cve.bz

Microsoft Patch Tuesday, August 2026: the CVEs

Filter

Microsoft Patch Tuesday August 2026: the CVEs Microsoft published on 11 August 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jul 2026, Jun 2026, May 2026, Apr 2026, Mar 2026, Feb 2026, Jan 2026, Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

  1. 5.4CVE-2026-70339EPSS 0.4%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  2. 6.7CVE-2026-65680EPSS 0.4%

    Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.

  3. 5.5CVE-2026-72971EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.

  4. 8.1CVE-2026-71331EPSS 0.7%

    Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

  5. 8.7CVE-2026-70355EPSS 0.8%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  6. 7.8CVE-2026-70354EPSS 0.4%

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.

  7. 5.5CVE-2026-70348EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.

  8. 7.8CVE-2026-70347EPSS 0.3%

    Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  9. 7.8CVE-2026-70346EPSS 0.3%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  10. 7.8CVE-2026-70345EPSS 0.3%

    Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  11. 7.8CVE-2026-70344EPSS 0.3%

    Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

  12. 8.8CVE-2026-70340EPSS 0.8%

    Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

  13. 7.8CVE-2026-70338EPSS 0.4%

    Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

  14. 8.8CVE-2026-70337EPSS 0.9%

    Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

  15. 8.8CVE-2026-70336EPSS 0.8%

    Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  16. 7.8CVE-2026-70335EPSS 0.5%

    Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

  17. 7.8CVE-2026-70330EPSS 0.3%

    Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

  18. 8.8CVE-2026-70329EPSS 0.8%

    Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

  19. 6.5CVE-2026-70328EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  20. 6.5CVE-2026-70327EPSS 0.9%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.

  21. 8.8CVE-2026-70326EPSS 0.8%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  22. 5.5CVE-2026-70325EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  23. 8.8CVE-2026-70324EPSS 0.9%

    Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  24. 5.5CVE-2026-70323EPSS 0.4%

    Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

  25. 5.5CVE-2026-70322EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  26. 8.8CVE-2026-70321EPSS 1.7%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  27. 5.5CVE-2026-70320EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  28. 5.5CVE-2026-70319EPSS 0.4%

    Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  29. 5.5CVE-2026-70318EPSS 0.5%

    Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  30. 5.5CVE-2026-70317EPSS 0.4%

    Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

  31. 5.5CVE-2026-70316EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  32. 5.5CVE-2026-70315EPSS 0.4%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  33. 5.5CVE-2026-70314EPSS 0.5%

    Improper input validation in Microsoft Office allows an unauthorized attacker to disclose information locally.

  34. 7.8CVE-2026-70313EPSS 0.5%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  35. 5.5CVE-2026-70312EPSS 0.4%

    Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  36. 7.8CVE-2026-70311EPSS 0.5%

    Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.

  37. 5.5CVE-2026-70310EPSS 0.4%

    Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  38. 7.0CVE-2026-70307EPSS 0.3%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  39. 9.3CVE-2026-70306EPSS 1.0%

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

  40. 7.8CVE-2026-70304EPSS 0.3%

    Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally.

  41. 7.8CVE-2026-70130EPSS 0.3%

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  42. 8.8CVE-2026-69320EPSS 0.9%

    Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  43. 8.2CVE-2026-69306EPSS 0.5%

    Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  44. 7.8CVE-2026-69278EPSS 0.3%

    Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  45. 7.8CVE-2026-68821EPSS 0.3%

    Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges locally.

  46. 7.0CVE-2026-68820KEVEPSS 8.6%

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  47. 7.5CVE-2026-68819EPSS 1.0%

    Buffer over-read in Windows Network File System allows an unauthorized attacker to deny service over a network.

  48. 7.8CVE-2026-68817EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  49. 7.8CVE-2026-68816EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  50. 7.8CVE-2026-68815EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  51. 7.8CVE-2026-68814EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  52. 5.5CVE-2026-68813EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  53. 7.8CVE-2026-68812EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  54. 7.8CVE-2026-68811EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  55. 7.8CVE-2026-68810EPSS 0.5%

    Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  56. 5.5CVE-2026-68809EPSS 0.4%

    Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

  57. 5.5CVE-2026-68808EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  58. 7.8CVE-2026-68807EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  59. 7.8CVE-2026-68806EPSS 0.5%

    Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  60. 7.8CVE-2026-68805EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  61. 7.8CVE-2026-68804EPSS 0.5%

    Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  62. 7.8CVE-2026-68803EPSS 0.5%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  63. 5.5CVE-2026-68802EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  64. 7.8CVE-2026-68801EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  65. 7.8CVE-2026-68800EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  66. 5.5CVE-2026-68799EPSS 0.5%

    Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  67. 7.8CVE-2026-68798EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  68. 5.5CVE-2026-68797EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

  69. 7.8CVE-2026-68796EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  70. 7.8CVE-2026-68795EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  71. 7.8CVE-2026-68794EPSS 0.5%

    Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  72. 7.8CVE-2026-68793EPSS 0.5%

    Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

  73. 7.8CVE-2026-68792EPSS 0.3%

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an authorized attacker to elevate privileges locally.

  74. 5.5CVE-2026-66810EPSS 0.4%

    Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  75. 5.5CVE-2026-66809EPSS 0.4%

    Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  76. 8.8CVE-2026-66808EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  77. 7.8CVE-2026-66807EPSS 0.5%

    Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  78. 5.5CVE-2026-66806EPSS 0.4%

    Off-by-one error in Microsoft Office Word allows an unauthorized attacker to disclose information locally.

  79. 8.8CVE-2026-66805EPSS 2.0%

    Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  80. 7.8CVE-2026-66804EPSS 0.3%

    Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

  81. 8.1CVE-2026-66802EPSS 0.5%

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.

  82. 7.8CVE-2026-66799EPSS 0.3%

    Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

  83. 6.5CVE-2026-66301EPSS 1.0%

    Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.

  84. 8.8CVE-2026-65815EPSS 1.7%

    Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

  85. 7.8CVE-2026-65814EPSS 0.3%

    Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.

  86. 8.8CVE-2026-65813EPSS 0.9%

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  87. 8.8CVE-2026-65811EPSS 1.0%

    Improper input validation in Power BI allows an authorized attacker to execute code over a network.

  88. 7.8CVE-2026-65810EPSS 0.4%

    Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally.

  89. 8.8CVE-2026-65807EPSS 0.8%

    Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.

  90. 6.5CVE-2026-65806EPSS 0.8%

    Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.

  91. 7.8CVE-2026-65799EPSS 0.3%

    Integer overflow or wraparound in Windows DNS allows an authorized attacker to elevate privileges locally.

  92. 6.7CVE-2026-65798EPSS 0.3%

    Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

  93. 6.7CVE-2026-65797EPSS 0.3%

    Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

  94. 8.1CVE-2026-65796EPSS 0.7%

    Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

  95. 6.7CVE-2026-65795EPSS 0.3%

    Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

  96. 6.5CVE-2026-65794EPSS 0.9%

    Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.

  97. 9.8CVE-2026-65791EPSS 1.0%

    Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

  98. 7.8CVE-2026-65790EPSS 0.3%

    Heap-based buffer overflow in Windows Message Queuing allows an authorized attacker to elevate privileges locally.

  99. 8.1CVE-2026-65789EPSS 0.7%

    Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

  100. 7.0CVE-2026-65788EPSS 0.3%

    Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.