In a fresh development, this doesn't affect our editorial independence. When you purchase through links in our articles, we may earn a small commission.
Industry observers note that alongside Windows and Office, other products and services are also affected: Teams, Exchange Server, Hyper-V, Windows Defender, Visual Lab, and Microsoft’s cloud services. As part of August’s Patch Tuesday, Microsoft dropped security updates that address 398 fresh vulnerabilities.
As part of the ongoing story, among the remainder, all but one are classified as high risk. One Windows flaw is already being exploited in the wild, while two vulnerabilities were already publicly known beforehand. Microsoft classifies 42 of the vulnerabilities as critical.
According to the latest update, the next scheduled Patch Tuesday will be on September 8th, 2026.
Industry observers note that windows 10’s support officially ended in October 2025, but those enrolled in the Extended Security Updates (ESU) program continue to receive security updates until October 2027. A large number of the vulnerabilities—over 200 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates.
Industry observers note that attackers can gain elevated privileges, allowing them to execute code with system privileges. To do this, they must combine this exploit with another remote code execution (RCE) vulnerability. The only Windows security vulnerability in this month’s patch that’s already being exploited in the wild is the use-after-free (UAF) vulnerability CVE-2026-68820, in the Windows auxiliary function driver for Winsock.
Industry observers note that these include, for example, the RCE vulnerability CVE-2026-62878 in the Windows DNS server. If successful, the buffer overflow can be exploited to execute code with elevated privileges without user interaction. Microsoft has classified 18 Windows security vulnerabilities as critical.
In a fresh development, the flaw stems from actions being performed on an object without first checking whether the object in question actually exists. The UAF vulnerability CVE-2026-62893 in the Trivial File Transfer Protocol (TFTP) server of Windows Deployment Services could be exploited via UDP port 69 to inject and execute code without user interaction.
As part of the ongoing story, although only classified as high risk, it also contains the RCE vulnerability CVE-2026-59124. But since Microsoft’s High Performance Computing (HPC) Pack isn’t enabled by default, the vulnerability isn’t considered critical—even if attackers could use it to execute injected code. The RCE vulnerability CVE-2026-62815 in Quick UDP Internet Connections (QUIC) can also be used to execute injected code without user interaction.
The report highlights that check out our picks for the best antivirus programs for Windows as well as best VPN services to stay ahead of security problems. Tip: Whether you keep your Windows up to date, you need proper antivirus protections if you want your PC to remain secure and private.
The report highlights that these include 22 RCE vulnerabilities classified as critical, five of which are in the Office graphics component. With critical RCE vulnerabilities in Office, the preview pane is often the attack vector—a user doesn’t need to actually open a file with Office for an attack to succeed. Microsoft has fixed 128 security vulnerabilities in its Office products.
Industry observers note that rCE vulnerabilities classified as high risk can be exploited if a user opens a malicious Office file in a vulnerable Office product (open-and-own).
As part of the ongoing story, microsoft has fixed seven security vulnerabilities in Exchange Server.
In a fresh development, an attacker can bypass user authentication and take control of all email accounts, send and receive emails, and download attachments. The elevation of privilege (EoP) vulnerability CVE-2026-62911 is classified as critical, and the exploitability of this flaw was successfully demonstrated in May at the Pwn2Own hacking competition in Berlin.
According to the latest update, the remaining six vulnerabilities are classified as high risk, including the RCE vulnerability CVE-2026-62913.
The report highlights that it addresses 41 Chromium vulnerabilities, which aren’t included in the total number of vulnerabilities mentioned above. The next Chrome/Chromium patch, which addresses five vulnerabilities, is due out this week. The most recent security patch to Edge 151.0.4129.78 is dated August 10th and is based on Chromium 151.0.7922.109.
In a fresh development, this article originally appeared on our sister publication PC-WELT and was translated and localized from German.
In a fresh development, his main topics are IT security (malware, antivirus, security gaps) and Internet technology. Frank Ziemann has been working as a freelance author for sister site PC-WELT since 2005, writing news and test reports.