August 2026 Patch Tuesday: 808 Patches, 84 Critical, 1 Actively Exploited

By the Numbers

Microsoft's August 2026 Patch Tuesday addresses 808 vulnerabilities across Windows, Office, Azure, and related products. Of these, 84 are rated Critical, 369 Important, and 5 Moderate. One vulnerability is confirmed actively exploited in the wild and appears on CISA's Known Exploited Vulnerabilities catalog. Note that Microsoft's advisory document also lists 843 additional CVEs affecting Azure Linux packages; these are Linux distribution updates rather than Windows or Office patches and are excluded from the figures above.

The product family breakdown shows Browser components leading with 312 patches, followed by Windows at 207, Office at 109, and Azure at 28. Exchange receives 8 patches this month, while SharePoint has 27.

Patches to Prioritize

CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege

CVSS 7.0 | Important | Actively Exploited | CISA KEV

This vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock allows a local attacker to escalate privileges to SYSTEM level. Exploitation requires the attacker to already have code execution on the target system, making this a post-compromise escalation path.

Attack vector: Local. The attacker must first gain initial access through another means, such as phishing or exploiting a separate vulnerability, then run a specially crafted application to trigger the AFD flaw.

What an attacker gains: Full SYSTEM privileges on the compromised host, enabling complete control over the machine, persistence establishment, credential harvesting, and lateral movement.

The fix: Microsoft has released an updated afd.sys driver. Apply the cumulative update for your Windows version immediately. Given active exploitation, do not wait for your normal patching cycle.

Critical Vulnerability Breakdown

CVE-2026-56162 | Azure SQL Database Elevation of Privilege

CVSS 10.0 | Critical

The maximum CVSS score reflects a complete compromise scenario. An attacker who exploits this flaw can gain administrative control over Azure SQL Database instances. This is a cloud-side vulnerability; Microsoft has applied mitigations, but customers should verify their configurations and review access logs for anomalous activity.

CVE-2026-50481 | Azure Active Directory Elevation of Privilege

CVSS 9.9 | Critical

This vulnerability allows privilege escalation within Azure Active Directory. Successful exploitation could let an attacker with low-privilege access elevate to directory-level administrative permissions, compromising identity management across an organization's Azure tenant.

CVE-2026-50515 | Azure Service Bus Remote Code Execution

CVSS 9.9 | Critical

Remote code execution in Azure Service Bus. An attacker could execute arbitrary code within the Service Bus environment, potentially accessing or manipulating messages in transit and pivoting to connected systems.

CVE-2026-59115 | Microsoft Entra Provisioning Service Elevation of Privilege

CVSS 9.9 | Critical

Privilege escalation in the Entra Provisioning Service could allow an attacker to manipulate user provisioning workflows, create unauthorized accounts, or modify existing identity synchronization processes.

CVE-2026-56161 | Azure Logic Apps Information Disclosure

CVSS 9.6 | Critical

This flaw exposes sensitive information processed by Azure Logic Apps workflows. Attackers could access workflow data, connection strings, or credentials stored within Logic App configurations.

CVE-2026-50516 | Microsoft Azure Kubernetes Service Elevation of Privilege

CVSS 9.4 | Critical | Exploitation Less Likely

Privilege escalation within AKS clusters. An attacker with access to a container could potentially escape to the node level or gain elevated permissions within the Kubernetes control plane.

CVE-2026-24301 | Microsoft Copilot Information Disclosure

CVSS 8.8 | Critical

Information disclosure in Microsoft Copilot could allow unauthorized access to data that Copilot processes or references. Organizations using Copilot should apply this patch and review what data sources are connected to their Copilot deployments.

CVE-2026-49163 | Application Insights Profiler Elevation of Privilege

CVSS 8.8 | Critical

Elevation of privilege in the Application Insights Profiler component. Exploitation could grant an attacker elevated access to monitored applications or the telemetry data they generate.

By Product Family

Browser (312 patches)

The largest share of this month's patches addresses browser components. Administrators managing enterprise browser deployments should review the cumulative browser updates and ensure auto-update mechanisms are functioning correctly.

Windows (207 patches)

Windows patches include the actively exploited CVE-2026-68820 AFD vulnerability. Beyond that priority item, this month's Windows updates address kernel components, networking stack issues, and various privilege escalation vectors. The AFD patch alone makes this month's Windows updates mandatory for immediate deployment.

Office (109 patches)

Office products receive 109 patches addressing document parsing, macro handling, and application-specific vulnerabilities. Organizations should push Office updates through their standard channels, prioritizing systems where users regularly open external documents.

Azure (28 patches)

Azure components account for six of the eight Critical vulnerabilities rated CVSS 9.4 or higher this month. CVE-2026-56162 in Azure SQL Database carries the maximum CVSS 10.0 score. Most Azure vulnerabilities are mitigated server-side by Microsoft, but administrators should verify service health dashboards and review any customer action items Microsoft has published for these CVEs.

SharePoint (27 patches)

SharePoint receives 27 patches this month. Organizations running on-premises SharePoint deployments should prioritize these updates, particularly any addressing remote code execution or authentication bypass scenarios.

.NET (21 patches)

.NET framework and .NET Core updates address various vulnerabilities. Development teams should update their runtime environments and rebuild applications against patched SDKs where applicable.

Exchange (8 patches)

Exchange Server receives 8 patches. Given Exchange's history as a target for sophisticated attackers, on-premises Exchange administrators should treat these updates as high priority even in the absence of confirmed exploitation.

Defender (2 patches)

Microsoft Defender receives two patches. These typically deploy automatically through definition updates, but administrators should confirm Defender versions are current across managed endpoints.

What to Patch First

1. CVE-2026-68820 (Windows AFD for WinSock): Actively exploited, CISA KEV listed. Patch all Windows systems immediately. This is your top priority.
2. CVE-2026-56162 (Azure SQL Database): CVSS 10.0. Verify Microsoft has applied server-side mitigations and review any required customer actions.
3. CVE-2026-50481, CVE-2026-50515, CVE-2026-59115 (Azure AD, Service Bus, Entra): All CVSS 9.9. Review Azure service health and apply any customer-side configurations Microsoft recommends.
4. CVE-2026-56161 (Azure Logic Apps): CVSS 9.6 information disclosure. Audit Logic Apps for sensitive data exposure.
5. CVE-2026-50516 (AKS): CVSS 9.4, though rated less likely to be exploited. Review AKS cluster configurations and apply updates.
6. CVE-2026-24301, CVE-2026-49163 (Copilot, Application Insights): CVSS 8.8 Critical items. Address after higher-severity Azure issues.
7. Exchange Server patches: Given Exchange's attack surface, prioritize these for on-premises deployments.
8. Remaining Windows, Office, and Browser updates: Deploy through standard patching cycles, prioritizing internet-facing systems.

This month demands immediate attention for the actively exploited WinSock driver vulnerability, and Azure administrators face an unusually high concentration of Critical cloud service flaws requiring verification and potential action.