August’s Patch Tuesday is a monster: 751 fixes, with an exploited Windows flaw

Microsoft's August 2026 Patch Tuesday closed with 751 CVE entries across all product families, with 108 rated as critical. One flaw, CVE-2026-68820, is already exploited, affecting the Windows WinSock driver (afd.sys) by enabling elevation of privilege. Two other vulnerabilities, CVE-2026-62832 and CVE-2026-72971, were disclosed but not exploited. This security-focused update is recommended for Windows, Office, and Exchange systems, while no SQL Server updates were released this month.

Several critical issues impact server roles, including Windows DNS Server with a cluster of critical Remote Code Execution (RCE) vulnerabilities and Windows DHCP Server, which appears most populated with 14 entries. It is recommended to begin testing with printing and fonts, followed by the Remote Desktop client, and then perform a smoke test on the WinSock flaw due to the exploited afd.sys vulnerability. The Readiness team provided an infographic detailing deployment risks for the Microsoft August update.

Both August client and server-side updates come with empty known-issues lists, which may change as the update is deployed. No service or enforcement deadlines were published by Microsoft for this August update. The 13 October 2026 date marks the end of Extended Support for Windows Server 2012 and 2012 R2, Windows 10 2016 LTSB, Office LTSC 2021, and retail Office 2021. Windows Server 2022 will reach extended support on 13 October 2026, with security-only support extending to 14 October 2031.