Microsoft Monthly Security Update (August 2026)
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
CSIRTS triage
- What
- Microsoft products contain multiple vulnerabilities allowing remote code execution and privilege escalation.
- Who is affected
- Windows and Microsoft product users running unpatched August 2026 versions.
- Urgency
- Critical; CVE-2026-68820 is confirmed exploited in the wild.
- Action
- Apply Microsoft August 2026 Security Updates immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.hkcert.org/security-bulletin/microsoft-monthly-security-update-august-2026
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-68820Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 26% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-628322.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 82% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-729710.36% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 29% of all EPSS-scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-68820 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-62832 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-72971 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- unknownexploitedSecurity Alert: Microsoft Releases August 2026 Security Updatesjpcert
- unknownexploitedMultiple vulnerabilities in Microsoft Windows (August 12, 2026)cert-fr-avis
- unknownexploitedNCSC-2026-0284 [1.00] [M/H] Vulnerabilities patched in Microsoft Windowsncsc-nl
- mediumCVE-2026-72971: Improper link resolution before file access ('link following') in Windows Container Isolation …nvd
- highexploitedCVE-2026-68820: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker …nvd
- highCVE-2026-62832: Improper link resolution before file access ('link following') in Windows User Profile Service…nvd
- highexploitedCISA Adds Three Known Exploited Vulnerabilities to Catalogcisa
- highCVE-2026-62832: Windows User Profile Service Elevation of Privilege Vulnerabilitymsrc
- mediumCVE-2026-72971: Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerabilitymsrc
- highexploitedCVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymsrc
- criticalexploitedCVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerabilitycisa-kev
More from HKCERT Security Bulletins
- unknownMicrosoft Edge Multiple Vulnerabilities2026-08-17
- unknownVMWare Products Multiple Vulnerabilities2026-08-14
- unknownPalo Alto Products Multiple Vulnerabilities2026-08-14
- unknownMongoDB Multiple Vulnerabilities2026-08-13
- unknownIBM WebSphere Products Multiple Vulnerabilities2026-08-13