What Changed
Microsoft’s August 2026 security update covers 421 vulnerabilities, according to Cisco Talos. Microsoft marked 62 of them critical, and 40 of those critical flaws allow remote code execution.
One flaw is exploited in the wild: CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (CVSS 7.0) that lets an authorized attacker escalate privileges locally.
Critical Flaws Microsoft Rates “More Likely” To Be Exploited
- CVE-2026-62893: Windows Deployment Services TFTP Server RCE, use-after-free, CVSS 9.8, no authentication required.
- CVE-2026-65665: SharePoint Server RCE through deserialization of untrusted data, CVSS 8.8, requires authentication.
- CVE-2026-62823: Windows DHCP Server heap overflow allowing RCE from an adjacent network, CVSS 8.8.
Other Flaws Worth Attention
Talos also lists critical network-reachable RCEs in Windows DNS Server (CVE-2026-62878, CVSS 9.8) and the Windows iSCSI Target Service (CVE-2026-65791, CVSS 9.8), although Microsoft rates exploitation less likely or unlikely. Microsoft QUIC (CVE-2026-62815, CVSS 9.8) and an Exchange Server authentication bypass (CVE-2026-62911, CVSS 8.0) are also on the list.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Among “important” flaws Microsoft rates more likely to be exploited are SharePoint RCE CVE-2026-63520 and Windows User Profile Service elevation CVE-2026-62832.
What To Verify First
- Deploy the AFD.sys fix everywhere, since it is already used in attacks.
- Patch WDS, DHCP and DNS servers early; they are central services inside most networks.
- Install the August SharePoint updates on every farm server.
- If you run Cisco Secure Firewall or Snort, update to the new ruleset (Snort 2 rules 1:66902–1:66948 ranges, Snort 3 rules 1:66902 and 1:301589–1:301607).
What Teams May Be Underestimating
With 421 fixes, the total is not a useful planning number. The few network-reachable critical flaws and the one exploited driver bug decide most of this month’s risk.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
