August 2026
Microsoft shipped 1676 fixes in its August 2026 security updates. 88 are Critical severity, under active exploitation, or were publicly disclosed before a fix shipped — those are listed below. The rest: 868 fixes to open-source packages bundled for Microsoft’s Azure Linux container distro, 353 Chromium fixes shipped through Microsoft Edge, and 367 lower-severity, non-exploited, non-publicly-disclosed fixes to Microsoft products — are counted here but not listed row by row.
Built by Daily CISO from Microsoft’s own update guide for this release (initial release August 11, 2026, last revised October 10, 2026); not an official Microsoft page. The full 1676-fix list, including every Azure Linux and Edge/Chromium entry, is on Microsoft’s own page, linked above.
CVE-2026-56162: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-63508: Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
Critical
Microsoft Planetary Computer Pro (GeoCatalog)
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-65667: Microsoft Teams Elevation of Privilege Vulnerability
Critical
Microsoft Teams
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-65770: Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Critical
Azure Managed Instance for Apache Cassandra
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-65801: Microsoft Exchange Online Elevation of Privilege Vulnerability
Critical
Microsoft Exchange Online
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-65816: Azure Arc Elevation of Privilege Vulnerability
Critical
Azure Web Apps
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69502: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69555: Azure Arc Elevation of Privilege Vulnerability
Critical
Azure ARC
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69836: Microsoft Entra ID Remote Code Execution Vulnerability
Critical
Microsoft Entra ID
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-50481: Azure Active Directory Elevation of Privilege Vulnerability
Critical
Azure Active Directory
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-50515: Azure Service Bus Remote Code Execution Vulnerability
Critical
Azure Service Bus
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-59115: Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
Critical
Microsoft Entra Provisioning Service
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-62830: Azure SRE Agent Elevation of Privilege Vulnerability
Critical
Azure SRE Agent
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-63509: Microsoft Fabric Elevation of Privilege Vulnerability
Critical
Microsoft Fabric
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-68782: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-68789: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-69851: Microsoft Entra ID Elevation of Privilege Vulnerability
Critical
Microsoft Entra ID
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-62815: Microsoft QUIC Remote Code Execution Vulnerability
Critical
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +8 more
CVSS 9.8
CVE-2026-62873: Microsoft 365 Admin Center Elevation of Privilege Vulnerability
Critical
Microsoft 365 Admin Center
CVSS 9.8 · Microsoft says no customer action required
CVE-2026-62878: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 9.8
CVE-2026-62893: Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 9.8
CVE-2026-65791: Windows iSCSI Target Service Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 9.8
CVE-2026-56161: Azure Logic Apps Information Disclosure Vulnerability
Critical
Azure Logic Apps
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-62896: Microsoft Teams Elevation of Privilege Vulnerability
Critical
Microsoft Teams
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-69400: Azure Logic Apps Elevation of Privilege Vulnerability
Critical
Azure Logic Apps
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-70332: Microsoft Office SharePoint Spoofing Vulnerability
Critical
Microsoft SharePoint Online
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-50516: Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Critical
Azure Kubernetes Service
CVSS 9.4 · Microsoft says no customer action required
CVE-2026-59118: Copilot Cowork Elevation of Privilege Vulnerability
Critical
Copilot Cowork
CVSS 9.3 · Microsoft says no customer action required
CVE-2026-62834: Azure Data Factory Elevation of Privilege Vulnerability
Critical
Azure Data Factory
CVSS 9.3 · Microsoft says no customer action required
CVE-2026-66309: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 9.1 · Microsoft says no customer action required
CVE-2026-68823: Azure Confidential Ledger Remote Code Execution Vulnerability
Critical
Azure Confidential Ledger
CVSS 9.1 · Microsoft says no customer action required
CVE-2026-24301: Microsoft Copilot Information Disclosure Vulnerability
Critical
Copilot Web
CVSS 8.8 · Microsoft says no customer action required
CVE-2026-49163: Application Insights Profiler Elevation of Privilege Vulnerability
Critical
Application Insights Profiler
CVSS 8.8 · Microsoft says no customer action required
CVE-2026-62816: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-62817: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation), +2 more
CVSS 8.8
CVE-2026-62818: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.8
CVE-2026-62822: Windows GDI+ Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-62823: Windows DHCP Server Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 8.8
CVE-2026-62824: Remote Desktop Client Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows Server 2012, Windows Server 2012 (Server Core installation), +4 more
CVSS 8.8
CVE-2026-62827: Microsoft SharePoint Server Elevation of Privilege Vulnerability
Critical
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
CVSS 8.8
CVE-2026-62869: Azure Entra ID Spoofing Vulnerability
Critical
Microsoft Entra ID
CVSS 8.8 · Microsoft says no customer action required
CVE-2026-64921: Microsoft SharePoint Server Elevation of Privilege Vulnerability
Critical
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
CVSS 8.8
CVE-2026-65665: Microsoft SharePoint Server Remote Code Execution Vulnerability
Critical
Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition
CVSS 8.8
CVE-2026-65668: Microsoft Purview eDiscovery Elevation of Privilege Vulnerability
Critical
Microsoft Purview eDiscovery
CVSS 8.8 · Microsoft says no customer action required
CVE-2026-62836: Azure SQL Managed Instance Elevation of Privilege Vulnerability
Critical
Azure SQL Managed Instance
CVSS 8.7 · Microsoft says no customer action required
CVE-2026-66800: Azure Data Factory Information Disclosure Vulnerability
Critical
Azure Data Factory
CVSS 8.6 · Microsoft says no customer action required
CVE-2026-69519: Azure Stack HCI Information Disclosure Vulnerability
Critical
Azure Stack HCI
CVSS 8.6 · Microsoft says no customer action required
CVE-2026-69558: Microsoft Partner Center Information Disclosure Vulnerability
Critical
Microsoft Partner Center
CVSS 8.6 · Microsoft says no customer action required
CVE-2026-69419: Azure Data Manager for Energy Remote Code Execution Vulnerability
Critical
Azure Data Manager for Energy
CVSS 8.5 · Microsoft says no customer action required
CVE-2026-69543: Azure Virtual Machines Elevation of Privilege Vulnerability
Critical
Azure Virtual Machines
CVSS 8.5 · Microsoft says no customer action required
CVE-2026-70130: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +4 more
CVSS 8.4
CVE-2026-62819: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.1
CVE-2026-62820: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-62889: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.1
CVE-2026-65679: Windows iSCSI Target Service Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-65789: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-65796: Windows iSCSI Target Service Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-66802: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, +6 more
CVSS 8.1
CVE-2026-71331: Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-62911: Microsoft Exchange Server Elevation of Privilege Vulnerability
Critical
Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM
CVSS 8.0
CVE-2026-62890: Windows GDI+ Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 7.8
CVE-2026-63513: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-63515: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-63518: Microsoft Office Word Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 7.8
CVE-2026-63519: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-63522: Azure SQL Database Elevation of Privilege Vulnerability
Critical
Azure SQL Database
CVSS 7.8 · Microsoft says no customer action required
CVE-2026-63525: Microsoft Office Word Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +6 more
CVSS 7.8
CVE-2026-63526: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-63532: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-64898: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-64903: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-64907: Microsoft Office Word Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 7.8
CVE-2026-64909: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 7.8
CVE-2026-64910: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-64911: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-65657: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-65664: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-66799: Windows Key Guard Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 7.8
CVE-2026-66807: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.8
CVE-2026-68794: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +10 more
CVSS 7.8
CVE-2026-68804: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +10 more
CVSS 7.8
CVE-2026-68816: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +10 more
CVSS 7.8
CVE-2026-69855: Microsoft Copilot in Azure Information Disclosure Vulnerability
Critical
Microsoft Copilot in Azure
CVSS 7.7 · Microsoft says no customer action required
CVE-2026-62918: Microsoft Teams Spoofing Vulnerability
Critical
Microsoft Teams
CVSS 7.5 · Microsoft says no customer action required
CVE-2026-62832: Windows User Profile Service Elevation of Privilege Vulnerability
Important
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +14 more
CVSS 7.8 · publicly disclosed before a fix shipped
CVE-2026-69414: Microsoft Defender Elevation of Privilege Vulnerability
Important
Microsoft Malware Protection Engine
CVSS 7.8 · publicly disclosed before a fix shipped
CVE-2026-68820: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Important
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 7.0 · actively exploited
CVE-2026-72971: Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
Important
Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems
CVSS 5.5 · publicly disclosed before a fix shipped