Patch Tuesday August 2026: what's exploited and what to install first
Microsoft released fixes for 401 vulnerabilities on Aug 11, 2026. 1 is already being exploited by attackers, so install that fix first. 2 were publicly disclosed before the fix came out. 44 are rated Critical.
Install these first: already exploited
- Windows Ancillary Function Driver for WinSockExploitedImportantCVSS 7.0Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
Publicly disclosed before the fix
Details were public before Microsoft's update, so attacks often follow quickly.
- Windows User Profile Service Elevation of Privilege Vulnerability
- CVSS 5.5 Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
Critical fixes
- CVSS 9.8 Microsoft QUIC Remote Code Execution Vulnerability
- CVSS 9.8 Windows DNS Server Remote Code Execution Vulnerability
- CVSS 9.8 Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
- CVSS 9.8 Windows iSCSI Target Service Remote Code Execution Vulnerability
- CVSS 8.8 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
- CVSS 8.8 Windows DNS Server Remote Code Execution Vulnerability
- CVSS 8.8 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
- CVSS 8.8 Windows GDI+ Remote Code Execution Vulnerability
- CVSS 8.8 Windows DHCP Server Remote Code Execution Vulnerability
- CVSS 8.8 Remote Desktop Client Remote Code Execution Vulnerability
- CVSS 8.8 Microsoft SharePoint Server Elevation of Privilege Vulnerability
- CVSS 8.8 Microsoft SharePoint Server Elevation of Privilege Vulnerability
How to install this month's updates
- Windows PCs: Settings → Windows Update → Check for updates, install, and restart. Restarting is what actually applies the fix.
- Managed fleets: approve this month's updates in Intune, Windows Update for Business or WSUS, and push the exploited fixes first instead of waiting for your normal ring schedule.
- Microsoft 365 Apps / Office: usually updates itself; in any Office app, File → Account → Update Options → Update Now to make sure.
- Servers: Exchange, SharePoint and SQL Server need their own update packages; they don't come through Windows Update alone.
- Check it worked: confirm the build number afterwards (run
winver) or check with our version checker.
By type
| Type | Fixes |
|---|---|
| Elevation of Privilege | 152 |
| Remote Code Execution | 110 |
| Information Disclosure | 85 |
| Spoofing | 16 |
| Denial of Service | 11 |
| Security Feature Bypass | 11 |
| Tampering | 4 |
Most-patched products
| Product | Fixes |
|---|---|
| Microsoft Office SharePoint | 29 |
| Microsoft Office | 29 |
| Microsoft Office Excel | 28 |
| Microsoft Office Word | 17 |
| Windows DNS | 16 |
| Windows DHCP Server | 14 |
| Windows Win32K | 13 |
| Windows Telephony Service | 12 |
The next Patch Tuesday is Nov 10, 2026 (in 5 days). Microsoft usually publishes around 10 a.m. Pacific; this page updates within the hour.
Questions
What should I patch first from Patch Tuesday August 2026?
The 1 exploited flaw: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability. Attackers are already using it.
When is the next Patch Tuesday?
Nov 10, 2026. Microsoft releases security updates on the second Tuesday of every month.
Source: Microsoft's August 2026 release notes and CISA's exploited-vulnerability catalog. Counts exclude Chromium fixes shipped in Microsoft Edge. Microsoft last revised this release on Nov 2, 2026. General information only; confirm details with Microsoft.