--- title: Patch Tuesday - August 2026 | daily.dev description: Microsoft's August Patch Tuesday covers 421 vulnerabilities, including 236 in Windows — one of the largest totals ever. Key highlights include a critical... canonical: https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Patch Tuesday - August 2026 | daily.dev og:description: Microsoft's August Patch Tuesday covers 421 vulnerabilities, including 236 in Windows — one of the largest totals ever. Key highlights include a critical... og:url: https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo og:image: https://api.daily.dev/og/posts/TYBmWOhyO.png og:image:alt: Patch Tuesday - August 2026 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Patch Tuesday - August 2026 **[Rapid7 Cybersecurity Blog](https://daily.dev/sources/rapid7-blog)** · 46 min read · 0 upvotes · 0 comments ## Summary Microsoft's August Patch Tuesday covers 421 vulnerabilities, including 236 in Windows — one of the largest totals ever. Key highlights include a critical unauthenticated RCE chain in SharePoint (CVE-2026-55040 + CVE-2026-63520) disclosed by Rapid7 researcher Stephen Fewer, a zero-day elevation-of-privilege in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820) actively exploited in the wild and attributed to North Korean threat actors, and continued uncoordinated disclosures from pseudonymous researcher Nightmare Eclipse targeting Windows Defender. Notable lifecycle events include Windows 11 24H2 Home & Pro, Windows Server 2022, Windows Server 2012/2012 R2, Office 2021, and Exchange Server 2016/2019 all reaching end-of-support milestones in October. Microsoft Edge also saw an unusually long five-day gap between Chrome and Edge security patches this month. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-68820 and why is it considered high priority despite a CVSS score of only 7.0? CVE-2026-68820 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) that is actively exploited in the wild. Despite a CVSS v3 base score of 7.0 — kept lower because exploitation requires winning a race condition — successful exploitation requires no user interaction and grants SYSTEM-level access. Microsoft credits discovery to Check Point researchers, and the vulnerability is expected to be added to the CISA KEV catalog. _Teams patching Windows environments track actively exploited CVEs like this one on daily.dev before they hit the KEV list._ ### How does the SharePoint critical RCE chain involving CVE-2026-55040 and CVE-2026-63520 work? The chain combines two vulnerabilities discovered by Rapid7 researcher Stephen Fewer. CVE-2026-55040 is a JWT token authentication bypass, and CVE-2026-63520 is a high-severity remote code execution flaw. When chained together, they form a critical unauthenticated remote code execution vulnerability against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. A detailed technical analysis and proof-of-concept for CVE-2026-55040 has been published. _SharePoint administrators deciding patch urgency for their on-prem servers can follow the full disclosure thread on daily.dev._ ### When does Windows Server 2012 R2 Extended Security Update support end? Windows Server 2012 and 2012 R2 reach the end of their Extended Security Update program on October 14, 2026. This marks the expiry of the third and final year of the paid ESU program, after which no further security updates will be available for these versions. On the same date, Windows Server 2022 moves to extended support and Office 2021 (including the LTSC edition) also loses support with no ESU option. _Admins planning migrations off end-of-life Windows Server versions can track deadline coverage on daily.dev._ ## Similar posts on daily.dev - [Patch Tuesday - June 2026](https://daily.dev/posts/patch-tuesday---june-2026-7hi4b0ter) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [June 2026 Microsoft Patch Tuesday](https://daily.dev/posts/june-2026-microsoft-patch-tuesday-soc9er861) · Tenable Blog · 0 upvotes · 0 comments - [Patch Tuesday, May 2026 Edition – Krebs on Security](https://daily.dev/posts/patch-tuesday-may-2026-edition-krebs-on-security-mp4rjfele) · Krebs on Security · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#sharepoint](https://daily.dev/tags/sharepoint) [View this post on daily.dev](https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Patch Tuesday - August 2026","url":"https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo"},"datePublished":"2026-08-11T22:17:19.207Z","dateModified":"2026-08-24T06:55:43.489Z","description":"Microsoft's August Patch Tuesday covers 421 vulnerabilities, including 236 in Windows — one of the largest totals ever. Key highlights include a critical...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9bf82827b99e6992110f040c87e21172?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9bf82827b99e6992110f040c87e21172?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Rapid7 Cybersecurity Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Rapid7 Cybersecurity Blog","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/rapid7-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sharepoint","timeRequired":"PT46M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Rapid7 Cybersecurity Blog","item":"https://daily.dev/sources/rapid7-blog"},{"@type":"ListItem","position":3,"name":"Patch Tuesday - August 2026"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/patch-tuesday---august-2026-tybmwohyo#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-68820 and why is it considered high priority despite a CVSS score of only 7.0?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-68820 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) that is actively exploited in the wild. Despite a CVSS v3 base score of 7.0 — kept lower because exploitation requires winning a race condition — successful exploitation requires no user interaction and grants SYSTEM-level access. Microsoft credits discovery to Check Point researchers, and the vulnerability is expected to be added to the CISA KEV catalog. Teams patching Windows environments track actively exploited CVEs like this one on daily.dev before they hit the KEV list."}},{"@type":"Question","name":"How does the SharePoint critical RCE chain involving CVE-2026-55040 and CVE-2026-63520 work?","acceptedAnswer":{"@type":"Answer","text":"The chain combines two vulnerabilities discovered by Rapid7 researcher Stephen Fewer. CVE-2026-55040 is a JWT token authentication bypass, and CVE-2026-63520 is a high-severity remote code execution flaw. When chained together, they form a critical unauthenticated remote code execution vulnerability against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. A detailed technical analysis and proof-of-concept for CVE-2026-55040 has been published. SharePoint administrators deciding patch urgency for their on-prem servers can follow the full disclosure thread on daily.dev."}},{"@type":"Question","name":"When does Windows Server 2012 R2 Extended Security Update support end?","acceptedAnswer":{"@type":"Answer","text":"Windows Server 2012 and 2012 R2 reach the end of their Extended Security Update program on October 14, 2026. This marks the expiry of the third and final year of the paid ESU program, after which no further security updates will be available for these versions. On the same date, Windows Server 2022 moves to extended support and Office 2021 (including the LTSC edition) also loses support with no ESU option. Admins planning migrations off end-of-life Windows Server versions can track deadline coverage on daily.dev."}}]} ```