Microsoft Patch Tuesday Analysis – August 2026

Executive Summary

On Tuesday, August 11, 2026, Microsoft released its monthly security patch, addressing 419 vulnerabilities across its products.

By severity level:

• Important - 356;
• Critical - 62;
• Moderate - 1.

Exploited (Zero-Days) and Publicly Disclosed Vulnerabilities

Special attention should be paid to the following 3 vulnerabilities. Fixing them is of the highest priority:

• CVE-2026-68820 (CVSS 7.0; Important) - Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (Elevation of Privilege).
• CVE-2026-72971 (CVSS 5.5; Important) - Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability (Tampering).
• CVE-2026-62832 (CVSS 7.8; Important) - Windows User Profile Service Elevation of Privilege Vulnerability (Elevation of Privilege).

General Trends

The August 2026 Patch Tuesday confirms that the anomalous workload on IT departments, which began in July, was not a one-time event. Microsoft released fixes for 419 vulnerabilities, keeping the number of critical threats at a consistently high level (62 Critical). This ongoing "patch storm" indicates a deep rework of the codebase and demands maximum resilience from organizations regarding their patch management processes. Key trends for August:

• Active kernel exploitation and public disclosures: This month saw active exploitation (Zero-Day) of an elevation of privilege vulnerability in the AFD.sys driver (CVE-2026-68820). This driver (Ancillary Function Driver for WinSock) has historically been a favorite target for hackers to take over the system after initial penetration. Additionally, details of vulnerabilities in the User Profile Service and the Container Isolation FS Filter Driver have been publicly disclosed, making the appearance of exploits for them a matter of days.
• Maximum threat (CVSS 10.0) for cloud and communications: August stands out with three vulnerabilities carrying the maximum possible CVSS rating of 10.0. Azure SQL Database, Microsoft Teams, and Microsoft Planetary Computer Pro are under attack. Combined with critical flaws (CVSS 9.9) in Azure Service Bus and Entra Provisioning Service, this indicates that cloud and hybrid infrastructure are at critical risk of a complete takeover.
• Network foundation under massive attack (RCE): A whole layer of critical remote code execution vulnerabilities in basic network components, without which no corporate network can function, has been closed. The fixes affected Windows DNS Server, DHCP Server, SMBv3, RPC Runtime Library, and Windows Deployment Services (WDS). Exploitation of such flaws is classically used to create network "worms" and massively infect servers without authentication.
• The ongoing Office and SharePoint crisis: The patch list once again features dozens of RCE vulnerabilities for Microsoft Excel, Word, Office, and SharePoint Server. It is obvious that attackers continue to actively seek and find ways to bypass sandboxes and defense mechanisms in documents, making phishing the most relevant vector for initial access.
• Massive Elevation of Privilege (EoP): Over 200 fixes are aimed at eliminating local elevation of privilege. Almost all system levels are vulnerable: Win32k, kernel, DWM, Windows Installer, telemetry, and virtualization services.

Full List of Vulnerabilities

Below is a table with all the vulnerabilities fixed this month.

Retrospective Vulnerability Analysis

• CVE-2026-50338 - Azure Spring Apps Elevation of Privilege Vulnerability (Elevation of Privilege). An improper authentication vulnerability (CWE-287) in Azure Spring Apps allows an authenticated attacker with basic privileges to elevate their rights over the network. Successful exploitation leads to a change in the security scope, allowing attacks on resources outside the Azure Spring Apps component within the cloud infrastructure. The attack is highly complex and requires advance preparation of the target environment. A PoC is available for the vulnerability. It was fixed in July 2026.

• CVE-2026-49176 - Windows WalletService Elevation of Privilege Vulnerability (Elevation of Privilege). A local elevation of privilege vulnerability related to improper access control and link resolution. Exploitation allows an attacker with basic rights to utilize the vulnerable WalletService WinRT interface and path redirection (e.g., by spoofing the documents folder) to execute code with system privileges (NT AUTHORITY\SYSTEM). The vulnerability was fixed in July 2026.

• CVE-2026-58635 - Windows Narrator Braille Elevation of Privilege Vulnerability (Elevation of Privilege). A Command Injection vulnerability in the Windows Narrator Braille component allows a local attacker to elevate their privileges to the context of the "NT AUTHORITY\Network Service" system account. The issue is related to the improper neutralization of file paths when passed as parameters through the brlapi.dll library. A confirmed PoC exists for this vulnerability, demonstrating exploitation through manipulation of Braille table parameters during connection setup. The vulnerability was fixed in July 2026.

• CVE-2026-50343 - Microsoft Install Service Elevation of Privilege Vulnerability (Elevation of Privilege). The vulnerability is related to improper privilege management (incorrect Access Control Lists, ACLs) in the registry key of the Microsoft Store Install Service. A local unprivileged user can write a path to an arbitrary dynamic-link library (DLL) into the StaticPluginMap registry key. When an update check is initiated via the WinRT API (AppInstallManager), the system service loads this library, resulting in a local elevation of privileges and the execution of arbitrary code with the highest NT AUTHORITY\SYSTEM rights. A PoC exists for this vulnerability. It was fixed in July 2026.

• CVE-2026-50454 — Windows User Interface Core Elevation of Privilege Vulnerability (Elevation of Privilege). The vulnerability is related to a Relative Path Traversal in the Windows User Interface Core subsystem, allowing a local user to elevate their privileges to the SYSTEM level. The available PoC demonstrates hijacking the protected ms-settings protocol association via the internal WinRT COM interface AppResolver, followed by launching the trusted system process fodhelper.exe to bypass UAC and execute arbitrary code with SYSTEM rights. The vulnerability was fixed in July 2026.

• CVE-2026-50402 — Windows NTFS Elevation of Privilege Vulnerability (Elevation of Privilege). The vulnerability is associated with a signed/unsigned integer comparison error in the NtfsIsBootSectorNtfs function of the ntfs.sys driver during MFT cluster number validation. When opening a specially crafted VHDX file, the improper check allows bypassing validation and triggering an out-of-bounds read, leading to a denial of service, as well as allowing the modification of file access rights at the kernel level by manipulating the $LogFile journal. A detailed technical writeup of the vulnerability can be found on GitHub. The vulnerability was fixed in July 2026.

• CVE-2026-58613 — Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (Elevation of Privilege). A Use-After-Free (UAF) vulnerability in the Windows Cloud Files Mini Filter Driver (cldflt.sys), an analysis of which was published by Cisco Talos researchers. The issue stems from the improper cleanup of orphaned requests in a global countdown timer when the synchronization provider process terminates prematurely. This leads to accessing a freed thread context (HSM_STREAM_CONTEXT) when executing the CldiStreamCompleteRequest function, allowing a local attacker to elevate their privileges to the SYSTEM level. A detailed description of the vulnerability is available on the website. The vulnerability was fixed in July 2026.

• CVE-2026-50475 — Windows Kernel Information Disclosure Vulnerability (Information Disclosure). Cisco Talos researchers have published a detailed report with PoC code demonstrating an off-by-one out-of-bounds vulnerability in the NsipGetAllInformationProviderParameters function of the NETIO.sys driver. Sending a specially crafted I/O request (IRP) allows a local authenticated user to extract 16 bytes of data from kernel memory. This exposes the addresses of tcpip.sys functions and makes it possible to calculate the driver's base address, resulting in a complete bypass of the KASLR protection mechanism. The vulnerability was fixed in July 2026.

• CVE-2026-50416 — Win32k Information Disclosure Vulnerability (Information Disclosure). A vulnerability in the Win32k subsystem related to the leakage of a raw kernel pointer at offset 0x100 within the user desktop heap projection. This allows local processes with minimal rights, including those in isolated sandboxes (Low Integrity, AppContainer, LPAC), to read kernel memory addresses and calculate the exact virtual addresses of window and menu objects, leading to a complete bypass of the KASLR protection mechanism. A PoC and vulnerability writeup are available on GitHub. The vulnerability was fixed in July 2026.

• CVE-2026-50656 — Microsoft Defender Elevation of Privilege Vulnerability (Elevation of Privilege). A vulnerability in the Microsoft Malware Protection Engine (mpengine.dll), publicly known as "RoguePlanet". The issue involves the improper handling of symbolic links before file access, causing a race condition when files are scanned by the Defender engine. A local authenticated user with low privileges can manipulate symbolic links while the antivirus process handles files, allowing them to redirect file operations and elevate their privileges on the system. A proof-of-concept PoC is available for testing. The vulnerability was fixed in June 2026.

• CVE-2026-42978 — Windows Push Notifications Elevation of Privilege Vulnerability (Elevation of Privilege). A Use-After-Free and Race Condition vulnerability in the Windows Push Notification Service (WpnService / wpncore.dll), executing in the context of NT AUTHORITY\SYSTEM. The issue is due to a lack of synchronization and state checks regarding the platform's shutdown in the methods of the PresentationEndpointFacade class: a local authorized attacker can trigger a race condition when accessing a freed NotificationPlatform object to execute code with SYSTEM-level privileges. Vulnerability research is available on GitHub. The vulnerability was fixed in June 2026.

• CVE-2026-45659 - Microsoft SharePoint Remote Code Execution Vulnerability (Remote Code Execution). An insecure data deserialization vulnerability in Microsoft SharePoint allows an authenticated attacker with minimal privileges to execute arbitrary code on the server via a network request to the REST API. A PoC is provided on GitHub. Fixed in May 2026.

• CVE-2026-41091 - Microsoft Defender Elevation of Privilege Vulnerability (Elevation of Privilege). A local vulnerability in the Microsoft Malware Protection Engine (mpengine.dll) related to the improper handling of junction points and symbolic links. Exploiting the vulnerability allows an authorized attacker to utilize a race condition using the Oplock locking mechanism and the Cloud Filter API to redirect write operations into protected system directories and execute code with SYSTEM-level privileges. A PoC exploit is available on GitHub. The vulnerability was fixed in May 2026.

Conclusion

The August 2026 update continues to test the resilience of corporate cybersecurity processes. Fatigue from July's record-breaking patch (622 vulnerabilities) must not cause delays, as the August package contains an actively exploited vulnerability and threats with a maximum CVSS rating of 10.0.

Recommended Action Plan for August:

1. Immediate Response (Zero-Day and Public): Urgently update workstations and servers to close the vulnerability in the AFD.sys (CVE-2026-68820) driver, which is already being used in real-world attacks. Also, prioritize patching the publicly disclosed flaws in the User Profile Service (CVE-2026-62832) and the unionfs.sys driver (CVE-2026-72971).
2. Critical Infrastructure Protection (CVSS 10.0 / 9.9): Database servers (Azure SQL), corporate communications (Microsoft Teams), and key cloud components (Entra, Service Bus) must be patched immediately. The compromise of these systems will lead to a halt in business processes.
3. Network Perimeter and Basic Services: Roll out updates to servers performing the roles of DNS, DHCP, RPC, and file shares (SMBv3). An RCE in these components is a direct path to the loss of the entire Active Directory domain.
4. End Users and Web Portals: Update Microsoft Office clients and SharePoint servers to block phishing attacks and corporate data theft.

Critical Retrospective Warning: The "Retrospective Vulnerability Analysis" section this month reads like a catalog of ready-made cyber weapons. High-quality PoC exploits for May, June, and July vulnerabilities have been published in open access (on GitHub and in infosec researcher blogs). These involve privilege escalation via Install Service, Defender, NTFS, Cloud Files, Win32k, as well as RCE in SharePoint. The availability of these scripts means that any system that has not received updates over the summer of 2026 can be compromised even by a low-skilled attacker ("script kiddie") in a matter of minutes. Clearing the technical debt for patches from previous months is an absolute priority.