August 2026 Patch Tuesday: 790 Patches, 108 Critical, 421 Actively Exploited
By the Numbers
Microsoft's August 2026 Patch Tuesday is unprecedented. With 790 total patches, this release shatters previous records, but the volume is not the story. The story is that 421 vulnerabilities are confirmed actively exploited in the wild. That number is staggering; for context, most months see zero to three actively exploited flaws. Of the total patches, 108 are rated Critical, 397 Important, and 207 Moderate. One vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. SharePoint is under sustained attack, with multiple actively exploited vulnerabilities spanning remote code execution, privilege escalation, spoofing, tampering, and information disclosure. If you run SharePoint, this is an emergency. The "Other" product family dominates the patch count at 405, driven largely by Linux kernel and third-party component fixes flowing through Microsoft's supply chain. Windows follows with 206 patches, and Office contributes 105.
Patches to Prioritize
These vulnerabilities are confirmed actively exploited. Patch them immediately.
CVE-2026-62827 | Microsoft SharePoint Server Elevation of Privilege | CVSS 8.8 | Critical
An attacker with authenticated access to SharePoint can escalate privileges to gain administrative control over the SharePoint environment. This is the only Critical-rated vulnerability among the actively exploited set and represents the most severe SharePoint risk this month. Attack vector is network-based, requiring valid credentials but no elevated permissions. The fix enforces proper authorization checks on privilege-sensitive operations.
CVE-2026-63514 | Microsoft SharePoint Server Remote Code Execution | CVSS 8.8 | Important
An authenticated attacker can execute arbitrary code on the SharePoint server, potentially compromising the entire server and any data it hosts. This requires network access and valid SharePoint credentials. Exploitation does not require administrator privileges. The patch addresses improper input validation that allowed code execution through crafted requests.
CVE-2026-65768 | Microsoft Teams Remote Code Execution | CVSS 8.8 | Important
An attacker can achieve remote code execution on systems running Microsoft Teams through a malicious payload delivered via Teams. The attack vector is network-based and likely involves user interaction, such as clicking a link or opening a file within Teams. Given Teams' ubiquity in enterprise environments, this vulnerability presents significant risk. The fix addresses the code execution pathway in Teams' content handling.
CVE-2026-57105 | Microsoft Office SharePoint Spoofing | CVSS 8.0 | Important
An attacker can spoof content or user identity within SharePoint, potentially enabling phishing attacks or unauthorized actions that appear legitimate. This requires network access and likely authenticated access. The fix corrects how SharePoint validates and displays origin information.
CVE-2026-56174 | Windows Narrator Braille Elevation of Privilege | CVSS 7.8 | Important
An attacker with local access can exploit the Windows Narrator Braille component to escalate privileges to SYSTEM. The attack vector is local, meaning the attacker needs an existing foothold on the system, but from there can gain complete control. The patch restricts how Narrator Braille handles privileged operations.
CVE-2026-58650 | Visual Studio Code Security Feature Bypass | CVSS 7.8 | Important
An attacker can bypass security features in Visual Studio Code, potentially allowing execution of untrusted code without appropriate warnings or sandboxing. This is a local attack vector, but given that VS Code is often used to open untrusted repositories and files, the practical risk is significant. The fix restores proper security boundary enforcement.
CVE-2026-50472 | Windows LUA File Virtualization Filter Driver Elevation of Privilege | CVSS 7.0 | Important
An attacker can exploit the Windows LUA File Virtualization Filter Driver to elevate privileges from a standard user to a higher privilege level. This is a local attack requiring the attacker to already have code execution on the target system. The fix addresses improper handling in the filter driver that allowed the privilege boundary to be crossed.
CVE-2026-62829 | Microsoft SharePoint Server Spoofing | CVSS 4.6 | Important
An attacker can spoof content within SharePoint Server, enabling deception attacks against users. Despite the lower CVSS score, active exploitation confirms real-world attacker interest. Network access is required. The patch corrects content validation logic.
CVE-2026-62837 | Microsoft SharePoint Server Information Disclosure | CVSS 6.5 | Important
An authenticated attacker can access sensitive information from SharePoint Server that should be restricted. This could include configuration data, user information, or document contents. The fix enforces proper access controls on information retrieval.
CVE-2026-63512 | Microsoft SharePoint Server Tampering | CVSS 6.5 | Important
An attacker can tamper with SharePoint Server data, potentially modifying documents, configurations, or other stored information without authorization. This requires authenticated access. The patch addresses insufficient integrity checks.
Critical Vulnerability Breakdown
These Critical-severity vulnerabilities are not yet confirmed exploited but warrant urgent attention due to their severity scores.
CVE-2026-64564 | sctp: ASCONF Transport Processing | CVSS 9.8
Remote code execution or denial of service via improper memory handling in SCTP ASCONF's DEL-IP processing. An unauthenticated remote attacker on a network with SCTP enabled can exploit this without user interaction.
CVE-2026-64562 | KVM: nVMX Shadow VMCS Handling | CVSS 9.8
A vulnerability in KVM's nested VMX implementation allows improper handling of shadow VMCS after VMCLEAR, potentially enabling guest-to-host escape or denial of service. Exploitable by a malicious VM guest.
CVE-2026-47243 | Kata Containers: runtime-rs Guest Escape
A container escape vulnerability in Kata Containers' runtime-rs allows an attacker with root privileges inside a Kata guest to escape to the host with root privileges via virtiofs. This is a critical isolation failure for Kata users.
CVE-2026-34191 | Apache Portable Runtime Utility: SQL Injection | CVSS 9.1
SQL injection in apr_dbd_oracle allows an attacker to execute arbitrary SQL commands. Applications using APR with Oracle database backends are affected. Network-based, no authentication required.
CVE-2026-68407 | wifi: nl80211 RNR Data Handling | CVSS 9.8
Memory corruption via improper freeing of RNR data on MBSSID mismatch in the nl80211 WiFi subsystem. An attacker within WiFi range could potentially achieve remote code execution on vulnerable systems.
CVE-2026-68395 | ata: sata_dwc_460ex Interrupt Handling | CVSS 9.8
Race condition where SATA interrupts are enabled before the IRQ handler is registered, potentially leading to memory corruption and code execution. Requires local access or attached storage device manipulation.
CVE-2026-68143 | net: slip Receive Buffer Race | CVSS 9.8
A race condition between receive operations and buffer reallocation in the SLIP network driver can lead to memory corruption. Exploitable remotely on systems using SLIP interfaces.
CVE-2026-68176 | tracing: mmiotrace NULL Dereference | CVSS 9.8
NULL pointer dereference in mmiotrace's hiter->dev handling can cause kernel crash or potential code execution. Requires local access and specific tracing configurations.
By Product Family
Windows (206 patches)
The Windows family sees significant patching this month, with the LUA File Virtualization Filter Driver elevation of privilege (CVE-2026-50472) and Narrator Braille elevation of privilege (CVE-2026-56174) both actively exploited. Multiple kernel-level vulnerabilities appear across the Linux subsystem components integrated into Windows, including Critical-rated SCTP, KVM, WiFi, and network driver flaws. Prioritize the actively exploited local privilege escalation vulnerabilities, as they represent post-compromise tools attackers are using now.
SharePoint (27 patches)
SharePoint is under coordinated attack. Six actively exploited vulnerabilities span nearly every attack category: CVE-2026-62827 (privilege escalation, Critical), CVE-2026-63514 (remote code execution), CVE-2026-57105 and CVE-2026-62829 (spoofing), CVE-2026-62837 (information disclosure), and CVE-2026-63512 (tampering). This pattern suggests attackers have developed a comprehensive SharePoint attack chain. On-premises SharePoint deployments require immediate patching. Coordinate with your SharePoint administrators today.
Office (105 patches)
Beyond the SharePoint-specific issues, Office sees substantial patching with CVE-2026-57105 (SharePoint spoofing) affecting the broader Office SharePoint integration. Review the full Office patch list for additional document-handling vulnerabilities that may enable initial access.
Other (405 patches)
The largest category consists primarily of upstream Linux kernel fixes, Apache component updates, and container runtime patches. CVE-2026-47243 (Kata container escape) is notable for organizations using Kata Containers for workload isolation. CVE-2026-34191 (Apache APR SQL injection) affects web infrastructure components. These patches flow through Microsoft's supply chain from upstream projects.
Azure (14 patches)
Azure patches this month include container and virtualization-related fixes. Organizations running Kata Containers on Azure should prioritize CVE-2026-47243. Review for any patches affecting Azure Kubernetes Service or Azure Container Instances.
Exchange (7 patches)
Exchange receives seven patches this month. While none appear in the actively exploited list, Exchange remains a high-value target. Review the Exchange patches for any elevation of privilege or remote code execution issues and prioritize accordingly.
.NET (21 patches)
The .NET runtime and framework receive 21 patches. Review for any deserialization or remote code execution vulnerabilities that could affect web applications.
Browser (3 patches)
Three browser patches this month. Low volume suggests Microsoft Edge is relatively stable, but apply these during normal maintenance windows.
Defender (1 patch)
A single Defender patch. Defender typically auto-updates, but verify deployment across managed endpoints.
SQL Server (1 patch)
One SQL Server patch. Review for any authentication bypass or privilege escalation risks.
What to Patch First
- SharePoint Server, all instances: CVE-2026-62827, CVE-2026-63514, CVE-2026-57105, CVE-2026-62829, CVE-2026-62837, CVE-2026-63512. Six actively exploited vulnerabilities indicate a coordinated attack campaign. Patch immediately or take SharePoint offline until patched.
- Microsoft Teams: CVE-2026-65768. Remote code execution in a communication tool used by millions. High likelihood of phishing-style delivery.
- Visual Studio Code: CVE-2026-58650. Developers are high-value targets, and VS Code handles untrusted code regularly.
- Windows endpoints: CVE-2026-50472 and CVE-2026-56174. Both are local privilege escalation, indicating attackers are using these for post-compromise elevation.
- Kata Containers: CVE-2026-47243. Complete container isolation failure; if you rely on Kata for security boundaries, this is critical.
- Linux kernel and network components: CVE-2026-64564, CVE-2026-68407, CVE-2026-68143. CVSS 9.8 network-reachable vulnerabilities in systems running affected subsystems.
- All remaining Critical-rated patches: Address these within your standard critical patch SLA.
This is an extraordinary Patch Tuesday that demands immediate action, particularly for SharePoint environments facing what appears to be a coordinated multi-vulnerability attack campaign.