Microsoft August 2026 Patch Tuesday fixes 394 flaws, including 3 zero-days

Key Takeaways

• Microsoft’s August 2026 Patch Tuesday addresses a substantial 394 vulnerabilities across its product ecosystem.
• Three zero-day vulnerabilities are included in this month’s updates, one of which is actively being exploited in the wild.
• The vulnerabilities span critical components such as Windows, Office, SharePoint, Azure, .NET, PowerShell, and Visual Studio Code.
• Organizations must prioritize patching, especially for zero-day and critical remote code execution flaws, to mitigate immediate risks.

Microsoft has released its comprehensive August 2026 Patch Tuesday security updates, fixing an extensive 394 vulnerabilities across a wide array of its core products. These include critical components like Windows operating systems, Microsoft Office suite, SharePoint Server, Azure services, .NET framework, PowerShell, Visual Studio Code, and numerous other enterprise applications.

The security rollout, officially published on August 11, 2026, also contains crucial patches for three zero-day vulnerabilities. This makes immediate and thorough patching a paramount concern for both organizations and individual users to safeguard their systems against active threats.

Zero-Day Vulnerabilities: A Closer Look

This month’s update addresses three zero-day vulnerabilities, each presenting distinct risks:

The vulnerability CVE-2026-72971 targets the unionfs.sys driver, a component vital for Windows Container Isolation. Categorized as a tampering flaw, its exploitation could compromise the integrity of files or system functions within affected containerized environments. Given its public disclosure prior to the patch release, organizations leveraging Windows container workloads should treat this update with high priority.

CVE-2026-62832 is an elevation-of-privilege vulnerability impacting the Windows User Profile Service. Such flaws are frequently exploited in multi-stage attacks, allowing an adversary with initial access to escalate their permissions to higher system levels. While Microsoft’s advisory does not indicate active exploitation, its public disclosure significantly increases the likelihood of proof-of-concept exploits emerging and subsequent attack attempts.

Of the three zero-days, CVE-2026-68820 presents the most immediate danger, as Microsoft confirms it is being actively exploited in the wild. This elevation-of-privilege vulnerability resides in the Windows Ancillary Function Driver for WinSock. Enterprises must consider this an urgent patching priority, concurrently investigating any suspicious local privilege escalation activity and reviewing endpoint telemetry for anomalous process execution or changes in privileged account behavior.

Broader Impact Across Microsoft Products

The sheer volume of vulnerabilities addressed this Patch Tuesday poses a significant operational challenge for IT and security teams. While not every flaw will be relevant to every environment, the extensive product coverage necessitates rapid identification of exposed Windows servers, endpoints, cloud workloads, developer systems, and collaboration platforms.

Microsoft explicitly states that all listed vulnerabilities require customer action, underscoring that applying the provided security updates is the primary and most effective mitigation, rather than relying solely on compensatory security controls.

Key Vulnerabilities Beyond Zero-Days

Beyond the zero-days, several other vulnerabilities demand immediate attention. CVE-2026-72971, an Important-rated tampering vulnerability in the Windows Container Isolation File System Filter Driver (unionfs.sys), is significant. As containerized environments become ubiquitous for modern applications, maintaining strong isolation boundaries is critical. A flaw in a component governing container file system integrity could severely undermine expected protections, making assessment and deployment of this update crucial for administrators of Windows container environments.

Another high-priority item is CVE-2026-71331, a Critical remote code execution (RCE) vulnerability affecting both the Microsoft Azure Attestation service and Device Health Attestation Service. RCE vulnerabilities are among the most severe, as successful exploitation can grant attackers the ability to execute arbitrary malicious code within the context of the compromised service. Given that Device Health Attestation is fundamental to assessing device security posture and enforcing conditional access in many enterprise settings, organizations utilizing DHA-related services must promptly validate their exposure and apply the necessary patches.

Microsoft’s August update also includes multiple vulnerabilities impacting Microsoft SharePoint Server. These encompass elevation-of-privilege flaws such as CVE-2026-70355, CVE-2026-70326, and CVE-2026-70324, alongside CVE-2026-70321, an Important-rated remote code execution vulnerability. SharePoint remains a prime target for attackers due to its role in storing sensitive internal documents, business workflows, credentials, and collaborative data. Compromising SharePoint can offer adversaries a direct path to sensitive information and enable further lateral movement within a corporate network. Administrators should prioritize patching internet-facing SharePoint servers, scrutinize access logs for unusual activity, and ensure administrative interfaces are not exposed unnecessarily.

The update further addresses CVE-2026-70354, an Important .NET remote code execution vulnerability, and CVE-2026-70337, an Important RCE issue in Microsoft PowerShell Core. PowerShell, while essential for legitimate automation, is frequently abused by threat actors for reconnaissance, payload delivery, and post-exploitation activities. Additionally, Microsoft fixed CVE-2026-70338, a PowerShell security feature bypass. Defenders should patch affected PowerShell installations and maintain vigilance for suspicious encoded commands, unusual child processes, remote execution, and attempts to disable endpoint security protections.

Developer environments are also targeted, with CVE-2026-70336 affecting Visual Studio Code, potentially leading to remote code execution, and CVE-2026-70335 impacting GitHub Copilot and Visual Studio Code through an elevation-of-privilege vulnerability. Developers should not postpone these updates, particularly for workstations with access to production cloud environments, source-code repositories, signing certificates, or deployment pipelines. A compromised developer endpoint can introduce significant software supply-chain risks if attackers gain access to repository tokens, modify source code, or steal credentials used in CI/CD systems.

Windows infrastructure teams should also examine CVE-2026-70330, an elevation-of-privilege vulnerability in Windows DNS, and CVE-2026-70348, a denial-of-service flaw in Windows Management Services. Microsoft fixed four distinct Windows Installer elevation-of-privilege vulnerabilities—CVE-2026-70347 through CVE-2026-70344—which are relevant for attackers aiming to escalate limited system access to higher privileges. CVE-2026-70340, impacting Azure CycleCloud, warrants evaluation by organizations managing high-performance computing and cloud-cluster workloads.

For Office users, a broad collection of Important-rated bugs across Outlook, Excel, Word, PowerPoint, and the broader Microsoft Office suite have been addressed. CVE-2026-70329 is a remote code execution vulnerability in Microsoft Outlook, while patches for Excel, Word, PowerPoint, and Office resolve multiple information-disclosure issues. Even non-Critical Office flaws can become highly effective vectors in phishing campaigns that leverage malicious email attachments, shared documents, or deceptive collaboration content.

What You Should Do

• Prioritize Zero-Days and Criticals: Immediately apply patches for the three zero-day vulnerabilities, especially CVE-2026-68820 due to active exploitation. Follow with all Critical-rated vulnerabilities, such as CVE-2026-71331.
• Patch Internet-Facing Systems First: Focus patching efforts on internet-facing SharePoint servers, Azure services, and Windows infrastructure components, as these are often primary targets for external attackers.
• Secure Developer Workstations: Ensure developer tools like Visual Studio Code and GitHub Copilot are updated promptly to mitigate supply-chain risks.
• Update Office and Endpoints: Deploy updates for Microsoft Office applications and all Windows endpoints, as these are common entry points for malware and phishing attacks.
• Monitor for Suspicious Activity: After patching, actively monitor logs and endpoint telemetry for any signs of exploitation, particularly for privilege escalation attempts or unusual process behavior.
• Test Patches: Adhere to established change-management processes for testing patches, but avoid unnecessary delays given the severity and active exploitation of some vulnerabilities.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.