Patch Tuesday is a day. Patching is a week. Yesterday Microsoft shipped its August updates and one of the vulnerabilities in them was already being exploited by someone we could not name. Today we can name them, and there are three separate deadlines running that were not visible on release day.
This is the day two read. If you want the release itself, the numbers and what shipped, that is yesterday's post. This one is only what changed since.
The zero-day now has an attacker attached to it
CVE-2026-68820, the use-after-free in the Windows Ancillary Function Driver for WinSock, shipped on Tuesday carrying Microsoft's Exploitation Detected label and nothing else. That label tells you attacks are happening. It does not tell you who, or against whom, and those two facts are most of what decides whether a CVSS 7.0 elevation of privilege belongs at the top of your week.
On August 12, BleepingComputer reported that the attackers are North Korean, that the campaign is Operation Dream Job, and that the targets are defense-sector companies.
Two things follow from that. The first is that working exploit code exists, is in the hands of a well-resourced state group, and has been used against real organizations rather than demonstrated in a lab. The second is more useful for deciding your own priority: Operation Dream Job is a targeted campaign with a narrow victim list, not a spray. If you are a defense contractor or a supplier to one, this is your emergency. If you are a dental practice, it is still a patch you should ship this week, but the reason is that privilege escalation bugs get reused by everyone else once they are public, not that Lazarus is coming for you.
That distinction is the part most coverage leaves out, and it is the difference between a fleet-wide emergency change window and a normal one.
Three deadlines are running, and they are not the same length
The CISA Known Exploited Vulnerabilities catalog sets a remediation deadline for federal agencies on every entry it adds. Those dates are public, and they are the closest thing available to a government assessment of how fast something needs to be gone. Three deadlines from this week's additions are live right now, and the spread between them is the story.
- August 14, three days. CVE-2026-20349 in Cisco Secure Firewall ASA and FTD, and CVE-2026-72898 in Metabase, a SQL injection at CVSS 10.0. Both were added on August 11, the same day as Patch Tuesday, and both are due this Friday. BleepingComputer covered the Cisco flaw; Dark Reading covered the Metabase one and called its blast radius wide.
- August 25, two weeks. CVE-2026-68820, the Microsoft zero-day above, added the same day as the other two.
- Already past. CVE-2026-8037, command injection in Progress LoadMaster at CVSS 9.8, was added on August 7 and was due on August 10. Its EPSS score is 99.3%, which is about as close to a certainty of exploitation as that model gets.
The pattern is worth naming because it is the opposite of what a Severity-sorted list would tell you. The Microsoft bug is the one under confirmed nation-state attack and it got the longer deadline. The two that got three days are the ones sitting on the edge of the network, where an attacker does not need a foothold first. Exposure beat Severity, and it beat attribution too.
If your patching priority is a sort on the CVSS column, this week is the week it gives you the wrong order.
Three analysts, three different totals for the same release
Something else surfaced overnight that is worth knowing before you quote a number in a meeting. The published counts for August 2026 do not agree:
- Microsoft's own security update data: 751 CVEs.
- CrowdStrike: 415 CVEs, 62 of them Critical.
- Tenable: 398 CVEs.
None of them is wrong. They are counting different things, because a large share of the entries in Microsoft's August data are Azure Linux package advisories that ship no Windows update article at all. An analyst counting what a Windows administrator can actually deploy lands near 400. Microsoft, counting everything it published, lands at 751. We track 347 against update articles we hold pages for, and we label both figures on our Patch Tuesday page for exactly this reason.
The practical advice is short: pick one source, say which one you are using, and do not compare this month's total against last month's from a different analyst. Month-over-month "Patch Tuesday is getting bigger" claims are frequently just two different counting methods sitting next to each other.
SharePoint did not stop when the updates shipped
Yesterday's post flagged that this release reaches past Windows into SharePoint, Teams and Azure SQL Managed Instance. Rapid7 has since published analysis on two of the SharePoint entries specifically: CVE-2026-55040, a JWT token authentication bypass, and CVE-2026-63520, a remote code execution issue.
SharePoint has been an entry point repeatedly this year. An authentication bypass and an RCE in the same release, on a server that is usually reachable and usually patched on a slower cycle than the domain controllers, is a combination worth a specific look rather than a place in the queue.
What to actually do with the rest of this week
- If you run Cisco ASA or FTD, or Metabase, those are due Friday. Internet-facing and on a three-day government clock is the shortest deadline on the board.
- Check Progress LoadMaster today. Its deadline has already passed and its EPSS score says exploitation is effectively certain.
- Ship the Microsoft cumulative update this week. August 25 is the federal deadline, not a suggestion of when it becomes urgent. The fix rides in this month's cumulative updates, including KB5120238, KB5120242, KB5120229 and KB5120249.
- If you are in or near the defense supply chain, treat CVE-2026-68820 as an incident question, not only a patching one. Confirmed exploitation against your sector means the useful question is whether it was already used, not only whether you are now protected.
- Look at SharePoint separately from Windows. Different owner, different maintenance window, and this month a bypass and an RCE.
Every CVE and update article named here has its own page on senserva.com with the affected products, Microsoft's own known-issues text, and the change trail as entries get revised through the month. The patch tracker ranks this month by exploitation and exposure rather than by Severity label, which is the sort order this particular week rewards. The non-Microsoft exploited CVE tracker is where the Cisco, Metabase and Progress entries live, because most months the thing with the shortest deadline is not a Microsoft product.
Sources
- BleepingComputer, Lazarus hackers exploited Windows zero-day to target defense firms, August 12, 2026
- BleepingComputer, Cisco warns of ASA and FTD VPN flaw exploited to crash devices, August 11, 2026
- Dark Reading, Metabase SQL zero-day attacks could have wide blast radius, August 10, 2026
- CrowdStrike, August 2026 Patch Tuesday analysis, August 11, 2026
- Tenable, Microsoft's August 2026 Patch Tuesday addresses 398 CVEs, August 11, 2026
- Rapid7, Microsoft SharePoint JWT token authentication bypass, August 11, 2026
- Zero Day Initiative, The August 2026 security update review, August 11, 2026
- CISA Known Exploited Vulnerabilities catalog, deadlines read August 12, 2026
Deadline and exploitation data in this post comes from the CISA KEV catalog and Microsoft's published security update data, read on August 12, 2026. Senserva credits every public data source it uses on our data sources page.