Published Tuesday, August 11, 2026 at 10:00 AM PT

<strong>DEVELOPING — Microsoft August 2026 Patch Tuesday: Likely Imminent, July Release Still Active</strong>

BLUF: Patch Tuesday in the August 2026 cycle is due tomorrow (12 Aug) but not yet released as of 11 Aug 23:59 UTC. July 2026 Patch Tuesday (released ~20 July) remains critical and unpatched in many environments—622 flaws including 2 exploited zero-days. Do not delay July patches while awaiting August release.

DETAILS

  • July 2026 release (confirmed, ~20 July): 622 vulnerabilities patched; independent sources report variance (570–622 flaws, 2–3 zero-days actively exploited in the wild)
  • Priority CVEs by product: Windows kernel, Microsoft Exchange, Active Directory, .NET framework
  • Exploitation status: At least 2 zero-days in the July release are confirmed in active use; attack surface is real
  • August cycle status (as of 11 Aug): Patch Tuesday rolls 12 Aug; release details and advisory not yet published. History suggests official guidance will drop 12–13 Aug AM UTC
  • Deployment gap: Organizations that deferred July patches face 3-week active-exploit window; August patches will compound urgency

IMPACT

  • Windows-based infrastructure: All supported versions (Server 2019–2025, Windows 10–11)
  • Exchange on-premises deployments: Critical; zero-day affects mail routing and auth chains
  • Directory services: AD and hybrid cloud identity stacks at elevated risk
  • Supply chain: .NET vulnerabilities affect downstream apps (ASP.NET, WinForms)
  • Timeline: Threat actors have had 22+ days to weaponize July zero-days; patch lag = active risk

RECOMMENDED ACTIONS

  1. Immediate (next 24h): If July patches are not yet deployed, prioritize: Windows kernel, Exchange, AD updates—do not wait for August
  2. Pre-deployment (by 13 Aug): Stand up test environment; begin staging August patches the moment MSRC publishes (usually 12–13 Aug AM)
  3. Monitoring: Track MSRC.Microsoft.com and security vendor advisories (CrowdStrike, Kaspersky, Help Net Security) for August CVE details post-release
  4. Comms: Alert engineering + security leads that a dual-month patch storm is incoming; resource for expedited testing cycles

SOURCES

  • Microsoft Security Response Center (MSRC) — July 2026 Patch Tuesday release (~20 July 2026)
  • HackRead, CrowdStrike, BleepingComputer, Help Net Security, Kaspersky advisories — July release details
  • Patch Tuesday calendar — August cycle due 12 Aug 2026

Note: This alert is based on confirmed July 2026 release data and historical August Patch Tuesday cadence. August release details will be published 12–13 Aug; re-issue with full CVE manifest upon MSRC publication.

Recent high-severity events at publish time:

Recent high-severity events