The one confirmed in-the-wild issue is CVE-2026-68820, a use-after-free elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock, commonly known as AFD. Microsoft rates it Important with a CVSS base score of 7.0, and its attack requires local authenticated access. That CVSS number should not drive the response: confirmed exploitation means this is the flaw most likely to turn an initial foothold—whether through stolen credentials, malware, an exposed remote-access host, or another bug—into higher local privileges.
Cisco Talos reports that Microsoft classed 40 of the 62 Critical vulnerabilities as remote-code-execution issues. Microsoft’s Security Update Guide remains the primary record for individual CVEs and affected products; Talos’ value here is in condensing that record and adding IPS coverage. The practical result is a Patch Tuesday that needs role-based triage rather than a blanket rush driven by the raw CVE total.
CVE-2026-68820 turns local access into an urgent Windows patching problem
CVE-2026-68820 affects the Windows Ancillary Function Driver for WinSock, a kernel-mode component involved in Windows networking. Microsoft’s advisory describes a use-after-free condition that an authorized local attacker could exploit to elevate privileges. The vendor has confirmed exploitation in the wild, making it the only August issue in this release with that status.
For endpoint administrators, the important point is that “local” does not mean harmless. Local privilege escalation vulnerabilities are frequently valuable after an attacker has crossed the first boundary: a malicious Office document, compromised VPN account, remote-management tool abuse, or a low-privileged interactive session. Once elevated, an intruder may be able to disable defenses, access other users’ data, establish persistence, or harvest credentials.
Patch Windows clients and servers on the normal supported servicing path, and make the reboot part of the remediation window. A successful update deployment recorded by an endpoint-management console does not necessarily mean the vulnerable kernel component has been replaced in memory. Organizations that defer restarts should identify systems carrying the August cumulative update but awaiting reboot, particularly shared workstations, jump hosts, Remote Desktop Session Hosts, and servers used for administrative access.
The advisory does not identify a workaround for CVE-2026-68820. That leaves patching, reboot completion, and alerting on suspicious privilege changes as the defensible response.
Server roles deserve priority over the month’s largest CVSS numbers
Several of the most consequential Critical issues are tied to Windows and Microsoft server workloads that may be reachable from internal networks or, in poorly segmented environments, from beyond them. Microsoft rates exploitation as more likely for CVE-2026-62893 in Windows Deployment Services TFTP Server, a 9.8 remote-code-execution vulnerability caused by a use-after-free condition. A system running WDS with its TFTP service available to untrusted segments should be near the top of a remediation queue.
Windows DNS Server has three Critical RCE vulnerabilities in the release, including CVE-2026-62878, a 9.8 stack-based buffer overflow. CVE-2026-62817 is an 8.8 out-of-bounds write with an adjacent-network attack vector, while CVE-2026-62820 is an 8.1 race condition exposed over the network. DNS is a foundational service and a frequent exception to normal network filtering rules; administrators should confirm which servers are actually running the Microsoft DNS role, patch them, and ensure that recursion and zone-transfer settings are not unnecessarily exposed.
Windows DHCP Server also receives attention through CVE-2026-62823, an 8.8 heap-based buffer overflow that Microsoft considers more likely to be exploited. The vulnerability has an adjacent-network vector. That narrows the exposure compared with an internet-facing service, but it still makes DHCP infrastructure a realistic target for an attacker already operating on a local network.
Other server-oriented fixes that merit early review include:
- CVE-2026-62818 affects Active Directory Certificate Services and could permit authenticated remote code execution through a use-after-free flaw.
- CVE-2026-62824 affects Remote Desktop Client and is rated 8.8 for remote code execution.
- CVE-2026-62819 affects Routing and Remote Access Service and could allow an attacker to gain unauthorized access to a victim machine.
- CVE-2026-62889 affects Secure Socket Tunneling Protocol, a Windows VPN component, through a double-free condition.
- CVE-2026-65791 affects Windows iSCSI Target Service and has a 9.8 score, though Microsoft assesses exploitation as less likely.
The ordering matters. A 9.8 score tells administrators that successful compromise could be severe; Microsoft’s exploitability assessment is a separate prediction about the likelihood of exploitation. An exposed WDS, DNS, DHCP, RRAS, SSTP, or iSCSI deployment may deserve faster attention than a higher-scoring issue in a service that is absent, isolated, or already managed by the cloud provider.
SharePoint and Office enlarge the attack surface beyond Windows Update
Microsoft SharePoint Server appears repeatedly in August’s Critical set. CVE-2026-65665 is an 8.8 deserialization flaw that could allow authenticated remote code execution and is rated more likely to be exploited. CVE-2026-62827 and CVE-2026-64921 are 8.8 SharePoint elevation-of-privilege vulnerabilities involving improper authentication and missing authentication for a critical function, respectively. Talos also flags CVE-2026-63520, another SharePoint Server RCE issue, and CVE-2026-70355, a SharePoint elevation-of-privilege issue, among Microsoft’s “more likely” vulnerabilities.
The operational lesson is simple: do not treat this as a workstation-only Patch Tuesday. On-premises SharePoint farms need their own maintenance planning, validation, backups, and post-installation checks. SharePoint fixes can have dependencies and may require attention beyond the monthly Windows cumulative update, so administrators should verify the product-specific update path and installed build rather than assuming WSUS or Windows Update has covered it.
Office is another substantial part of the release. Talos identifies three Critical Excel RCE vulnerabilities—CVE-2026-68794, CVE-2026-68816, and CVE-2026-68804—along with nine Microsoft Office RCE vulnerabilities, five in the Office Graphics Component, and three in Word. Most of these are rated 7.8, with CVE-2026-70130 in Office rated 8.4.
Those Office flaws could allow unauthorized attackers to execute code locally, according to the advisories. The published summaries do not provide enough detail to declare a single delivery path or user-interaction requirement for every issue, so administrators should avoid assuming that all of them are equivalent. What is clear is that the volume makes prompt Office servicing important, especially for users who regularly open files received from outside the organization.
Cloud CVEs should be assigned before they are escalated
August also includes high-severity issues associated with Azure SQL Database, Azure SQL Managed Instance, Azure Service Bus, Azure Entra ID, Microsoft Teams, Microsoft 365 Admin Center, Purview eDiscovery, and other cloud services. Several carry scores of 9.0 or higher, including CVE-2026-56162 in Azure SQL Database and CVE-2026-65667 in Microsoft Teams, both scored 10.0 in Talos’ summary.
A high cloud-service CVSS score does not automatically translate into an emergency endpoint deployment. The necessary action may be a Microsoft service-side fix, a customer configuration change, a tenant-level mitigation, an application update, or a check that the service is even in use. Talos’ broad monthly rundown does not map every cloud vulnerability to a customer action, affected tenant configuration, or remediation status.
Security teams should therefore assign each cloud CVE to the product owner before escalating it as a generic “patch Windows” task. That prevents a familiar failure mode in vulnerability management: a ticket is marked complete because a desktop update deployed, while the actual asset owner never evaluated the affected cloud workload.
Snort coverage is useful telemetry, not proof of protection
Cisco Talos has released Snort rules in response to the August disclosures. The listed coverage spans Snort 2 signatures 1:66902 through 1:66948, with gaps, and Snort 3 signatures 1:66902 plus 1:301589 through 1:301607. That works out to 39 listed Snort 2 rules and 20 listed Snort 3 rules.
Talos says the rules detect attempts to exploit some of the disclosed vulnerabilities and warns that more rules may arrive as information develops. It does not publish a CVE-to-signature map in the announcement, nor does it claim coverage for all 421 vulnerabilities. Administrators should update Cisco Secure Firewall SRUs or the relevant Snort Subscriber Ruleset where licensed, then validate that the rules are enabled and producing usable events.
The missing map matters. A Snort alert can help identify scanning, exploit attempts, or compromise activity around vulnerable services, but absence of an alert cannot establish that a system is safe from CVE-2026-68820, the SharePoint issues, or any other August flaw. Network detection is particularly limited for local privilege-escalation bugs and encrypted or internal traffic that the sensor cannot inspect.
The concrete August 11 priority is to complete the Windows update and reboot cycle for CVE-2026-68820, patch externally reachable and core server roles beginning with WDS, DNS, DHCP, SharePoint, AD CS, and remote-access services, then use the updated Snort rules to watch the services that remain exposed during the rollout.