August 2026 Patch Tuesday: How Attackers Chain CVEs

Key Stats - 422 Fixes in Total

• Critical: 41
• Important: 379
• Moderate: 2
• Weaponized: 1
• Publicly Known: 1

This month’s release covers Windows, Office, SharePoint, Exchange, PowerShell, Visual Studio Code, Teams, Azure services and core operating system components. On the surface, the numbers are significant once again (looking back to last month biggest ever release), but for me that is not really the interesting part.

What stood out is how some of these vulnerabilities could realistically support different stages of the same attack. Initial execution through malicious Office content, privilege escalation through WinSock, and the potential abuse of trusted platforms such as SharePoint all show why we should not always look at vulnerabilities in isolation.

Attackers are rarely interested in stopping after the first compromise. They want to know what they can do next, so this month I want to look at things slightly differently and ask: which vulnerabilities become more dangerous when combined?

CVE-2026-68820: An Old Target Returns

The Windows Ancillary Function Driver for WinSock, or afd.sys, is not new. We have seen vulnerabilities in this area used to turn limited local access into SYSTEM privileges. Researchers demonstrated this with CVE-2023-21768, showing just how useful AFD could be as the second stage of an attack.

August 2026 brings that scenario back into focus. CVE-2026-68820 is another WinSock Elevation of Privilege vulnerability, and this time Microsoft has confirmed that exploitation has already been detected. An attacker still needs to get onto the device first, but if they do, successful exploitation could give them SYSTEM-level privileges.

That is what makes vulnerabilities like this so important. They may not provide the initial way into the device, but they could provide the next step in the attack chain.

CVE-2026-63532: The Preview Pane Strikes Again

Our old villain, the Preview Pane, is back again.

In 2023, CVE-2023-23397 was exploited by a Russia-based threat actor against government, military, energy and transportation organizations. A specially crafted Outlook message could force the victim’s device to authenticate to an attacker-controlled server, exposing credentials that could then be used for lateral movement and further compromise.

Now we have CVE-2026-63532, a Microsoft Office Remote Code Execution vulnerability caused by an integer overflow and heap-based buffer overflow. Microsoft confirms that the Preview Pane is an attack vector, which passes my sniff test.

A malicious Office file could provide the initial code-execution an attacker needs before they move on to the next stage of their attack.

Organizations could consider temporarily disabling unnecessary preview functionality (which may upset some users who use email for their day to day), maintaining strong email and attachment filtering, and using Microsoft Defender Attack Surface Reduction best practices to restrict malicious Office behaviors.

CVE-2026-62827: Turning Trust Against the User

SharePoint is normally somewhere we trust. It is an internal location used for documents, collaboration, and file sharing, which is exactly why gaining control of it could be so useful to an attacker.

CVE-2026-62827 is a Critical Microsoft SharePoint Server Elevation of Privilege vulnerability. Microsoft states that an authenticated attacker with domain access could perform remote code execution on the SharePoint server and elevate themselves to SharePoint administrator.

A plausible attack chain could involve an attacker placing a malicious file into a trusted SharePoint document library and disguising it with a double extension, for example Quarterly_Report.xlsx.exe. If Windows is configured to hide known file extensions, a user could potentially mistake this for a normal Excel spreadsheet and run it.

The vulnerability itself does not automatically make that happen, but it demonstrates my point. Once an attacker gains control of something users already trust, they have another opportunity to move the attack forward.

The countermeasure is to restrict administrative privileges, monitor for unusual file uploads or permission changes, show full file extensions on Windows devices, and use application control, SmartScreen and endpoint protection to prevent untrusted executables from running.

How to be the Hero this month: Break the Attack Chain

1. Prioritize vulnerabilities that can provide initial access. Microsoft Office and Preview Pane vulnerabilities deserve particular attention because malicious content can provide attackers with a relatively low-friction route onto an endpoint.
2. Accelerate remediation of CVE-2026-68820. The WinSock vulnerability is already being exploited and demonstrates why Elevation of Privilege vulnerabilities should not be treated as secondary.
3. Protect trusted platforms such as SharePoint. If attackers gain control of platforms that users already trust, they can potentially use that trust against them. Restrict administrative privileges, monitor unusual uploads and permission changes, and maintain strong endpoint controls.
4. Look at vulnerabilities as potential combinations rather than individual CVSS scores. Ask yourself what an attacker could do next, if a vulnerability was successfully exploited. Initial execution, privilege escalation, and the abuse of trusted platforms become considerably more dangerous when they can be combined.
5. Review anything marked Weaponized or Publicly Known and make sure your accelerated patching processes are really working as expected.
6. Reduce the opportunities between each stage of an attack. Application control, least privilege, Attack Surface Reduction rules, email filtering, SmartScreen and endpoint detection can all help stop one link in the chain from turning into a much larger compromise.
7. Prioritize Resilience alongside Prevention. Breaking the attack chain is important, but when prevention fails, recovery speed really matters. Absolute enables organizations to rapidly restore compromised endpoints at scale using firmware embedded persistence and automated rehydration capabilities, helping to reduce downtime and operational strain during major incidents.

Patch smart. Build resilience. Happy patching.

See the Aug 2026 Patch Tuesday Chart (PDF).

Kind Regards

Rob