Microsoft August 2026 Patch Tuesday: 790 records and an exploited zero-day

Microsoft released its August security updates on 11 August 2026. The official MSRC document contains 790 vulnerability records mapped to 206 product entries. That is an unusually large set, but it needs careful interpretation: it also tracks vulnerabilities in dependencies and external components distributed within the Microsoft ecosystem. It should not be reduced to a claim that Microsoft engineers introduced “790 new bugs.”

The most urgent item is CVE-2026-68820 in the Windows Ancillary Function Driver for WinSock, marked Exploitation Detected by Microsoft. The file also contains two records labelled publicly disclosed. Analysing the CVSS values in the document yields 68 entries with a base score of at least 9.0 and 342 between 7.0 and below 9.0. The order of those numbers should not replace checking exploitation status, product reachability and active roles.

Exploited CVE-2026-68820

CVE-2026-68820 is a use-after-free condition in AFD, the Windows driver supporting network sockets. A local authenticated attacker must win a race, but can then elevate privileges to SYSTEM. Microsoft scores it 7.0 under CVSS; no user interaction is required, and exploitation has been detected.

This is a clear example of why CVSS-only prioritisation fails. A 7.0 issue with active exploitation should precede many critical records where the component is not installed or reachable. Local privilege escalation is commonly a second stage: phishing, session theft, an application flaw or a low-rights account provides initial access, and the driver allows full host takeover.

User endpoints, session servers, VDI and systems on which many people execute code should be early targets. Internet-facing hosts where another service can yield a local account are also high priority. EDR may complicate exploitation, but it is not a substitute for a kernel fix.

Two publicly disclosed issues

Microsoft marks CVE-2026-72971 in the Windows Container Isolation FS Filter Driver as a publicly disclosed tampering flaw. It concerns unionfs.sys and is not labelled exploited at publication time. CVE-2026-62832 in Windows User Profile Service is the second public issue; it enables elevation of privilege and Microsoft rates future exploitation as more likely.

Public disclosure reduces the time researchers and attackers need to reconstruct the conditions. It is not proof of a campaign. A patch process benefits from separate lanes: exploited now, publicly disclosed, critical remote and the remaining set ordered by exposure. That model gives operations a clear reason for sequencing.

Reading the number 790 correctly

The official data spans a broad surface. Titles include 30 SharePoint-related records, 28 for Excel, 12 for Remote Desktop, 8 for the Windows Kernel, 14 for Azure, 9 for Visual Studio Code and 6 for Teams. Office as a broader family appears in 47 titles. These counts are not package counts: one CVE can affect multiple products, and one update can resolve many CVEs.

Highest-scored entries include CVE-2026-65667 for Teams and CVE-2026-56162 in Azure SQL, both with a base score of 10.0. CVE-2026-50515 describes remote code execution in Azure Service Bus at 9.9, while CVE-2026-65791 covers RCE in Windows iSCSI Target Service at 9.8. A score expresses technical severity under its assumptions; customers must establish whether the service, role or feature is active.

Not every cloud entry requires an administrator to patch a host. Some corrections are deployed by the provider; others require an agent, image, SDK or configuration change by the customer. The owner of each service should read the MSRC remediation and record who is responsible for completion.

The first 24 hours

1. Retrieve the current MSRC document and preserve its revision date because Microsoft may add information after initial release.
2. Identify Windows hosts affected by CVE-2026-68820, prioritising reachable and shared systems.
3. Create separate worklists for the two publicly disclosed CVEs and critical records tied to active roles.
4. Correlate products with CMDB data, EDR inventory, enabled server roles, base images and Azure resources.
5. Run rapid tests on representative rings: sign-in, VPN, printing, Office applications, security agents and critical services.
6. Start ring deployment, but do not leave the exploited CVE in a normal monthly window where emergency policy permits faster action.
7. Prove installation with the build or KB state and required restart; sending a deployment job is not remediation evidence.

Rings should represent genuine profiles: user hardware, VDI, controllers, file servers and specialist roles. A test on one laptop does not demonstrate driver compatibility with a session farm. An excessively long pilot, however, extends exposure. For an exploited flaw, reduce time between rings and staff the deployment so regressions can be handled quickly.

Hunting does not end after installing a KB

Because CVE-2026-68820 is exploited, some systems may have been attacked before patching. Review EDR alerts for unusual elevation to SYSTEM, child processes launched from user applications, new services, scheduled tasks and persistence changes. The CVE record is not a complete campaign signature, so behavioural detections matter more than one hash.

Record when a fix became available and when each host actually installed it. That defines the exposure window. If suspicious behaviour is found, an update closes one path but does not remove privileges already obtained. Incident response may require isolation, volatile-data collection, network analysis and rebuilding.

In Azure, check service communications, Defender for Cloud recommendations and agent status as well. The central document is a starting point, but a resource may require action other than classic Windows Update. A risk owner should show evidence of completion rather than assume that “Microsoft patches the cloud.”

Patch management as a measurable process

“98% deployed” is a poor metric if the missing two per cent contains a public server or administration host. Measure time to exposure reduction for exploited flaws, time to complete installation by asset class, and exceptions without an owner or deadline. Reports should distinguish powered-off, unreachable and genuinely non-compliant devices.

A tested rollback path is useful, but rolling back security is a risk decision. If a patch creates a regression, teams should know whether they can disable the feature, isolate the host, use an alternative version or only restore a vulnerable state. Every exception needs compensating controls and a reassessment date.

The counts, exploitation status and product descriptions above come from the official MSRC CVRF. Deployment order, telemetry and metrics are Breachroad recommendations. The August release is a strong scenario for evidence-based prioritisation in our cybersecurity training for organisations. If a process cannot rapidly identify owners and coverage gaps, an IT security assessment can review vulnerability and patch management.