Zurück zur Übersicht

Red Team Manager Active Directory & Identity

Microsoft Patch Tuesday for August 2026 — Snort rules and prominent vulnerabilities

Cisco Talos·11. August 2026, 22:21

Originalartikel lesen bei Cisco Talos

Microsoft hat im August 2026 421 Sicherheitslücken behoben, darunter 62 kritische Schwachstellen, von denen eine bereits aktiv ausgenutzt wurde (CVE-2026-68820). Betroffen sind zahlreiche Microsoft-Produkte wie Windows, SharePoint und Office. Nutzer sollten die bereitgestellten Updates umgehend installieren, um sich vor potenziellen Angriffen zu schützen.

Kurzfassung

Microsoft hat im August 2026 insgesamt 421 Sicherheitslücken behoben, darunter 62 kritische Schwachstellen. Eine dieser Schwachstellen (CVE-2026-68820) wird bereits aktiv ausgenutzt. Betroffen sind zahlreiche Microsoft-Produkte wie Windows, SharePoint und Office, wobei viele ein Risiko für die Remotecodeausführung darstellen.

Relevanz für Manager / CISOs

Priorität:Sofort

Betroffene

Organisationen und Nutzer, die Microsoft-Produkte wie Windows, SharePoint und Office einsetzen.

Warum relevant

Die aktive Ausnutzung von CVE-2026-68820 bedeutet ein unmittelbares Risiko für Systeme, die nicht gepatcht sind. Die Vielzahl kritischer Schwachstellen, insbesondere solche mit Remotecodeausführungsrisiko, erfordert eine schnelle Reaktion, um die Integrität und Verfügbarkeit von Systemen zu gewährleisten.

Realistisches Worst Case

Erfolgreiche Ausnutzung der aktiv ausgenutzten Schwachstelle (CVE-2026-68820) oder anderer kritischer Lücken, die zu Remotecodeausführung, Datenkompromittierung oder vollständiger Systemübernahme führen kann.

Handlungsempfehlung

Umgehende Installation aller von Microsoft bereitgestellten Sicherheitsupdates für die betroffenen Produkte.

Defensive Validierung / Purple-Team Checks

▸Überprüfen Sie, ob alle Microsoft-Produkte (Windows, SharePoint, Office) die neuesten Sicherheitsupdates vom August 2026 installiert haben.
▸Scannen Sie Ihre Systeme auf Anzeichen einer Kompromittierung, insbesondere im Hinblick auf die aktiv ausgenutzte Schwachstelle CVE-2026-68820.
▸Validieren Sie, dass Ihre Intrusion Detection/Prevention Systeme (z.B. Snort-Regeln, falls verfügbar) so konfiguriert sind, dass sie bekannte Exploits für die behobenen Schwachstellen erkennen und blockieren.

MITRE ATT&CK Zuordnung

Taktik	Technik	Konfidenz	Beleg
Initial Access	T1190 Exploit Public-Facing Application	High	eine bereits aktiv ausgenutzt wurde (CVE-2026-68820)
Execution	T1210 Exploitation for Client Execution	Low	viele posing remote code execution risks

Offene Punkte

Spezifische Details zur Art der Ausnutzung von CVE-2026-68820 sind im Artikel nicht genannt.
Die genauen Auswirkungen der Remotecodeausführung für jede einzelne Schwachstelle sind nicht detailliert beschrieben.
Es wird nicht spezifiziert, welche spezifischen Versionen der Microsoft-Produkte betroffen sind.

Red-Team-Relevanz

Was heißt das für dein nächstes Assessment?

Initial Access möglich?Ja
Privilege Escalation relevant?Ja
Exploit öffentlich verfügbar?Ja
Detection / Logging prüfbar?Ja
Für Purple-Team-Szenario geeignet?Ja

Kundenfragen

Haben wir Cisco extern erreichbar?
Haben wir Exchange extern erreichbar?
Können wir Resource Development detektieren?
Können wir Collection detektieren?

MITRE ATT&CK Kill Chain (6 Techniken)

Resource Development

DNS Server

Server

DNS Server

Server

Vulnerabilities

Collection

Sharepoint

Themen

Patch Tuesday

Vollständigen Artikel lesen bei Cisco Talos

4 Quellen berichten

Weitere Quellen

Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days
BleepingComputer · vor 1 Tag
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day
SecurityWeek · vor 1 Tag
Microsoft's Patch Tuesday Deluge Continues With August Updates
Dark Reading · vor 1 Tag

Erwähnte CVEs (94)

CVE-2026-68820HIGH(7.0)

KEVEPSS 0%

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-62893CRITICAL(9.8)

EPSS 2%

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

CVE-2026-65665HIGH(8.8)

EPSS 2%

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-62823HIGH(8.8)

EPSS 1%

Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-62830CRITICAL(9.9)

EPSS 0%

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVE-2026-50516CRITICAL(9.4)

EPSS 1%

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-68794HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-68816HIGH(7.8)

EPSS 0%

Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-68804HIGH(7.8)

EPSS 0%

Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

CVE-2026-62911HIGH(8.0)

EPSS 1%

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-63515HIGH(7.8)

EPSS 0%

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-65657HIGH(7.8)

EPSS 0%

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-63532HIGH(7.8)

EPSS 0%

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-64898HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-64903HIGH(7.8)

EPSS 0%

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-64909HIGH(7.8)

EPSS 0%

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-64910HIGH(7.8)

EPSS 0%

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-64911HIGH(7.8)

EPSS 0%

Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-70130HIGH(8.4)

EPSS 0%

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-63513HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-63519HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-65664HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-63526HIGH(7.8)

EPSS 0%

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-66807HIGH(7.8)

EPSS 0%

Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

CVE-2026-63518HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-63525HIGH(7.8)

EPSS 0%

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-64907HIGH(7.8)

EPSS 0%

Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.

CVE-2026-62827HIGH(8.8)

EPSS 1%

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-64921HIGH(8.8)

EPSS 1%

Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-62824HIGH(8.8)

EPSS 1%

Stack-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

CVE-2026-62818HIGH(8.8)

EPSS 1%

Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.

CVE-2026-62817HIGH(8.8)

EPSS 1%

Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-62820HIGH(8.1)

EPSS 0%

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-62878CRITICAL(9.8)

EPSS 1%

Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-66802HIGH(8.1)

EPSS 0%

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network.

CVE-2026-71331HIGH(8.1)

EPSS 0%

Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network.

CVE-2026-62890HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Windows GDI+ allows an authorized attacker to execute code locally.

CVE-2026-62822HIGH(8.8)

EPSS 1%

Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network.

CVE-2026-66799HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

CVE-2026-62816HIGH(8.8)

EPSS 0%

Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-62819HIGH(8.1)

EPSS 1%

Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

CVE-2026-62889HIGH(8.1)

EPSS 1%

Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.

CVE-2026-65789HIGH(8.1)

EPSS 0%

Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-65791CRITICAL(9.8)

EPSS 1%

Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.

CVE-2026-49163HIGH(8.8)

EPSS 1%

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network.

CVE-2026-50481CRITICAL(9.9)

EPSS 0%

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2026-68823CRITICAL(9.1)

EPSS 1%

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.

CVE-2026-62869HIGH(8.8)

EPSS 0%

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

CVE-2026-56161CRITICAL(9.6)

EPSS 0%

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

CVE-2026-63522HIGH(7.8)

EPSS 0%

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.

CVE-2026-56162CRITICAL(10.0)

EPSS 0%

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-62836HIGH(8.7)

EPSS 0%

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-50515CRITICAL(9.9)

EPSS 1%

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.

CVE-2026-62873CRITICAL(9.8)

EPSS 0%

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-59115CRITICAL(9.9)

EPSS 1%

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

CVE-2026-70332CRITICAL(9.6)

EPSS 0%

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-63508CRITICAL(10.0)

EPSS 0%

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-59118CRITICAL(9.3)

EPSS 0%

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-65668HIGH(8.8)

EPSS 0%

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.

CVE-2026-62815CRITICAL(9.8)

EPSS 1%

Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.

CVE-2026-62896CRITICAL(9.6)

EPSS 0%

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.

CVE-2026-62918HIGH(7.5)

EPSS 0%

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-65667CRITICAL(10.0)

EPSS 0%

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-58650HIGH(7.8)

EPSS 0%

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-63520HIGH(8.1)

EPSS 1%

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-59124CRITICAL(9.8)

EPSS 2%

Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.

CVE-2026-59133HIGH(8.8)

EPSS 1%

Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network.

CVE-2026-59132HIGH(7.5)

EPSS 1%

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network.

CVE-2026-61348HIGH(7.0)

EPSS 1%

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-61925HIGH(7.8)

EPSS 0%

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-61930HIGH(7.8)

EPSS 2%

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-62688HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.

CVE-2026-62696HIGH(7.8)

EPSS 3%

Integer underflow (wrap or wraparound) in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

CVE-2026-62713HIGH(7.8)

EPSS 2%

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-62712HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-62735HIGH(7.8)

EPSS 0%

Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

CVE-2026-62737HIGH(7.8)

EPSS 0%

Untrusted pointer dereference in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-62783HIGH(7.8)

EPSS 2%

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-62766HIGH(7.0)

EPSS 1%

Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.

CVE-2026-65788HIGH(7.0)

EPSS 1%

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-69278HIGH(7.8)

EPSS 0%

Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-70307HIGH(7.0)

EPSS 0%

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-70335HIGH(7.8)

EPSS 0%

Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

CVE-2026-66804HIGH(7.8)

EPSS 3%

Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.

CVE-2026-70355HIGH(7.3)

EPSS 0%

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

CVE-2026-61358HIGH(7.8)

EPSS 3%

Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

CVE-2026-61929HIGH(7.0)

EPSS 1%

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-62698HIGH(7.8)

EPSS 0%

Numeric truncation error in Microsoft Digest Authentication allows an authorized attacker to elevate privileges locally.

CVE-2026-62721HIGH(7.8)

EPSS 0%

Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.

CVE-2026-62741HIGH(7.8)

EPSS 2%

Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

CVE-2026-62788HIGH(7.0)

EPSS 0%

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-62832HIGH(7.8)

EPSS 2%

Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

CVE-2026-62888HIGH(7.8)

EPSS 2%

Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

CVE-2026-65775HIGH(7.8)

EPSS 2%

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

Verwandte Artikel

Microsoft Patches Record 622 Vulnerabilities, Including Two Exploited Zero-Days

SecurityWeek·vor 29 Tagen