Microsoft patches 420 flaws and 3 zero-days. Not one zero-day is rated Critical

The number nobody agrees on

Microsoft shipped its August 2026 security update on 11 August. Then everybody published a different total.

What each outlet counted

Source	CVEs reported
SecurityWeek	421
This site, counted from Microsoft’s release document	420
BleepingComputer	400
Tenable	398
CyberSecurityNews	394

Nobody is wrong. They are counting different things, and the reason is visible in Microsoft's own export.

Microsoft’s machine-readable document for this release carries 420 CVE numbers that Microsoft assigned itself. It also carries 370 more from Chromium and the open source packages inside Azure Linux, which Microsoft reships and which nobody counts as Patch Tuesday. Twenty of them have Customer Action Required set to False: Azure Entra ID, Azure SQL Database, Teams, the Microsoft 365 admin centre, Copilot Cowork, Purview eDiscovery. Those are service-side fixes Microsoft has already deployed. There is nothing to install and nothing to schedule.

Take those out and you have 400, which is BleepingComputer's figure exactly. SecurityWeek's 421 is the full set plus the one Edge entry. The lower counts drop more: some exclude anything without a downloadable package, some appear to exclude Azure entirely.

The three zero-days are all privilege escalation

One actively exploited, two publicly disclosed before a fix existed.

The three zero-days

CVE	Component	Impact	Severity	Status
CVE-2026-68820	Ancillary Function Driver for WinSock	Elevation of Privilege	Important	Actively exploited
CVE-2026-62832	Windows User Profile Service	Elevation of Privilege	Important	Publicly disclosed
CVE-2026-72971	Container Isolation FS Filter Driver (unionfs.sys)	Tampering	Important	Publicly disclosed

Not one is remote code execution. Not one is rated Critical. All three require an attacker to already be running code on the machine.

CVE-2026-68820 is a use-after-free in afd.sys, the driver behind every Windows socket. A locally authenticated attacker with low privileges runs a crafted application, wins a race, and holds SYSTEM. It is the only one confirmed exploited in the wild, and it is rated Important rather than Critical because the severity rubric weighs the requirement for local access.

That rating is correct and it is also the trap. Severity describes the vulnerability. It does not describe your estate.

What the distribution actually says

All 420 CVEs by impact

Elevation of Privilege176 CVEs

Remote Code Execution111 CVEs

Information Disclosure85 CVEs

Spoofing20 CVEs

Denial of Service12 CVEs

Security Feature Bypass11 CVEs

Tampering4 CVEs

176 of 420 are elevation of privilege. That is 42% of the release, and it is 65 more than remote code execution.

This is the sentence worth taking to a patching meeting: the largest thing Microsoft fixed this month, and the only thing being exploited, are both about what an attacker does after they are already inside.

The perimeter framing does not survive that. An organisation that prioritises by "can this be triggered remotely" will deprioritise 176 vulnerabilities including the one under active attack, and will have done so by following a defensible-sounding rule.

Office is a quarter of the release and nobody is talking about it

Where the 420 sit, by product tag

Family or component	CVEs	Of which Critical
Office family, all products	119	24
Microsoft Office SharePoint	30	4
Microsoft Office	29	14
Microsoft Office Excel	28	3
Microsoft Office Word	17	3
Windows DNS	16	4
Windows DHCP Server	14	1
Windows Win32K	13	0

119 of 420, over a quarter of the release, are in the Office family. Twenty-four of the 62 Critical ratings are there. Microsoft Office alone accounts for 14 Critical CVEs, more than any other single tag.

SharePoint at 30 is the one to look at hardest. It is the product most likely to be internet-facing, most likely to be a version behind, and most likely to be owned by a team that does not think of itself as running a web application.

The 40 critical remote code execution entries, by product

Of the 62 rated Critical, 40 are remote code execution. That is the subset worth a change window rather than a monthly cycle, and it is concentrated rather than spread.

Critical remote code execution, grouped

Product group	Critical RCE
Microsoft Office	14
Windows DNS	4
Microsoft Office Excel	3
Microsoft Office Word	3
Azure and Device Health Attestation	2
Windows GDI+	2
Active Directory Certificate Services	1
Windows Deployment Services	1
Windows DHCP Server	1
Windows iSCSI Target Service	1
Windows RRAS	1
Windows SSTP	1
Reliable Multicast Transport Driver	1
Microsoft QUIC	1
Remote Desktop Client	1
SharePoint	1
Azure Service Bus	1
Azure Confidential Ledger	1

This briefing first carried a twentieth row: CVE-2021-34474, a Dynamics 365 Business Central issue with a five-year-old identifier, offered as an example of a revised advisory breaking a script keyed on the current year. It is not in the August release. It came from a thirty-day export, and so did eighteen other entries and the original total of 438. The correction is set out at the end, because a briefing arguing that counting method decides the number should show its own working when the method turns out to be wrong.

What to do this week

The position

Patch Tuesday coverage has settled into a format: a headline count, the zero-day names, a list of the Critical entries. It is accurate and it is close to useless, because the headline count is contested, the Critical list does not contain the exploited bug, and the shape of the release goes unmentioned.

The shape is the finding. A release where 42% of the content is privilege escalation, and the sole exploited vulnerability is privilege escalation rated Important, is a release about post-compromise activity. That is a statement about where attackers are spending their time, and it is available to anybody who opens the release document rather than the press release.

The same reading applies to the pattern this site covered on 11 August, when an AI agent produced 84 flaws in 5G core software and 23 still had no fix. Volume is not the constraint any more. Triage is. And triage that sorts on severity alone will get this month wrong.

Correction, 12 August 2026

This briefing was published on 12 August with a total of 438 CVEs and republished the same day with 420.

The first figure came from a spreadsheet exported from Microsoft's Security Update Guide. That view is a rolling thirty-day window, not a release. It carried nineteen entries that belong to July's Patch Tuesday or to long-standing Dynamics advisories being re-published, and it omitted nothing, so every derived figure was slightly too high: 181 elevation of privilege rather than 176, 64 Critical rather than 62, 41 Critical remote code execution rather than 40.

The second figure comes from the CVRF document Microsoft publishes for the release itself, read by script. That is the artefact the release note points at, and it is addressable per month, so this is now reproducible rather than transcribed.

The argument is unchanged and the correction sharpens it. Elevation of privilege is still the largest class by 65. The exploited vulnerability is still rated Important. What moved is the headline number, and it moved because of exactly the thing this briefing accused five outlets of: counting a different set and calling it the same month. The corrected total of 400 requiring action is BleepingComputer's figure precisely.

The Patch Tuesday browser and the JSON endpoint were rebuilt from the same document at the same time.