August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?
August 2026 Patch Tuesday forecast urges risk-based triage as AI inflates CVE volume, flags actively exploited SharePoint RCE CVE-2026-50522 and LegacyHive Windows flaw.
July 2026 Patch Tuesday set records with over 600 CVEs, including 405 for Windows 11 and Server 2025, though only two were exploited zero-days and one was publicly disclosed. The author recommends prioritizing known-exploited and internet-facing vulnerabilities, matching patches to high-risk systems, and accelerating ring-based deployment toward Microsoft's suggested three-day turnaround. Notable items include actively exploited SharePoint RCE CVE-2026-50522 enabling machine key theft, the unassigned LegacyHive Windows User Profile Service flaw, and several end-of-servicing dates for Windows and Exchange.
- Only 2 exploited zero-days and 1 public disclosure among 600+ July CVEs
- SharePoint CVE-2026-50522 actively exploited for machine key theft
- LegacyHive: non-admin can mount other users' registry hives; fix pending
- Windows 11 24H2 end of servicing October 13, 2026; Exchange ESU ends October
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-50522 | Unauthenticated Deserialization RCE in Microsoft SharePoint Server CVE-2026-50522 is a deserialization of untrusted data flaw (CWE-502) in Microsoft SharePoint Server that allows an unauthenticated attacker to send maliciously crafted serialized data over the network and execute code on the server, reflected in its 9.8 critical CVSS score with no privileges or user interaction required. Successful exploitation yields full remote code execution with high impact on confidentiality, integrity, and availability, giving attackers a foothold for follow-on actions such as data theft, lateral movement, or ransomware. Any organization running on-premises SharePoint Server is in scope, particularly deployments reachable from untrusted networks; the required action notes stakeholders must evaluate each asset's internet exposure under CISA BOD 26-04. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-07-22 and security news headlines describe it as a critical RCE exploited in the wild, with some reports referencing exploitation after a public proof-of-concept release and an authentication bypass. The structured record lists no public PoC as confirmed, but an EPSS of 84.6% (100th percentile) underscores a very high near-term exploitation likelihood. Do: Apply Microsoft's security updates for SharePoint Server immediately per the vendor advisory, as required under CISA's KEV listing and BOD 26-04, and prioritize any SharePoint deployments that are internet-facing (federal/critical-infrastructure operators must follow BOD 26-04 timelines or discontinue unmitigated use). Until patched, restrict public access to SharePoint endpoints (VPN, firewall rules, or reverse proxy) and review IIS/application logs and running processes for signs of unauthenticated deserialization abuse. Because some reports reference an authentication bypass being chained, also verify authentication paths and monitor for follow-on attacker activity after patching. | 9.8 | 85% | KEV |
| massorder of 100,000+ on-prem SharePoint Server deployments worldwide, with tens of thousands plausibly internet-exposed |
Full article1,145 words · extracted from helpnetsecurity.com · click to collapse
July 2026 Patch Tuesday was record-setting in so many ways. The sheer volume of security patches for almost every product in the Microsoft portfolio was the highest ever and, of course, well over 600 CVEs were identified in the Security Updates Guide.
Interestingly, only two CVEs were reported as exploited zero-days and only one as publicly disclosed, but we’ll get back to that later in this article. There were 405 CVEs reported against Windows 11 and Server 2025, and 337 logged for Windows 10 and its associated server versions. There were record numbers of CVEs for Microsoft SharePoint and Office, and also updates for SQL Server, Exchange Server, and .NET framework as well.
Did you catch the CVEs reported for Age of Empires and Minecraft Server? Many organizations are still struggling to test and deploy all these patches, and others are asking if there may be another wave coming next week.
The impact of AI on vulnerability identification is forcing IT administrators and security professionals to ask questions and drive changes in the patch management industry. Microsoft is even recommending a three-day turnaround on patching, with a two-day grace period to stay ahead of the ‘AI-accelerated’ threats as they continue to grow.
As you can imagine, this sparked a debate among several industry experts. They agree the threat will continue to grow but the challenge to meet a three-day requirement is that large enterprises are constrained by testing, change control, and compatibility requirements. That challenge needs to be addressed by building a process that can deploy patches in days for the vulnerabilities that matter most and stays disciplined with everything else.
Only a small fraction of disclosed vulnerabilities are ever confirmed as exploited in the wild. I mentioned in my introductory paragraph only three CVEs out of 600+ from July Patch Tuesday were known exploited or publicly disclosed, so there’s no need to focus heavily on all the other patches immediately or to treat every CVE as an emergency.
Focus on triaging the CVEs and patches accordingly, assessing your systems’ exposure to the highest vulnerabilities, testing as appropriate for the systems involved, and deploying in risk priority once you’ve completed your assessment. Traditional ring deployment included deployment of almost all patches starting with a small pilot group, then to less critical company systems, and finally installation organization wide.
The Patch Apocalypse requires a new approach with a more specific focus on risk:
- Identify the known exploited or internet facing vulnerabilities as the most critical
- Match those patches up with the systems in your organization that are at highest risk based on network location, data processed, business criticality, etc.
- Develop a quick test or an acceptance scenario to ensure the patches do not disrupt those systems. Once that is complete you can deploy this set and move on to the next set of lower priority systems. This approach is key to reducing risk in the Patch Apocalypse.
There were a few important items to note from this past month as we go into the August Patch Tuesday. If you are still catching up on deploying the updates from July, you should focus on getting the SharePoint patches out. The Microsoft Security Center announced that CVE-2026-50522, a remote code execution vulnerability, is now actively being exploited. Hackers can steal machine keys using this vulnerability and maintain access after the system is patched. With these keys, a remote attacker can execute code on the SharePoint system.
Speaking of hackers, the researcher, Nightmare Eclipse, is in the news again with a disclosed vulnerability being called LegacyHive. Per ACROS Security, ‘The vulnerability allows a regular non-admin user to mount any other user’s registry hive in full access mode, and then either access that user’s stored secrets or modify any values in their registry to affect what gets executed the next time they log in.’ This vulnerability in the Windows User Profile Service has been acknowledged by Microsoft and they are working on a fix. There is no CVE assigned yet, but this is one to look for in the upcoming August release.
And finally, if you have edge systems with outdated secure boot certificates, Microsoft has introduced some targeting improvements in the latest Windows 11 24H2 and 25H2 preview patch. This enhancement will ‘increase coverage’ of devices eligible to receive new Secure Boot certificates and should help you out next week with the cumulative updates.
There are several products reaching End of Servicing per Microsoft’s Modern Policy, meaning the continuous updates will cease and there is no extended support. Windows 11 Version 24H2 reaches End of Servicing in two months on October 13th, 2026. On November 10th, Windows 11 Version 23H2 Enterprise and Education Editions, as well as Windows 11 IoT Enterprise 23H2, will reach End of Servicing. Microsoft also announced the end of ESU support for Exchange Server 2016/2019 this October. The ESU support has been extended for a six-month period, but will not be extended again so plan accordingly per the announcement’s recommendations.
August 2026 Patch Tuesday forecast
- Microsoft has already said the large volume CVE trend will continue as AI identifies more vulnerabilities. With that already stated, we can expect another large set of updates with many new CVEs reported. I suspect Microsoft fixed a lot of the ‘low hanging fruit’ last month so maybe the number will be back to normal highs we’ve seen in the past. We may not see the entire portfolio updated but most of the products will receive updates again.
- Adobe had a small set of releases on July 28th for Format Plugins, Bridge, and the on-premise Campaign Classic. It’s hard to know what AI will find and Adobe will fix, but I would consider Photoshop, InCopy, InDesign, and Acrobat Reader high on the list of possibilities since they didn’t have updates in the last month.
- It’s unlikely Apple will release any updates next week. The last major release was on July 27th for macOS Tahoe 26.6, macOS Sequioa 15.7.8, and macOS Sonoma 14.8.9. These releases had large numbers of reported CVEs with Tahoe having 128 unique CVEs as an example. There was a minor release on August 6th with just CVE-2026-65400, a screen sharing vulnerability, addressed in each. Applying the latest patches will take care of the major release as well since they are cumulative.
- Google released Chrome Desktop 151.0.7922.108 for Windows on August 6th addressing 41 CVEs. They continue to release security updates weekly, but I suspect we see fewer CVEs with a minor update next week.
- It’s likely we’ll see Mozilla release some minor updates for Thunderbird and Firefox next week. The last major release was July 21st for Firefox and Thunderbird 153, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.
Welcome to the patch apocalypse! Traditional patching based on vendor severity and flat CVSS values is rapidly being overcome by events. And those events are AI-driven.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/08/07/august-2026-patch-tuesday-forecast/