Patch Tuesday, August 2026: Microsoft Clears More Than 400 Actionable Flaws, SAP Patches a CVSS 10

Technology giants, Microsoft and SAP both released their monthly security updates on August 11, 2026. Between them they closed several hundred issues, including one Windows flaw that CISA added to its Known Exploited Vulnerabilities Catalog the same day and one SAP flaw scored at the top of the CVSS scale.

The two releases are different problems for a MedTech organisation. Microsoft's is a volume and sequencing problem, hundreds of fixes arriving at once against an estate that includes validated workstations and production endpoints where you cannot simply push an update and move on. SAP's is a concentration problem, a small number of notes sitting directly on the systems that carry manufacturing execution data and commerce integration.

400 Fixes That Need Action, One Already Under Attack

Published totals for this release run from 394 to 421, and the spread is not disagreement about what shipped. It is five trackers drawing the line in different places. Microsoft assigned 420 CVE numbers for August, of which twenty are service side fixes to Azure, Teams, Copilot and Microsoft 365 that require no customer action at all, as one analysis of the MSRC release document sets out. Excluding those gives the 400 figure BleepingComputer published. Tenable counts 398 and states plainly that it omitted two CVEs assigned by MITRE rather than Microsoft. Zero Day Initiative reaches the same 398 and adds a point worth carrying into your change board: several of the most alarming Critical entries, including the CVSS 10s, were already mitigated by Microsoft and need no action from you.

That last point also explains the Critical spread. CrowdStrike reports 62 Critical across the full assigned set, while Tenable reports 42 across its narrower one. The number that belongs in your ticket queue is 400 items requiring action, and the number that belongs in your executive summary is that this is one of the largest releases Microsoft has ever shipped, lower than the previous month's record but still far above a normal cycle.

The item that changes your week is CVE-2026-68820, a use after free in the Ancillary Function Driver for WinSock. It carries a CVSS score of 7.0, which understates it. CrowdStrike describes an attacker who already has low privileged local access winning a race condition to reach SYSTEM with no user interaction required. CISA listed it alongside a Cisco Secure Firewall flaw and a Metabase SQL injection issue.

Two further flaws were publicly disclosed before patch day without confirmed exploitation. CrowdStrike assesses that CVE-2026-62832 in the Windows User Profile Service is likely the fix for a proof of concept released publicly in July. Separately, Rapid7 disclosed CVE-2026-63520 in SharePoint Server in coordination with Microsoft, the second half of a chain that becomes unauthenticated remote code execution when combined with an earlier flaw for which Rapid7 has now published technical analysis.

SAP: 28 Notes, One Scored 10.0

SAP's August Patch Day brought 28 new security notes, four of them HotNews and eight High Priority. Onapsis puts the total at 33 with five HotNews and nine High Priority, a figure that includes reissued notes from May and July alongside four that SAP published after the initial release. SecurityWeek's count of four critical notes matches the new note figure. Both are correct at their own boundary.

The headline is CVE-2026-58231, SAP Security Note 3771065, scored at 10.0. It is an improper authorisation weakness in the Commerce Cloud Data Hub Adapter. Onapsis describes an unauthenticated attacker with network access to the import endpoint reaching arbitrary code execution and compromising internal components. The fix means moving to Commerce Cloud 2211.55 or 2211-jdk21.17 or later and then rebuilding and redeploying, so the work is not finished when the note is applied. SAP's interim control is an IP Filter Set limiting the Data Hub import path to trusted server addresses.

Two more critical items sit in the ABAP stack. CVE-2026-34265 is a memory corruption flaw in DIAG protocol parsing reachable without authentication and fixed at kernel patch level. A July HotNews note on NetWeaver AS ABAP was also reissued with additional guidance, worth rechecking if you closed it out last month.

SAP MII took six notes this month, two of them HotNews, all found with Onapsis Research Labs. CVE-2026-44772 (Note 3765948, CVSS 9.9) and CVE-2026-44758 (Note 3758900, CVSS 9.1) both allow command execution on the server through vulnerable servlets, and MII is the layer carrying batch and device history records between factory equipment and ERP. Neither patch finishes the job on its own, since both need a configuration step afterwards that no scanner will report as outstanding.

Why It Matters for Regulated MedTech

Neither vendor makes a medical device, and none of these CVEs will appear in an ICS Medical Advisory. Yet, they still land inside the regulated boundary, because of where these products sit rather than what they are.

Under 21 CFR 11.10, a manufacturer relying on electronic records must maintain secure, computer generated, time stamped audit trails of every action that creates, modifies or deletes a record, and must limit system access to authorised individuals. Since February 2, 2026, 21 CFR Part 820 has been the Quality Management System Regulation, incorporating ISO 13485:2016 by reference, and clause 4.1.6 of that standard requires validation of computer software used in the quality management system. A code injection flaw in the system that assembles production records puts both requirements in question, since an attacker with command execution on the host can alter the records and the log of who altered them in the same action. The same applies to SharePoint where your QMS holds design history files, supplier documentation or CAPA records, and stolen machine keys are the sharper case: an attacker forging valid sessions acts as a legitimate user inside precisely the records those audit trail controls exist to protect.

Recommendations:

• Treat CVE-2026-68820 as an emergency change: CISA listed it as actively exploited on August 11. Deploy the August cumulative update first on engineering workstations, build and release servers, service laptops and any manufacturing endpoint where a foothold could reach production systems.

• Inventory before you prioritise: If you haven't already, start with identifying every Windows build, SharePoint Server instance, SAP Commerce Cloud deployment and MII installation you own, including systems under validation, and confirm exact versions.

• Then triage against your own environment, not the CVSS list: Work high and critical severity first, weight by EPSS where the score is meaningful, and apply your existing vulnerability management procedure rather than treating the vendor list as a work queue. A flaw needing network access to an endpoint you have already segmented is not the same risk as one on an internet facing service, and a documented compensating control is a legitimate basis for scheduling rather than rushing.

• For on premises SharePoint, patch and then rotate: watchTowr found attackers pulling machine keys and advised that patching alone is insufficient, so rotate ASP.NET machine keys and credentials on exposed servers. CISA has also urged organisations running self-managed instances to confirm AMSI integration is enabled per web application.

• Apply SAP Note 3771065, then rebuild and redeploy: SAP's fixed levels are Commerce Cloud 2211.55 and 2211-jdk21.17. Where the change window is not immediate, SAP's own interim control is an IP Filter Set restricting the Data Hub import path to trusted server addresses.

• Close the MII notes with their configuration steps: Apply 3765948 and 3758900. SAP requires the Secure Transformer property be set with an allow list of hosts permitted to serve XSL files after patching, and Layer Seven Security separately recommends removing XMII_IllumXSLTServlet access from all roles as an interim control. Do not mark the ticket complete on the binary patch alone.

• Patch the ABAP kernel for CVE-2026-34265 and recheck the July HotNews note SAP reissued this month in case earlier remediation is now incomplete.

• Record every deferral in the risk register: For validated or revalidation blocked systems, document the compensating control, the owner and the target date, and route anything affecting a released product through postmarket surveillance rather than leaving it in IT ticketing.

Key Takeaway

The figure that will get quoted this month is 421, and it is the least useful number in the release. What matters is 400 items requiring action, one of them already being used against real targets, and one SAP flaw at the top of the scale sitting on an internet reachable endpoint. In regulated environment, the harder point is the MII pair, where the patch is half the fix and the missing half is a configuration step nothing will flag as outstanding.

Primary Sources

1. CISA, Three Known Exploited Vulnerabilities added to Catalog, August 11, 2026

2. Microsoft Security Update Guide, August 2026 release

3. SAP Security Notes, August 2026

4. SAP Security Note 3771065, Commerce Cloud Data Hub Adapter

5. SAP Security Notes 3765948 and 3758900, Manufacturing Integration and Intelligence