Microsoft’s August 2026 Patch Tuesday addresses 421 Microsoft vulnerabilities, including 62 rated Critical. One Windows vulnerability has been exploited in the wild by the Lazarus group to gain SYSTEM privileges.

The August update is smaller than July’s record-breaking release, but it’s still among Microsoft’s largest Patch Tuesday batches. More importantly, it includes several flaws likely to attract attacker interest: a publicly disclosed Windows privilege escalation flaw with a proof-of-concept (PoC), a newly completed unauthenticated SharePoint remote code execution (RCE) chain, and a potentially wormable Windows DNS Server flaw.

How to apply patches and check if you’re protected

These updates fix security problems and help keep your Windows PC protected. Here’s how to make sure you’re up to date:

• Click the Start button, then open Settings.
• Select Windows Update (usually at the bottom of the menu on the left).
• Click Check for updates. Windows will search for the latest security updates. If you’ve enabled Get the latest updates as soon as they’re available under More options, you may be prompted to restart immediately to complete the update. Otherwise, continue to the next step.

• If updates are available, they’ll start downloading automatically. When they’re ready, click Install or Restart now if prompted. Your computer may need a restart to finish the update.
• After restarting, go back to Windows Update and check again. If it says You’re up to date, you’re all set.

Technical details

Windows Deployment Services (WDS) users should prioritize CVE-2026-62893 (CVSS score 9.8 out of 10), an unauthenticated RCE flaw in the TFTP (Trivial File Transfer Protocol) server. TFTP normally runs on UDP port 69 and has no built-in authentication. It is primarily an enterprise and school network issue, but it could enable lateral movement where WDS is deployed.

Microsoft also fixed CVE-2026-62832, a publicly disclosed elevation of privilege (EoP) vulnerability in the Windows User Profile Service. It maps to the issue researchers called LegacyHive, for which a limited public proof of concept was released in July.

The PoC demonstrates how a local authenticated attacker could abuse the service’s registry hive handling to load another user’s hive, potentially including an administrator’s. The released demonstration is deliberately constrained and requires credentials for another user, but the availability of code and the broad Windows footprint make this one a strong candidate for exploitation attempts.

Another good reason to promptly update is the number (I counted 48) of remote code execution (RCE) fixes for Office applications and components, including Excel, Word, Outlook, PowerPoint, and the Office graphics component. Document-borne vulnerabilities are attractive to phishing operators because email attachments and shared documents provide delivery mechanisms that people are likely to open.

---

---