The next scheduled Patch Tuesday will be on September 8th, 2026.
Table of Contents
Windows security updates
A large number of the vulnerabilities—over 200 this time—are spread across the various Windows versions (10, 11, Server) for which Microsoft still provides security updates. Windows 10’s support officially ended in October 2025, but those enrolled in the Extended Security Updates (ESU) program continue to receive security updates until October 2027.
Attacks on Winsock
The only Windows security vulnerability in this month’s update that’s already being exploited in the wild is the use-after-free (UAF) vulnerability CVE-2026-68820, in the Windows auxiliary function driver for Winsock. Attackers can gain elevated privileges, allowing them to execute code with system privileges. To do this, they must combine this exploit with another remote code execution (RCE) vulnerability.
Critical Windows vulnerabilities
Microsoft has classified 18 Windows security vulnerabilities as critical. These include, for example, the RCE vulnerability CVE-2026-62878 in the Windows DNS server. If successful, the buffer overflow can be exploited to execute code with elevated privileges without user interaction.
The UAF vulnerability CVE-2026-62893 in the Trivial File Transfer Protocol (TFTP) server of Windows Deployment Services could be exploited via UDP port 69 to inject and execute code without user interaction. The flaw stems from actions being performed on an object without first checking whether the object in question actually exists.
The RCE vulnerability CVE-2026-62815 in Quick UDP Internet Connections (QUIC) can also be used to execute injected code without user interaction. Although only classified as high risk, it also contains the RCE vulnerability CVE-2026-59124. But since Microsoft’s High Performance Computing (HPC) Pack isn’t enabled by default, the vulnerability isn’t considered critical—even if attackers could use it to execute injected code.