August Patch Tuesday: 400 Flaws, 3 Zero-Days, and What to Fix First
Microsoft's August Patch Tuesday fixes roughly 400 vulnerabilities, three already under active attack, alongside a reminder to patch Adobe products too.
Microsoft’s August 2026 Patch Tuesday landed with fixes for roughly 400 vulnerabilities, including three that are already being exploited, according to BleepingComputer and CrowdStrike. It’s a smaller batch than some recent months, but the three active zero-days mean it’s not a month to let slide.
The zero-days come first, as always. With three vulnerabilities already under active attack, the practical rule doesn’t change from month to month: whatever else is on the list, these get pushed first, especially on any machine that touches email, the web, or the outside world in general.
Worth a second look: Adobe’s updates. This month’s release also included fixes from Adobe, covered in the same Qualys review. Adobe products (Acrobat, Reader, and similar) often get less attention than Windows and Office in a business’s patch routine, but they’re just as reachable through a malicious PDF or file attachment.
The pattern holds. Every month brings a different number, but the underlying approach doesn’t change: confirm what’s actively exploited, patch that everywhere immediately, then work through the rest on your normal cycle rather than trying to evaluate every CVE individually.
General IT Tip: Multi-Factor Authentication, No Exceptions
If there’s one control that consistently blunts the impact of a patching gap, it’s MFA. A lot of the damage from an exploited vulnerability depends on what an attacker can do once they’re in, and a stolen or guessed password that’s backed by MFA is far less useful to them. If any admin accounts, remote access tools, or email logins in your environment still don’t require it, that’s worth fixing before the next patch cycle even starts.
What This Means for You
- Confirm the three actively-exploited fixes are installed across your environment.
- Don’t skip Adobe’s updates just because they arrived alongside the bigger Microsoft release.
- Check that MFA is enforced everywhere it can be, particularly on anything with administrative access.
Sources: