Microsoft Patch Tuesday, August 2026: two exploited flaws headline 375 CVEs

The release at a glance

Microsoft's August 2026 Patch Tuesday release is in scope for 375 CVEs, made up of 5 critical, 246 high and 124 medium. Two vulnerabilities are the standout items because both are in CISA KEV. CVE-2026-65660 is a Microsoft SharePoint Server remote code execution vulnerability added to KEV on 25 September 2026 with a due date of 28 September 2026; CVE-2026-68820 is a Windows Ancillary Function Driver for WinSock elevation of privilege vulnerability added on 11 August 2026 with a due date of 25 August 2026. Microsoft also flags CVE-2026-68820 as exploited; for CVE-2026-65660, CISA KEV is the source that lists it as exploited. The rest of the release is a large set of Windows, SharePoint, Microsoft 365 Apps, Edge and Exchange updates, with several critical network-facing remote code execution flaws.

What matters most

For SharePoint, CVE-2026-65660 is the first to review: an improper code injection flaw in Microsoft Office SharePoint that allows an authorised attacker to execute code over the network. CISA KEV lists it as exploited, and fixed versions are SharePoint Enterprise Server 2016 16.0.5565.1001, SharePoint Server 2019 16.0.10417.20198 and SharePoint Server Subscription Edition 16.0.19725.20522. CVE-2026-70306 is a SharePoint spoofing issue caused by improper neutralisation of input; it is rated critical at 9.3, reachable over the network without authentication but requiring user interaction. CVE-2026-63514 is a deserialisation-of-untrusted-data remote code execution flaw rated 8.8, and it sits alongside CVE-2026-64901, CVE-2026-65658, CVE-2026-65663 and CVE-2026-66805 with the same SharePoint fix profile.

For Windows and Windows Server, CVE-2026-68820 is a use-after-free elevation of privilege in the Windows Ancillary Function Driver for WinSock. CISA KEV, CISA SSVC and Microsoft flag it as exploited; it affects Windows 10, Windows 11 and Windows Server 2012 through 2025. CVE-2026-62815 is a use-after-free remote code execution in Microsoft QUIC rated 9.8, reachable over the network without authentication, affecting Windows 11 and Windows Server 2022 and 2025. CVE-2026-62878 is a stack-based buffer overflow in Windows DNS Server rated 9.8 with the same pre-authentication exposure, affecting Windows Server 2012 through 2025. CVE-2026-62893 is a use-after-free remote code execution in Windows Deployment Services TFTP Server rated 9.8 and reachable pre-authentication. CVE-2026-65791 is a heap-based buffer overflow in Windows iSCSI Target Service rated 9.8 and reachable pre-authentication; it affects Windows 10 Version 1607, Windows 10 Version 1809 and Windows Server 2012 through 2025.

Patch in this order

1. Patch the two exploited items first. For CVE-2026-65660, apply the SharePoint fixed versions listed above by CISA's due date of 28 September 2026. For CVE-2026-68820, apply the August Windows security updates on all affected Windows 10, Windows 11 and Windows Server systems; examples of fixed versions include Windows 10 22H2 10.0.19045.7663, Windows 11 24H2 10.0.26100.9168 and Windows Server 2022 10.0.20348.5499. CISA's due date for CVE-2026-68820 is 25 August 2026.

1. Patch the critical network-facing remote code execution flaws next, especially on internet-exposed services: CVE-2026-62815 (Microsoft QUIC), CVE-2026-62878 (Windows DNS Server), CVE-2026-62893 (Windows Deployment Services TFTP Server) and CVE-2026-65791 (Windows iSCSI Target Service). These are all rated 9.8 and reachable pre-authentication. Apply the August cumulative updates for affected Windows and Windows Server versions, such as Windows Server 2022 10.0.20348.5499.

1. Update SharePoint for the remaining SharePoint issues — CVE-2026-70306, CVE-2026-63514, CVE-2026-64901, CVE-2026-65658, CVE-2026-65663 and CVE-2026-66805 — using the same fixed versions as CVE-2026-65660.

1. Roll out the remaining high and medium vulnerabilities as a normal patch cycle, giving priority to any product that is exposed to untrusted networks.

Beyond the patch

A release of 375 CVEs is manageable if you separate the two exploited items from the critical network-facing group and from everything else. Managed Detection & Response (MDR) helps with the exploited SharePoint and Windows flaws, while Virtual CISO Services (vCISO) can turn the QUIC, DNS, Deployment Services and iSCSI remote code execution issues into a clear list of what is actually exposed, so the first patch run is proportionate.