Microsoft's August 2026 Patch Tuesday Addresses 398 CVEs (CVE-2026-68820)
August 11, 2026 · Tenable Blog · Severity: CRITICAL
Microsoft's August 2026 Patch Tuesday addresses a record 398 CVEs, with 42 rated critical, 355 important, and one moderate. The update includes patches for a wide range of products, such as .NET, Azure services, Microsoft Office, Windows components, and third-party integrations like GitHub Copilot. Notably, three zero-day vulnerabilities are fixed, one of which was exploited in the wild, underscoring the urgency for organizations to apply these patches promptly. The release also omits two CVEs assigned by MITRE (CVE-2026-6726 and CVE-2026-6727), which may require separate attention. 📌 **Analyst Note:** The active exploitation of one zero-day, likely CVE-2026-68820, poses immediate risk to unpatched systems, especially in enterprise environments relying on affected services like Active Directory or Exchange Server. Organizations should prioritize deployment of these patches to mitigate potential breaches.
Key Takeaways
- Microsoft patched 398 CVEs in August 2026, including 42 critical and three zero-days.
- One zero-day was actively exploited in the wild, highlighting urgent patching needs.
- The update covers major components like .NET, Azure, Exchange Server, and Windows.
- CVE-2026-68820 is the headline vulnerability, with two additional MITRE-assigned CVEs omitted.