Microsoft's security release of 11 August 2026
Patch Tuesday, August 2026
As of , CISA lists two of the 402 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2026-65660, Microsoft SharePoint Server Remote Code Execution.
On CISA's list of exploited vulnerabilities
- CVE-2026-65660Microsoft SharePoint Server Remote Code Execution. Listed by CISA on 25 September 2026, 45 days after the release
- CVE-2026-68820Windows Ancillary Function Driver for WinSock Elevation of Privilege. Listed by CISA on 11 August 2026, release day
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 402 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | 1 CVE |
| CISA's SSVC exploitation: none | 399 CVEs |
| Not assessed by CISA's SSVC | none |
| Critical by CVSS (9.0 or more) | 7 CVEs |
| EPSS 0.10 or more | none |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2026-65660Microsoft SharePoint Server Remote Code Execution | Active | Patch nowListed | 8.8 High | 0.02 |
| 2 | CVE-2026-68820Windows Ancillary Function Driver for WinSock Elevation of Privilege | Active | Patch soonListed | 7.0 High | 0.00 |
| 3 | CVE-2026-62911Microsoft Exchange Server Elevation of Privilege | Proof of concept | Not on CISA's list | 8.0 High | 0.01 |
| 4 | CVE-2026-59124Microsoft High Performance Computing (HPC) Pack Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 5 | CVE-2026-63514Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 6 | CVE-2026-64901Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 7 | CVE-2026-65658Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 8 | CVE-2026-65663Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 9 | CVE-2026-65665Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 10 | CVE-2026-65815Microsoft Dynamics 365 On-Premises Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 11 | CVE-2026-66805Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 12 | CVE-2026-66808Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 13 | CVE-2026-70321Microsoft SharePoint Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.02 |
| 14 | CVE-2026-62912Microsoft Exchange Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 15 | CVE-2026-63516Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 16 | CVE-2026-62815Microsoft QUIC Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 17 | CVE-2026-62878Windows DNS Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 18 | CVE-2026-62893Windows Deployment Services TFTP Server Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 19 | CVE-2026-65791Windows iSCSI Target Service Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.01 |
| 20 | CVE-2026-50516Microsoft Azure Kubernetes Service Elevation of Privilege | None | Not on CISA's list | 9.4 Critical | 0.01 |
| 21 | CVE-2026-70306Microsoft Office SharePoint Spoofing | None | Not on CISA's list | 9.3 Critical | 0.01 |
| 22 | CVE-2026-49179Windows Active Directory Domain Services Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 23 | CVE-2026-57104Azure Storage Explorer Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2026-59113Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 25 | CVE-2026-59133Microsoft High Performance Computing (HPC) Pack Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 26 | CVE-2026-62784Microsoft Local Security Authority Server (lsasrv) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 27 | CVE-2026-62785Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 28 | CVE-2026-62790Windows SMBv3 Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 29 | CVE-2026-62795Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 30 | CVE-2026-62800Windows SMBv3 Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 31 | CVE-2026-62816Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 32 | CVE-2026-62817Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 33 | CVE-2026-62818Windows Active Directory Certificate Services (AD CS) Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 34 | CVE-2026-62822Windows GDI+ Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 35 | CVE-2026-62823Windows DHCP Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 36 | CVE-2026-62824Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 37 | CVE-2026-62827Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 38 | CVE-2026-62872.NET Framework Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 39 | CVE-2026-62913Microsoft Exchange Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 40 | CVE-2026-64921Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 41 | CVE-2026-65767Microsoft Teams for Android Spoofing | None | Not on CISA's list | 8.8 High | 0.01 |
| 42 | CVE-2026-65768Microsoft Teams Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 43 | CVE-2026-65807Microsoft Excel Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 44 | CVE-2026-65811Power BI Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 45 | CVE-2026-69320Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 46 | CVE-2026-70324Microsoft SharePoint Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 47 | CVE-2026-70326Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.01 |
| 48 | CVE-2026-70329Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 49 | CVE-2026-70336Visual Studio Code Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 50 | CVE-2026-70337Microsoft PowerShell Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 51 | CVE-2026-69306Visual Studio Code Security Feature Bypass | None | Not on CISA's list | 8.2 High | 0.01 |
| 52 | CVE-2026-62778Windows DNS Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 53 | CVE-2026-62781RPC Runtime Library Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 54 | CVE-2026-62792Windows TCP/IP Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 55 | CVE-2026-62819Windows Routing and Remote Access Service (RRAS) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 56 | CVE-2026-62820Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 57 | CVE-2026-62889Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 58 | CVE-2026-63520Microsoft SharePoint Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 59 | CVE-2026-65679Windows iSCSI Target Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 60 | CVE-2026-65789Windows DNS Server Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 61 | CVE-2026-65796Windows iSCSI Target Service Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 62 | CVE-2026-66802Windows Device Health Attestation (DHA) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 63 | CVE-2026-70340Azure CycleCloud Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.01 |
| 64 | CVE-2026-71331Windows Device Health Attestation (DHA) Remote Code Execution | None | Not on CISA's list | 8.1 High | 0.01 |
| 65 | CVE-2026-57105Microsoft Office SharePoint Spoofing | None | Not on CISA's list | 8.0 High | 0.01 |
| 66 | CVE-2026-54113Remote Procedure Call Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 67 | CVE-2026-59132Windows TCP/IP Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 68 | CVE-2026-59134Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 69 | CVE-2026-61363Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 70 | CVE-2026-62787Windows DNS Server Remote Code Execution | None | Not on CISA's list | 7.5 High | 0.01 |
| 71 | CVE-2026-62898Microsoft QUIC Information Disclosure | None | Not on CISA's list | 7.5 High | 0.01 |
| 72 | CVE-2026-62901.NET Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 73 | CVE-2026-65681Windows iSCSI Target Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.01 |
| 74 | CVE-2026-58612PowerShell Information Disclosure | None | Not on CISA's list | 7.4 High | 0.01 |
| 75 | CVE-2026-64900Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 76 | CVE-2026-70355Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 77 | CVE-2026-47299Azure Monitor Agent Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.01 |
| 78 | CVE-2026-62910Microsoft Exchange Server Elevation of Privilege | None | Not on CISA's list | 7.2 High | 0.01 |
| 79 | CVE-2026-65675CoPilot Chat Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 80 | CVE-2026-62702Windows Graphics Kernel Denial of Service | None | Not on CISA's list | 6.8 Medium | 0.01 |
| 81 | CVE-2026-61920Windows DNS Server Remote Code Execution | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 82 | CVE-2026-40375Microsoft Dynamics Business Central Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 83 | CVE-2026-47285Visual Studio Code Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 84 | CVE-2026-58639Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 85 | CVE-2026-59138Microsoft Remote Registry Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 86 | CVE-2026-61345Microsoft Remote Registry Service Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 87 | CVE-2026-61918Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 88 | CVE-2026-61921Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 89 | CVE-2026-61924Windows Remote Desktop Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 90 | CVE-2026-62714Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 91 | CVE-2026-62715Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 92 | CVE-2026-62716Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 93 | CVE-2026-62718Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 94 | CVE-2026-62720Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 95 | CVE-2026-62742Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 96 | CVE-2026-62745Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 97 | CVE-2026-62750Windows HTTP Protocol Stack Tampering | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 98 | CVE-2026-62782Windows SMB Client Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 99 | CVE-2026-62814Windows DHCP Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 100 | CVE-2026-62837Microsoft SharePoint Server Information Disclosure | None | Not on CISA's list | 6.5 Medium | 0.01 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 11 August 2026, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.