Security News Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2026-patch-tuesday-fixes-400-flaws-3-zero-days/

Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

Patch Tuesday addresses 42 "Critical" vulnerabilities, 37 of which are remote code execution and 5 are elevation of privilege.

The approximate number of bugs in each vulnerability category is listed below:

• 176 Elevation of Privilege Vulnerabilities
• 11 Security Feature Bypass Vulnerabilities
• 110 Remote Code Execution Vulnerabilities
• 86 Information Disclosure Vulnerabilities
• 12 Denial of Service Vulnerabilities
• 21 Spoofing Vulnerabilities

When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today.

Therefore, the number of flaws does not include some flaws in Mariner, Microsoft Teams, Microsoft Azure, Microsoft Entra, Microsoft Office, and Power Apps that were fixed by Microsoft earlier this month.

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

ZDI: The August 2026 Security Update Review

I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “new normal”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, but still huge by historical standards. Take a break from your regularly scheduled activities as we take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for August 2026

For the first part of the August release, Adobe released five bulletins addressing 51 unique CVEs in Adobe ColdFusion, Commerce, Lightroom Classic, Content Credentials SDK, and Adobe Campaign Classic.

If you’re running Campaign Classic, that’s your priority. Not only is it a deployment priority of 1, but it also contains two different CVSS 10 bugs and supersedes the patch that was just released on August 3. ColdFusion is also deployment priority 1 and also contains a CVSS 10 bug. Adobe Commerce rates a priority 2 with code execution bugs as high as CVSS 9.1. The patches for Lightroom Classic and Content Credentials SDK are packed with CVEs, but only rate a deployment priority of 3.

None of the Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release.

Microsoft Patches for August 2026

There are a couple of things to point out right at the beginning. Again, counting is difficult due to the size, but I see 398 new CVEs to go along with the other updates documented this month. However, there is only one listed being under active attack, so we’ve got that going for us, which is nice. The release impacts Windows and Windows components, Office and Office Components, AMD Zen, Azure and Azure Components, GitHub Copilot, Windows Defender, Exchange Server, SharePoint, OneDrive for macOS, Teams, Power BI, .NET and Visual Studio, DHCP Server and Client, DNS Server, and Windows TPM. Minecraft is absent from this release. All told, there are 62 rated Critical, one rated Moderate, with the rest rated Important in severity. Eight of these bugs were submitted through the ZDI program.

This volume of updates indeed seems to be the new normal – at least for now. What is interesting is that, while there is an explosion of bugs being reported (and fixed), there has been no equivalent increase in the number of bugs being actively exploited, at least as 0-days.

Looking Ahead

The next Patch Tuesday will be on September 8, just after Labor Day here is the US. I’ll be back then to give you my full thoughts on the release – no matter how large it may be. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Zero Day Initiative — The August 2026 Security Update Review

I’ve successfully survived Hacker Summer Camp, and I have returned with a new outlook on patch density. When even Linus Torvalds says that huge updates are the “ new normal ”, it’s time to readjust what we consider a true bug apocalypse. This month’s release is thankfully smaller than last months, b

www.zerodayinitiative.com