Update Windows Tonight: August 2026 Patch Tuesday Fixes an Exploited Privilege Bug

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Jennifer Hudsen reviews the August 2026 Windows Patch Tuesday security update while a Mac display shows no new action — Original AI-assisted editorial illustration for The IT Guys: Windows Patch Tuesday is the actionable update; Apple had no same-day macOS release.

Microsoft’s August 2026 Patch Tuesday security updates are out, and this is not a “wait until next month” release. Microsoft says every supported Windows version has an August security update, and its Security Update Guide marks one Windows privilege-escalation vulnerability as already exploited. Home users should install tonight; businesses should begin an accelerated, controlled rollout after a quick compatibility check.

The short version

Release: August 11, 2026 monthly Windows security update (“B” release/Patch Tuesday).
Urgency: High. Microsoft marks CVE-2026-68820, a Windows Ancillary Function Driver for WinSock elevation-of-privilege flaw, as exploited.
Main Windows 11 update: KB5121003 for versions 25H2 and 24H2, moving them to builds 26200.9168 and 26100.9168.
Apple check: No same-day macOS security release or Background Security Improvement appeared on Apple’s official pages. The latest macOS security updates remain the August 6 releases.
Best action: Back up important work, connect laptops to power, install the update, restart, and verify the build.

Why this Patch Tuesday matters

The headline risk is CVE-2026-68820. Microsoft describes it as an elevation-of-privilege vulnerability in the Windows Ancillary Function Driver for WinSock and labels exploitation as detected. Elevation of privilege generally means an attacker who already has some access can try to gain stronger local permissions. It is not the same thing as a drive-by compromise from simply browsing a web page, but it can turn an initial foothold into a much more serious incident.

Microsoft’s August CVRF feed is unusually large: it currently contains 790 CVE records, with 709 carrying an August 11 publication/revision entry. That catalog spans many Microsoft products and supported Windows generations, so do not interpret the raw count as 790 separate patches installed on every PC. Your applicable fixes depend on Windows version, architecture, enabled components, and installed Microsoft software.

The same official feed also marks two vulnerabilities as publicly disclosed but not detected in active exploitation: CVE-2026-72971, a Windows Container Isolation FS Filter Driver tampering flaw, and CVE-2026-62832, a Windows User Profile Service elevation-of-privilege flaw. Public disclosure does not automatically mean mass exploitation, but defenders should assume technical details may be easier for attackers to study.

Which update should you see?

Windows release	August security update	Expected build	Notes
Windows 11 25H2	KB5121003	26200.9168	Current production security update
Windows 11 24H2	KB5121003	26100.9168	Home/Pro support ends October 13, 2026
Windows 11 23H2	KB5120240	22631.7517	Enterprise/Education support ends November 10, 2026
Windows 11 26H1	KB5121000	28000.2704	Install only on devices actually running this release
Windows 10 22H2 / 21H2 eligible ESU or LTSC	KB5120249	19045.7663 / 19044.7663	Ordinary consumer Windows 10 support ended in 2025; eligibility matters
Windows Server 2025	KB5120233	26100.33296	Known WSUS error-detail limitation remains
Windows Server 2022	KB5120242	20348.5499	Known WSUS error-detail limitation remains
Windows Server 2019 / Windows 10 Enterprise LTSC 2019	KB5120238	17763.9121	Microsoft lists no known issue for this update

Microsoft also lists special hotpatch and standalone packages for a limited number of managed devices. Hotpatch-enrolled Windows 11 Enterprise 25H2/24H2 systems may automatically receive KB5123607, while devices using a Pluton security processor as the TPM may also receive KB5123273 and require a restart. Windows Server 2022 hotpatch environments may receive KB5123303. Microsoft says administrators do not need to change enrollment or policy for this sequence.

How to check whether your PC is affected

Press Windows key + R, type winver, and press Enter.
Write down the Windows version and OS build shown in the dialog.
Open Settings → Windows Update and select Check for updates.
Install the August cumulative security update offered for your version.
Restart when prompted, run winver again, and compare the resulting build with the table above.

If your build is different, do not force an unrelated KB from the Microsoft Update Catalog. Windows Update normally offers the package that matches your edition, architecture, servicing channel, and prerequisites. Managed business devices may also follow an administrator-controlled deployment ring.

What changed besides security fixes?

For Windows 11 versions 25H2 and 24H2, KB5121003 includes security improvements plus changes previously released in the July 28 preview and earlier July updates. Microsoft highlights expanded high-confidence targeting for new Secure Boot certificates and a servicing stack update intended to improve update reliability. Some devices may experience one additional restart during the Secure Boot certificate transition.

Windows 11 23H2’s KB5120240 also carries forward fixes involving mobile operator profiles, MDM reliability, File History backups to SMB shares, Secure Boot certificate targeting, and the emoji panel. Windows 10 KB5120249 includes a fix for File History network-share backups that could incorrectly report invalid credentials.

Known issues and cautions

Microsoft currently lists no known issues for the main Windows 11 client updates KB5121003, KB5120240, and KB5121000, or for Windows 10 KB5120249.
“No known issues” means none are documented at publication time—not that every hardware and software combination has been proven problem-free.
Windows Server 2025 and 2022 retain a known WSUS limitation: synchronization error details may not display. Microsoft says that detail reporting was temporarily removed while addressing CVE-2025-59287.
IT teams servicing offline Windows images must include the correct boot.stl file. Microsoft warns that omitting it can prevent installation media from starting and produce error 0xc0430001.
Save open work before installation. The Secure Boot certificate rollout can cause an extra restart on a limited number of devices.

What home users should do tonight

Back up anything irreplaceable. A current backup is insurance against update trouble, storage failure, and malware—not just Patch Tuesday.
Use Windows Update. Go to Settings → Windows Update, check for updates, and install the cumulative security update offered to your PC.
Keep the laptop plugged in. Do not interrupt firmware, Secure Boot, or operating-system servicing.
Restart and verify. Confirm the build with winver, then open your browser, printer software, VPN, and any other daily essentials.
Do not uninstall preemptively. The actively exploited vulnerability makes delaying or removing the security update without a specific compatibility problem the riskier choice.

What businesses and IT administrators should do

Prioritize internet-facing, administrator-used, remote-support, and high-value systems.
Deploy first to a representative pilot ring covering VPN, endpoint security, line-of-business applications, printers, and device-management agents.
After pilot validation, accelerate the broader rollout because active exploitation is documented.
Monitor installation failure, restart, BitLocker recovery, boot, VPN, File History/SMB backup, and authentication signals.
Verify the expected KB and build in Intune, Windows Update for Business, WSUS, RMM, or your inventory platform—do not rely only on a “deployment complete” banner.
Confirm servers and hotpatch-enrolled systems received the correct package sequence. Never substitute a client KB for a server update.

The good and the bad

Good

A fix is available for the exploited Windows vulnerability.
The main client KB pages list no known issues at publication time.
The cumulative model includes prior quality fixes.
Secure Boot certificate targeting continues to expand.

Bad / caution

Active exploitation means unpatched systems face a real—not theoretical—risk.
The broad Microsoft catalog makes applicability easy to misread.
Some systems can restart an extra time during Secure Boot servicing.
Older Windows 10 devices may not qualify for updates without ESU or LTSC servicing.

What about macOS?

Apple did not publish a new macOS security release, Rapid Security Response, or dated Background Security Improvement on August 11 as of this check. Apple’s security-release table still lists macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9 from August 6. If your Mac has not installed that release, it remains the current action item. We covered the practical details in Update Your Mac Tonight: Apple Fixes Screen Sharing Authentication Bypass.

Apple’s Developer releases page lists a TestFlight update today, but that is not a public macOS security/system release and should not be presented as one. This article’s urgent recommendation is therefore Windows-focused.

Frequently asked questions

Is this a preview update?

No. This is the regular monthly security “B” release—commonly called Patch Tuesday. A preview update is optional and primarily previews non-security changes for a later cumulative release.

Should I wait a week?

For a normal home PC, the actively exploited vulnerability favors installing promptly after saving work and confirming you have a backup. Businesses can use a short pilot ring, but broad delay without monitoring or compensating controls is hard to justify.

Do I need to download KB5121003 manually?

Usually not. Supported home PCs should receive the correct cumulative package automatically through Windows Update. Manual Catalog installation is mainly for administrators and troubleshooting—and the package must match the exact Windows version and architecture.

Why did my PC restart twice?

Microsoft says a limited number of consumer and business devices may experience one additional restart while new Secure Boot certificates are applied. That can be expected during this rollout, but repeated boot failure or a BitLocker recovery prompt deserves careful troubleshooting.

Is Windows 10 still getting this update?

Only eligible serviced editions and programs. Ordinary Windows 10 consumer support ended in October 2025. Microsoft lists KB5120249 for eligible Windows 10 ESU and LTSC 2021 systems, but the presence of a KB page does not make every unsupported Windows 10 PC eligible.

Need help updating safely?

If Windows Update fails, your PC asks for a BitLocker key, or a business application breaks after patching, avoid random “fix” tools. The IT Guys can help home users through our services and businesses through small-business IT support in Port Saint Lucie, Jensen Beach, Fort Pierce, and Vero Beach.

Official sources

Source status checked August 11, 2026 at approximately 7:00 p.m. EDT. Vendor advisories can change as investigations continue.