Microsoft August 2026 Patch Tuesday: 440 Exact-Date CVEs, 3 Zero-Days and Every Update

Microsoft’s August 11, 2026 Patch Tuesday was one of the largest security releases administrators have faced this year. Using an exact, reproducible Microsoft Security Update Guide filter—release number 2026-Aug and displayed release date August 11—the complete ledger contains 440 vulnerabilities: 400 Microsoft-assigned, two MITRE-assigned and 38 Chrome-assigned Chromium CVEs delivered through Edge. The exact-date set contains 44 Critical flaws, one vulnerability already exploited in attacks, and two more publicly disclosed before fixes were available.

This is the full companion to our quick August 11 Windows update alert. It adds the complete exact-date CVE ledger, the verified 61-row Microsoft update/package ledger, administrator priorities, restart guidance, and direct source links.

Patch these three zero-days first

The administrator “patch first” list

What home users should do

1. Back up important files before a major cumulative update.
2. Open Settings → Windows Update, select Check for updates, install everything marked Security or Cumulative, and restart.
3. After restart, open Settings → System → About and confirm the build matches the table below.
4. Update Microsoft 365/Office from File → Account → Update Options → Update Now.
5. Open Edge and visit edge://settings/help so Chromium fixes finish applying.

Business rollout order

1. Emergency ring: internet-facing services, identity systems, Exchange, SharePoint, WDS, DNS, DHCP, privileged workstations, and systems exposed to untrusted documents.
2. Pilot ring: representative endpoints, line-of-business applications, VPN clients, printing, Office automation, and security tooling.
3. Broad ring: remaining supported Windows clients and servers after pilot health checks.
4. Verify: update compliance, restart state, final build, service health, event logs, and vulnerability-scanner closure.
5. Retire or isolate unsupported systems: Windows 10 consumer editions are out of normal support; use eligible ESU coverage or migrate.

Major Windows and Windows Server cumulative updates

Windows 11 24H2/25H2 known issues: Microsoft’s KB5121003 page says it is not currently aware of any issues. That is not a guarantee of compatibility with every driver or business application; maintain a pilot ring and rollback plan. The package also carries servicing-stack work and expanded Secure Boot certificate targeting.

Servicing-stack and recovery-environment companions

These packages support reliable installation or update the Windows Recovery Environment. Integrated SSUs arrive with their cumulative update; Safe OS Dynamic Updates may be managed separately in enterprise deployment workflows.

.NET, Office, SharePoint and Exchange

Complete update/package ledger

These are all 61 verified release/package rows in the Microsoft-backed ledger: 16 Windows rows, 22 .NET/.NET Framework classifications, four explicitly named servicing-stack updates, 18 Office KBs, one Office Click-to-Run release family and one Edge Stable release. Category totals overlap by one because KB5120418 is both Windows and .NET.

Complete 440-CVE exact-date Patch Tuesday inventory

Every CVE below has SUG release number 2026-Aug and a displayed release date of August 11, and every CVE links directly to Microsoft’s advisory. The 38 Chrome-assigned Edge records have no Microsoft severity, impact or exploitability fields; the table preserves those values as “Not assigned” rather than inventing them.

What else is in Microsoft’s live August feed?

FAQ

Sources and methodology

• Microsoft Security Update Guide — August 2026 release note
• Microsoft CVRF v3.0 — August 2026 machine-readable document (current release timestamp August 14, 2026, 16:37:22)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-68820 added August 11; due August 25 for covered federal systems
• Check Point Research — Shattering the Dream: When a Job Offer Becomes a Zero-Day Attack
• Zero Day Initiative — The August 2026 Security Update Review
• Tenable — August 2026 Patch Tuesday analysis
• BleepingComputer — launch-day Patch Tuesday report and CVE table
• The Register — corrected 421-bug Microsoft-linked count
• Rapid7 — Patch Tuesday August 2026
• SANS Internet Storm Center — Microsoft Patch Tuesday August 2026
• Microsoft — August 2026 Office updates
• Microsoft — Exchange Server Subscription Edition KB5121573 and the version-specific Exchange links in the package ledger

Data note: The 440-row appendix was normalized from Microsoft’s SUG vulnerability and affected-product APIs using release number 2026-Aug and displayed release date August 11, 2026. It contains 6,654 normalized CVE-product mappings. Microsoft can revise the Security Update Guide; administrators should recheck the live advisory before an enterprise change window.