Microsoft’s August Patch Tuesday fixes 421 vulnerabilities, including an actively exploited Windows flaw

Summary

Microsoft’s August release fixes 421 vulnerabilities across 29 product families. One Windows privilege-escalation flaw is under active exploitation, while seven critical Windows flaws allow remote code execution without authentication or user interaction.

Key points

• Microsoft released 421 patches on August 11, covering 29 product families; 64 vulnerabilities were rated Critical.
• CVE-2026-68820, an Important-severity Windows privilege-escalation flaw affecting most Windows versions, is the only issue Microsoft says is actively exploited.
• Seven Critical Windows vulnerabilities enable remote code execution without authentication or user interaction; Microsoft considers CVE-2026-62893 more likely to be exploited within 30 days.
• All 17 highlighted Office vulnerabilities can be triggered through the Preview Pane; none were considered more likely to be exploited within 30 days.
• Microsoft expects 35 vulnerabilities to be exploited within 30 days, while three were publicly disclosed or under active exploitation at release.
• Sophos lists protections for several vulnerabilities, including CVE-2026-68820; the article advises downloading the applicable cumulative update from the Windows Update Catalog if not waiting for automatic updates.

MITRE ATT&CK

CVE

People

Vendors

Products

Related Articles

• Microsoft’s September Patch Tuesday Addresses 973 CVEs Across 39 Product FamiliesAccess · Azure · Copilot
• Underground Malware Operation Drains About $100,000 in CryptocurrencyEdge · Google Chrome · Microsoft Windows
• Threat Actors Target BYOD Users with Calls and Texts to Phish Microsoft 365 CredentialsExchange · Microsoft 365 · Microsoft SharePoint
• Compromised Jscrambler npm Releases Deliver Cross-Platform InfostealerAzure · Edge · Google Chrome
• Hunt.io Maps 3,923 Potentially Malicious Infrastructure Endpoints Across Eastern EuropeMicrosoft 365 · Microsoft SharePoint · Microsoft Teams