Microsoft and SAP Patch Critical Zero-Days in August 2026 Patch Tuesday
Microsoft’s August 2026 Patch Tuesday addressed 398 vulnerabilities, including 42 critical flaws and 355 rated Important, marking another month of heavy patch loads for security teams. Among the most urgent fixes was CVE-2026-68820, an actively exploited zero-day elevation-of-privilege vulnerability in the Windows Ancillary Function Driver (AFD) for WinSock, which handles socket commands. Researchers warned that the flaw already leveraged in the wild could be used by nation-state actors, mirroring past attacks linked to North Korean hacking groups.
Key Vulnerabilities and Priorities
-
Actively Exploited Zero-Days
- CVE-2026-68820 (WinSock Driver): Requires immediate patching due to confirmed exploitation.
- CVE-2026-62832 (Windows User Profile Service): Publicly disclosed, enabling attackers to load another user’s registry hive (e.g., an admin’s) for unauthorized access. Dubbed "LegacyHive", a proof-of-concept exploit emerged hours after Patch Tuesday.
-
Critical Remote Code Execution (RCE) Flaws
- Windows DNS Server RCE (CVSS 9.8)
- Microsoft QUIC RCE (CVSS 9.8)
- Windows iSCSI Target Service RCE (CVSS 9.8)
- Windows Deployment Services TFTP Server RCE (CVSS 9.8)
These vulnerabilities allow unauthenticated attackers to execute arbitrary code remotely, posing severe risks to exposed systems.
-
SharePoint and Active Directory Risks
- Microsoft SharePoint Server RCE (CVSS 9.8): Assessed as highly likely to be exploited, though no active attacks were confirmed at release.
- SharePoint Elevation of Privilege (EoP): Enables authenticated attackers with domain access to gain SharePoint administrator privileges.
- Active Directory Certificate Services (AD CS): Highlighted for accelerated remediation due to its role in identity compromise.
-
SAP’s Critical Fixes
SAP released 29 patches, including:- CVE-2026-44772 (SAP Commerce Cloud Data Hub Adapter, CVSS 10): An improper authorization flaw allowing unauthenticated attackers to execute arbitrary code via crafted data, risking data theft, application manipulation, or credential compromise.
- CVE-2026-44773 (SAP NetWeaver ABAP, CVSS 9.9): A memory corruption issue in Application Server ABAP, potentially leading to system crashes or data exposure.
Exploitation Trends and Mitigation
- No workarounds exist for most critical flaws, making patch deployment the primary defense.
- Systems unable to patch immediately should implement risk acceptance, segmentation, enhanced monitoring, and compensating controls.
- Prioritization guidance: Focus first on actively exploited zero-days and internet-exposed systems, followed by unauthenticated RCE flaws and publicly disclosed vulnerabilities.
Broader Context
- The WinSock zero-day and SAP Commerce Cloud flaw were flagged as the highest-priority fixes this month.
- SharePoint vulnerabilities were emphasized due to their potential to expose sensitive corporate data or disrupt business processes.
- The sheer volume of patches (398 for Microsoft, 29 for SAP) underscores the new normal of large-scale vulnerability management, with security teams urged to triage based on exploitation status and exposure risk.
The updates reflect ongoing threats from nation-state actors, ransomware groups, and opportunistic attackers, particularly targeting Windows, SharePoint, and SAP systems critical to enterprise operations.
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft
SAP TPRM report: https://www.rankiteo.com/company/sap
"id": "micsap1786497581",
"linkid": "microsoft, sap",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Software',
'location': 'Global',
'name': 'Microsoft',
'size': 'Enterprise',
'type': 'Technology'},
{'industry': 'Enterprise Software',
'location': 'Global',
'name': 'SAP',
'size': 'Enterprise',
'type': 'Technology'}],
'attack_vector': ['Exploited in the wild',
'Unauthenticated remote access',
'Authenticated local access'],
'data_breach': {'sensitivity_of_data': ['High (if PII or credentials '
'exposed)'],
'type_of_data_compromised': ['Registry hives',
'Corporate data',
'Application data']},
'date_detected': '2026-08',
'date_publicly_disclosed': '2026-08',
'date_resolved': '2026-08',
'description': 'Microsoft’s August 2026 Patch Tuesday addressed 398 '
'vulnerabilities, including 42 critical flaws and 355 rated '
'Important. Among the most urgent fixes was CVE-2026-68820, an '
'actively exploited zero-day elevation-of-privilege '
'vulnerability in the Windows Ancillary Function Driver (AFD) '
'for WinSock. SAP also released 29 patches, including critical '
'flaws like CVE-2026-44772 (SAP Commerce Cloud Data Hub '
'Adapter) and CVE-2026-44773 (SAP NetWeaver ABAP).',
'impact': {'data_compromised': ['Sensitive corporate data',
'Registry hives',
'Application data'],
'identity_theft_risk': ['High (if PII exposed)'],
'operational_impact': ['System crashes',
'Unauthorized access',
'Data exposure'],
'systems_affected': ['Windows DNS Server',
'Microsoft QUIC',
'Windows iSCSI Target Service',
'Windows Deployment Services TFTP Server',
'Microsoft SharePoint Server',
'Active Directory Certificate Services',
'SAP Commerce Cloud Data Hub Adapter',
'SAP NetWeaver ABAP']},
'investigation_status': 'Ongoing (for exploitation trends and threat actor '
'attribution)',
'lessons_learned': 'The incident highlights the importance of prioritizing '
'patches for actively exploited zero-days, '
'internet-exposed systems, and critical enterprise '
'software like SharePoint and SAP. Compensating controls '
'(e.g., segmentation, monitoring) are essential for '
'systems that cannot be patched immediately.',
'motivation': ['Espionage', 'Data Theft', 'System Compromise'],
'post_incident_analysis': {'corrective_actions': ['Accelerate patch '
'management processes',
'Implement risk-based '
'prioritization for '
'vulnerabilities',
'Enhance monitoring and '
'segmentation for critical '
'systems'],
'root_causes': ['Unpatched critical '
'vulnerabilities in Windows and '
'SAP systems',
'Exploitation of zero-day flaws by '
'nation-state actors',
'Lack of compensating controls for '
'exposed systems']},
'recommendations': ['Prioritize patching for actively exploited zero-days and '
'unauthenticated RCE flaws.',
'Implement network segmentation and enhanced monitoring '
'for unpatched systems.',
'Focus on SharePoint and Active Directory vulnerabilities '
'due to their role in identity and data compromise.',
'Apply SAP patches immediately, especially for Commerce '
'Cloud and NetWeaver ABAP.'],
'references': [{'date_accessed': '2026-08',
'source': 'Microsoft August 2026 Patch Tuesday'},
{'date_accessed': '2026-08',
'source': 'SAP Security Notes August 2026'}],
'response': {'containment_measures': ['Patch deployment',
'Network segmentation',
'Enhanced monitoring'],
'enhanced_monitoring': 'Recommended for exposed systems',
'network_segmentation': 'Recommended for unpatched systems',
'remediation_measures': ['Immediate patching',
'Compensating controls for unpatched '
'systems']},
'threat_actor': ['Nation-state actors (suspected North Korean hacking '
'groups)'],
'title': 'Microsoft and SAP Patch Critical Zero-Days in August 2026 Patch '
'Tuesday',
'type': ['Zero-Day Exploitation',
'Remote Code Execution',
'Elevation of Privilege',
'Memory Corruption'],
'vulnerability_exploited': ['CVE-2026-68820 (Windows Ancillary Function '
'Driver for WinSock)',
'CVE-2026-62832 (Windows User Profile Service - '
'LegacyHive)',
'CVE-2026-44772 (SAP Commerce Cloud Data Hub '
'Adapter)',
'CVE-2026-44773 (SAP NetWeaver ABAP)']}