's research, chaining this month's CVE-2026-63520 (8.1) with an authentication bypass fixed in July (CVE-2026-55040) produces takeover with no login required. This came out of contest research, and no in-the-wild exploitation has been seen as of August 12. The shape of the risk is that organizations that never applied July's updates are the exposed ones, so check for backlog across months.

Note that CVE-2026-50522, widely reported in July and genuinely exploited, is a separate matter. That one leaks the keys used for authentication, so patching alone was insufficient and the keys had to be rotated. Details are in our SharePoint vulnerability write-up.

High if enabled: Windows Deployment Services (CVE-2026-62893, 9.8)

By the numbers this is among the month's largest. CVE-2026-62893, 9.8, no login required. But it only affects servers with the Windows Deployment Services role installed. WDS is the feature used to set up company PCs over the network in bulk, and it is not present in Windows Server by default.

The flaw sits in the old TFTP transfer method the feature relies on. TFTP has no authentication and listens on UDP port 69 — a port essentially no organization exposes externally. Zero Day Initiative frames it the same way: the perimeter should be blocking it, but it is perfectly usable for moving sideways inside a network.

Put plainly, this is a 9.8 that does not concern you if you never installed the role. For organizations that do image their fleet through WDS, it is the top item. Check whether you use it first. Microsoft has also been winding the feature down — end-to-end deployment the traditional way has been unsupported since Windows Server 2022 — so this is a reasonable moment to ask whether to keep using it at all.

Medium: DHCP, Exchange, and the rest

Windows DHCP Server (CVE-2026-62823, 8.8), which hands out IP addresses to endpoints, also has a takeover flaw. No login is needed, but the attacker has to already be on the same network segment — it is not reachable across the internet. Assessments of how likely it is to be exploited differ between sources, with Tenable rating it higher and Microsoft-aligned analyses lower. Treat it as medium.

For on-prem Exchange Server, CVE-2026-62911 was reported as a privilege escalation demonstrated successfully at a hacking contest, bypassing authentication to take over mailboxes. If you run your own mail platform, include it this month.

Two more were publicly disclosed but are not being exploited: CVE-2026-62832 (7.8), which gains administrator rights by loading another user's settings, and CVE-2026-72971 (5.5), which tampers with a container-related driver. Normal monthly patching is fine for both.

For personal machines, Windows Update is enough

Everything above is about running servers. On a home or personal PC, apply Windows Update, restart, and you are done. Even CVE-2026-68820, the one flaw actually being exploited, assumes the attacker can already run something on your machine, so it is not the kind of thing that gets you taken over across the internet unprompted.

On Windows 11 24H2 or 25H2, this month's update is KB5121003 (builds 26100.9168 / 26200.9168). It is cumulative, so a restart is required. Certificates used in the machine's startup integrity check are also being rotated in stages, so on some hardware a second restart happens. That is expected, not a fault.

For Windows 10, mainstream support ended on November 14, 2025. This month's update (KB5120249) reaches you only if you are enrolled in extended support. If it does not arrive, the absence of updates is itself the problem, and moving to Windows 11 is the answer.

As for defects, Microsoft's official page states as of August 12 that it is not currently aware of any issues with this update. July's release caused power-related problems on some Dell models; nothing comparable has been reported for August. That said, this is one day after release, so staging the rollout for a few days remains a sound call in large estates.

Does it apply to you? A per-product quick reference

Here is "which ones concern us" organized by product. Check only the rows for products you use. The more self-hosted (on-premises) servers you run, the higher your priority.

Organizations that only use the cloud (Microsoft 365 / SharePoint Online / Exchange Online) need not act on the server-side flaws, because Microsoft handles those updates. What needs attention is the on-premises products you host on your own servers.

What Microsoft's monthly update (Patch Tuesday) is

On the second Tuesday of every month, Microsoft releases security fixes for Windows, Office, and its various server products together. This is Patch Tuesday, the "monthly update." Bundling them helps companies test and apply in a planned way.

Each fix carries the severity indicator "CVSS" (out of 10) and Microsoft's own exploitability assessment. Beyond the severity number, looking together at "does it need a login (is it unauthenticated)," "are attacks already happening," and "how central is the product internally" makes it easier to decide the order of application. This page presents priorities with that judgment already done for you.

Vulnerabilities confirmed to be under real-world attack are published by the U.S. agency CISA as the "Known Exploited Vulnerabilities (KEV)" list. Our Japanese-language tracking of the latest exploitation is in the CISA KEV dashboard (Japanese); checking it alongside the monthly update sharpens the priorities further.

How to apply each month: operational tips

Here are the basics for running the monthly update safely and reliably. Building a routine you can run the same way every month is, in the end, the best defense.

First, use two tiers by priority: apply the login-free takeovers and the already-exploited holes ahead of testing, and put the rest through your normal validation flow. Trying to run everything at the same speed delays the most dangerous ones. Second, keep an inventory of your on-prem server products. Knowing where each version of core servers like SharePoint, Exchange, AD, and SQL lives lets you immediately narrow down the targets in a month like this one.

For delivery, devices are typically covered via Windows Update or Microsoft Intune, and server fleets via WSUS or related Windows Server update mechanisms. After applying, confirm through reboots and service restarts — don't stop at "delivered," see it through to "in effect." And even after patching, don't forget to check whether you have already been breached. For a hole already under attack, an update prevents further intrusion; it does not guarantee you weren't already breached.

Update history

This page is updated in step with each month's Microsoft monthly update. The key points of past editions are kept here in brief.

• ▸August 2026 (released August 11): totals range from 398 to 421 depending on the source. Exactly one flaw is confirmed exploited — CVE-2026-68820 (7.0), a privilege escalation in the Windows networking layer, used by a North Korea-linked group through fake job offers; CISA set an August 25 deadline. The highest score belongs to an unauthenticated DNS server takeover, CVE-2026-62878 (9.8, wormable), with no exploitation observed. Also notable: Windows Deployment Services CVE-2026-62893 (9.8, only if the role is installed), 29-30 SharePoint fixes, and Exchange CVE-2026-62911. Research shows chaining July's CVE-2026-55040 with this month's CVE-2026-63520 yields unauthenticated takeover (not seen in the wild).
• ▸July 2026: On-prem SharePoint Server has two unauthenticated takeovers (CVE-2026-50522 / 58644, 9.8 each) as the top priority. Remote code execution in Exchange, Active Directory, DHCP, and SQL Server (8.8 each, low-privilege) also needs attention. Over 100 fixes total. [Updated July 15] SharePoint privilege escalation CVE-2026-56164 and AD FS CVE-2026-56155 were added to CISA KEV (exploited); unauthenticated RCE in RDP (CVE-2026-56190) and MSMQ (CVE-2026-50447) was also fixed the same month.

Sources

• ▸Microsoft Security Update Guide (official monthly list)
• ▸Zero Day Initiative - The August 2026 Security Update Review
• ▸Tenable - Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs
• ▸Check Point Research - analysis of CVE-2026-68820 exploitation
• ▸NVD - CVE-2026-62878 (Windows DNS, unauthenticated RCE, 9.8)
• ▸NVD - CVE-2026-68820 (Windows, privilege escalation, exploited)
• ▸Rapid7 - CVE-2026-63520 (SharePoint chain to unauthenticated RCE)
• ▸NVD - CVE-2026-50522 (July, SharePoint (SharePoint, unauthenticated RCE, 9.8)
• ▸NVD - CVE-2026-55005 (Exchange, RCE, 8.8)
• ▸NVD - CVE-2026-49178 (Active Directory, RCE, 8.8)
• ▸NVD - CVE-2026-48564 (Windows DHCP, RCE, 8.8)
• ▸CISA - Known Exploited Vulnerabilities Catalog (KEV)
• ▸Related: SharePoint Server takeover roundup (this site)
• ▸Related: CISA KEV dashboard (this site)