Microsoft's August Patch Tuesday covers 421 vulnerabilities, including 236 in Windows — one of the largest totals ever. Key highlights include a critical unauthenticated RCE chain in SharePoint (CVE-2026-55040 + CVE-2026-63520) disclosed by Rapid7 researcher Stephen Fewer, a zero-day elevation-of-privilege in the Windows Ancillary Function Driver for WinSock (CVE-2026-68820) actively exploited in the wild and attributed to North Korean threat actors, and continued uncoordinated disclosures from pseudonymous researcher Nightmare Eclipse targeting Windows Defender. Notable lifecycle events include Windows 11 24H2 Home & Pro, Windows Server 2022, Windows Server 2012/2012 R2, Office 2021, and Exchange Server 2016/2019 all reaching end-of-support milestones in October. Microsoft Edge also saw an unusually long five-day gap between Chrome and Edge security patches this month.
Table of contents
SharePoint: critical RCE chain by Rapid7AFD for Winsock: zero-day EoPWhat’s the opposite of coordinated disclosure?Container isolation filesystem driver: isolation failure, tamperingEdge: update slowdown?Microsoft lifecycle updateQuestions this post answers
What is CVE-2026-68820 and why is it considered high priority despite a CVSS score of only 7.0?
CVE-2026-68820 is an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) that is actively exploited in the wild. Despite a CVSS v3 base score of 7.0 — kept lower because exploitation requires winning a race condition — successful exploitation requires no user interaction and grants SYSTEM-level access. Microsoft credits discovery to Check Point researchers, and the vulnerability is expected to be added to the CISA KEV catalog. Teams patching Windows environments track actively exploited CVEs like this one on daily.dev before they hit the KEV list.
How does the SharePoint critical RCE chain involving CVE-2026-55040 and CVE-2026-63520 work?
The chain combines two vulnerabilities discovered by Rapid7 researcher Stephen Fewer. CVE-2026-55040 is a JWT token authentication bypass, and CVE-2026-63520 is a high-severity remote code execution flaw. When chained together, they form a critical unauthenticated remote code execution vulnerability against a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. A detailed technical analysis and proof-of-concept for CVE-2026-55040 has been published. SharePoint administrators deciding patch urgency for their on-prem servers can follow the full disclosure thread on daily.dev.
When does Windows Server 2012 R2 Extended Security Update support end?
Windows Server 2012 and 2012 R2 reach the end of their Extended Security Update program on October 14, 2026. This marks the expiry of the third and final year of the paid ESU program, after which no further security updates will be available for these versions. On the same date, Windows Server 2022 moves to extended support and Office 2021 (including the LTSC edition) also loses support with no ESU option. Admins planning migrations off end-of-life Windows Server versions can track deadline coverage on daily.dev.