Microsoft's August 2026 Patch Tuesday addresses 398 CVEs (CVE-2026-68820)
Tenable reports Microsoft's August 2026 Patch Tuesday addresses 398 CVEs including three zero-days, one exploited in the wild (CVE-2026-68820).
Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 important, and one moderate, and three zero-days among them. One zero-day is confirmed as exploited in the wild. The release covers components including .NET, .NET Framework, Active Directory Certificate Services (AD CS), Azure services, and Windows. Tenable's count omits two CVEs assigned by MITRE, CVE-2026-6726 and CVE-2026-6727.
- 398 CVEs patched: 42 critical, 355 important, 1 moderate
- Three zero-days included; one exploited in the wild
- Coverage spans .NET, AD CS, Azure, and Windows components
- CVE-2026-68820 highlighted in the release
- Two MITRE-assigned CVEs excluded from Tenable's count
- Organizations
- Tenable
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-6726 | Info Leak in TCG TPM 2.0 Reference Code Enables Attestation Key Forgery | 7.9 | <1% | ||
| CVE-2026-6727 | Timing Side-Channel in TCG TPM 2.0 Reference Code RSA-OAEP Decryption | 5.9 | <1% | ||
| CVE-2026-68820 | Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver | 7.0 | <1% | KEV | KEV |
From the original article
42Critical 355Important 1Moderate 0Low Microsoft addresses 398 CVEs in the eighth Patch Tuesday of 2026, with three zero-days, including one that was exploited in the wild. Microsoft patched 398 CVEs in its August 2026 Patch Tuesday release, with 42 rated critical, 355 rated as important and one rated as moderate. Our counts omitted two CVEs assigned by MITRE; CVE-2026-6726 and CVE-2026-6727.
By Research Special Operations · tenable.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.