Windows 11 August Patch Tuesday Fixes ~400 Security Flaws, Urges Fast Update

Microsoft’s August Patch Tuesday for Windows 11 has closed roughly four hundred security issues across Windows and related products, and the company is again urging customers to apply the update quickly—though the famous “three-day” guidance is aimed at managed corporate devices, not home PCs.

August Patchday: ~400 fixes, including 236 on Windows

On August 11, 2026, Microsoft shipped fixes addressing a total of about 400 vulnerabilities across Windows and additional software components. Different researchers count the total slightly differently depending on which entries they include, but the Windows portion is consistent: 236 vulnerabilities are listed as affecting Windows directly.

• Microsoft Security Update Guide lists 421 entries for the August cycle
• Other tallies include ~400 fixes (when considering only patch-day releases), 398, and 415 depending on counting method
• Windows-specific fixes total 236
• Other affected products include Office, SharePoint, Exchange Server, Azure, and various tools

Microsoft’s August total does not break any records. The company closed 570 issues in July, around 200 in June, and 107 in the same month the year prior. Over the first eight months of 2026, the cumulative number of fixes reported by Microsoft is 1,708, compared with 787 for the same period in the previous year—an increase of 117%.

As a reason for the jump, Microsoft points to AI-assisted tooling used during vulnerability research and discovery. For Windows 11 24H2 and 25H2, the August changes are delivered via the cumulative update KB5121003.

The “three days” rule is for IT-managed devices

The widely repeated recommendation to install Windows updates within three days traces back to a Microsoft-365 director post by Jeremy Chapman from July 8, 2026. In that guidance, Microsoft lays out scheduling targets for Intune and Windows Autopatch deployments: a pause window of under three days for quality updates, an installation window of zero to one day, and a follow-up period of at most two additional days.

Microsoft ties the recommendation to changes in attacker timelines, saying that AI tools have shortened the gap between a vulnerability being published and the first working exploitation. For private users, the practical impact is limited because security updates are delivered automatically on home systems.

The three-day figure is therefore best understood as a target for enterprise patch operations. Microsoft’s own documentation also uses a less strict overall upper bound of seven days when considering pause, installation, and follow-up time together.

What matters for gamers: one actively exploited bug plus privilege escalation

Among the August Patch Tuesday fixes, exactly one vulnerability is currently described as actively exploited: CVE-2026-68820 in the Windows driver AFD.sys (Ancillary Function Driver for WinSock). For most gaming PCs, many “critical” issues in this set are tied to server roles such as DNS, DHCP, WDS, or RRAS, which typically aren’t running on a standard home rig.

Where the update is more immediately relevant for everyday systems is in rights escalation. The patch includes fixes that can allow malware already on the system to gain higher privileges.

The U.S. agency CISA added CVE-2026-68820 to its known exploited catalog on August 11. Check Point attributes the associated exploit to the Lazarus group.

Microsoft also highlights CVE-2026-62832 in the User Profile Service, describing a path for a local account to obtain administrator privileges. With a CVSS score of 9.8 and remote attack potential, Microsoft lists additional items such as a bug in the Windows DNS Server and a weakness in Microsoft QUIC.

How to confirm the update and what to watch next

To verify the August update on Windows 11, check the build number shown in Settings → System → Info. After installing the August fixes, Windows 11 25H2 should show build 26200.9168, while Windows 11 24H2 should show build 26100.9168. Any higher build number within the same 26200 (25H2) or 26100 (24H2) series also indicates the device is on (or beyond) the relevant update level.

If the update is missing, first check whether updates were paused. Installation may also require two restarts due to Secure Boot.

One date Windows 11 24H2 users should note: support for the Home and Pro editions ends on October 13, 2026. Enterprise and Education remain supported until October 12, 2027.

Windows 10 owners should also be aware that the August fixes arrive only through the Extended Security Updates program, via KB5120249.