Windows August 2026 Patch Tuesday: KB5121003, 194 CVEs, One Exploited, and the SharePoint Fixes

Patch Tuesday for August 2026 landed on 11 August. This page is the reference version: which update to install on which Windows 11 build, what it fixes, what it breaks, and how to check that your devices and SharePoint farms really took it. Every number below comes from Microsoft's own pages and security data, and the sources are listed at the end.

What Microsoft released on 11 August 2026

Windows 11 gets a different KB depending on the version and on whether the device uses hotpatching. The build number is the quickest way to check what a device has, and it is what the Intune report in this post compares against.

Of the 194 CVEs in KB5121003, the biggest groups are elevation of privilege (129) and information disclosure (31), then remote code execution (20), denial of service (7), security feature bypass (3), spoofing (2) and tampering (2). Microsoft rates 23 of them “Exploitation More Likely”. One is exploited and one was publicly disclosed before the patch.

The exploited Windows vulnerability: CVE-2026-68820

The only August CVE that Microsoft marks Exploited:Yes is CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock. Microsoft rates it Important, CVSS 7.0, and the CVSS vector is local (AV:L) with high attack complexity.

In plain English: an attacker who can already run code on the machine as a normal user can run a crafted program that wins a race condition and gets SYSTEM privileges. It cannot be exploited remotely on its own, so it is the second step of an attack, not the first. That is why it sits at Important rather than Critical, and why a severity-sorted patch list puts it behind the Critical fixes even though it is the one being used in attacks.

CISA added it to its Known Exploited Vulnerabilities catalog on 11 August, with a due date of 25 August. Microsoft lists it against Windows 10, Windows 11 and Windows Server (30 product entries), so servers and Windows 10 devices need their own August KB. KB5121003, KB5120994 and KB5120240 cover the Windows 11 builds above.

The 7 Critical CVEs in KB5121003

None of these seven is marked exploited. The one flaw that was disclosed publicly before the patch is CVE-2026-62832, a Windows User Profile Service elevation of privilege rated Important.

Known issues in KB5121003

Microsoft's KB page lists two known issues for the August update. The ARM issue is fixed in later monthly updates, and the games issue is handled by a driver block, so the practical advice is to install the newest cumulative update rather than stop at the August one.

More detail on each issue elsewhere on this site: the inpoutx64 driver block and Teams and Outlook on ARM.

SharePoint Server: the August fixes and the July flaw CISA flagged

SharePoint Server has two separate stories this month, and the original version of this post blended them together.

August: 30 SharePoint CVEs, 4 Critical, none exploited

Microsoft's August data has 30 CVEs with SharePoint in the title: 13 spoofing, 10 remote code execution, 5 elevation of privilege, 1 information disclosure and 1 tampering. Four are Critical (CVE-2026-62827, CVE-2026-64921, CVE-2026-65665 and CVE-2026-70332), and none is marked exploited. Three are rated “Exploitation More Likely”: the remote code executions CVE-2026-63520 and CVE-2026-65665, and the elevation of privilege CVE-2026-70355. The fix is the August SharePoint update for your version:

Microsoft's data lists two KB numbers each for 2019 and 2016. Open both KB articles for your version and install every package they list.

July: CVE-2026-55040, the one CISA added to its exploited list

CVE-2026-55040 was published on 14 July 2026, not in August. Microsoft titles it “Microsoft SharePoint Server Security Feature Bypass Vulnerability” and rates it Critical, CVSS 9.1: network, no privileges, no user interaction, high impact on confidentiality and integrity, none on availability. Microsoft describes it as weak authentication that lets an unauthorized attacker bypass a security feature over the network, and its FAQ says the authentication feature could be bypassed because the flaw allows impersonation.

Two things follow from that wording. It is an authentication bypass, so it does not by itself run code on the server. And Microsoft's own entry does not claim code execution, so treat any write-up that calls it an RCE chain as unsupported.

The July fix was KB5002891 (SharePoint Enterprise Server 2016, build 16.0.5561.1001), KB5002883 (Server 2019, 16.0.10417.20175) and KB5002882 (Subscription Edition, 16.0.19725.20434). Microsoft's product list for this CVE contains only these three on-premises versions. The August builds in the table above are higher than the July ones, so a farm on the August build has the July fix too.

Check and patch SharePoint Server

Run this in the SharePoint Management Shell on a farm server. It reads the farm build with Get-SPFarm and compares it with the fixed builds from Microsoft's data. You choose the product yourself with -Product, because one threshold cannot cover three products. Test it in a non-production farm first.

# Run in the SharePoint Management Shell on a farm server
param(
    [Parameter(Mandatory)][ValidateSet('SE','2019','2016')][string]$Product
)
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

# Fixed builds, from Microsoft's July and August 2026 security update data
$july   = @{ SE=[version]'16.0.19725.20434'; '2019'=[version]'16.0.10417.20175'; '2016'=[version]'16.0.5561.1001' }
$august = @{ SE=[version]'16.0.19725.20522'; '2019'=[version]'16.0.10417.20198'; '2016'=[version]'16.0.5565.1001' }

$build = (Get-SPFarm).BuildVersion
"Farm build        : $build"
"CVE-2026-55040   : fixed at $($july[$Product]) or later"
"August 2026 CUs  : fixed at $($august[$Product]) or later"

if     ($build -ge $august[$Product]) { 'Result: on the August 2026 build or later' }
elseif ($build -ge $july[$Product])   { 'Result: CVE-2026-55040 fixed, August SharePoint fixes missing' }
else                                    { 'Result: BEHIND - CVE-2026-55040 is not fixed' }

Get-SPServer | Select-Object Name, Role, NeedsUpgrade | Format-Table -AutoSize

The patching order below follows Microsoft's “Install a software update” guidance for SharePoint Server. Read the full article for farms with search, load balancers or the User Profile Service.

1. Download the update packages for your SharePoint version and install them on every server in the farm. The installer patches only the server it runs on. Microsoft's procedure takes web servers out of the load-balancer rotation first.
2. Run the SharePoint Products Configuration Wizard on each server, or run PSConfig. Microsoft's documented command is:
   PSConfig.exe -cmd upgrade -inplace b2b -wait -cmd applicationcontent -install -cmd installfeatures -cmd secureresources
   It lives in C:\Program Files\Common Files\Microsoft Shared\web server extensions\16\bin. Sites are unavailable while it upgrades the databases.
3. Confirm the result in Central Administration under Upgrade and Migration, which Microsoft describes as the primary place to see product and patch installation status, and re-run the script above.

Illustrative output of the script on a Subscription Edition farm that has the July update but not August (server names are examples):

.\Check-SharePointBuild.ps1 -Product SE
Farm build        : 16.0.19725.20434
CVE-2026-55040   : fixed at 16.0.19725.20434 or later
August 2026 CUs  : fixed at 16.0.19725.20522 or later
Result: CVE-2026-55040 fixed, August SharePoint fixes missing

Name        Role                      NeedsUpgrade
----        ----                      ------------
SP-APP01    Application               False
SP-WFE01    WebFrontEnd               False

Check your Windows fleet is on the August build

The reliable test for a Windows 11 device is its build number, not whether it has synced recently. This script uses the Microsoft Graph PowerShell SDK to list Intune-managed Windows devices whose osVersion is below the August minimum for their version. It needs the DeviceManagementManagedDevices.Read.All permission.

# Requires: Microsoft.Graph PowerShell SDK, DeviceManagementManagedDevices.Read.All
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# August 2026 minimum builds. Hotpatch devices report 9106 for August,
# so lower the 26100 and 26200 minimums to 9106 if you run hotpatch.
$minimum = @{ '26100'=9168; '26200'=9168; '22631'=7517 }

$devices = Get-MgDeviceManagementManagedDevice `
    -Filter "operatingSystem eq 'Windows'" `
    -Property "deviceName,osVersion,lastSyncDateTime" -All

# TryParse, not a [version] cast: a device that never reported a version would
# otherwise throw and then vanish from the report entirely. Track those separately.
$behind  = [System.Collections.Generic.List[object]]::new()
$unknown = [System.Collections.Generic.List[object]]::new()

foreach ($d in $devices) {
    $v = $null
    if (-not [version]::TryParse($d.OsVersion, [ref]$v) -or $v.Revision -lt 0) {
        $unknown.Add($d); continue
    }
    $key = "$($v.Build)"
    if ($minimum.ContainsKey($key) -and $v.Revision -lt $minimum[$key]) { $behind.Add($d) }
}

"Windows devices checked : $($devices.Count)"
"Below August minimum    : $($behind.Count)"
"Version unreadable      : $($unknown.Count)   <- chase these, they are not 'clean'"
$behind | Select-Object DeviceName, OsVersion, LastSyncDateTime |
    Sort-Object OsVersion | Export-Csv .\BelowAugustBuild.csv -NoTypeInformation
$unknown | Select-Object DeviceName, OsVersion, LastSyncDateTime |
    Export-Csv .\UnreadableVersion.csv -NoTypeInformation

Any build above the minimum, such as September or October builds, passes, because the numbers only go up. Devices on other Windows 11 builds, Windows 10 and servers are not checked by this script and need their own August KB numbers from the Security Update Guide.

What else changed in the August update

Microsoft lists three changes in KB5121003 itself:

• Secure Boot: more high-confidence device targeting data, which widens the set of devices eligible to receive the new Secure Boot certificates automatically. Microsoft says certificate deployment through Windows Update continues over the coming months.
• Sharing: the Drop Tray experience (previously Drag Tray) is removed, along with its setting under Settings > System > Multitasking.
• Security updates, plus AI component updates to version 1.2605.856.0 (Image Search, Content Extraction, Semantic Analysis and Settings Model) and a servicing stack update, KB5123304 (build 26100.9156).

The rest of what people associate with this month came from the 28 July preview, KB5101684 (builds 26200.8973 and 26100.8973), which KB5121003 includes. Highlights from Microsoft's notes for that preview:

• Windows Hello Enhanced Sign-in Security now supports peripheral fingerprint sensors on desktops and other PCs. Microsoft says the feature was first disclosed in January 2026 and is now starting to roll out.
• Voice Access gains Voice Isolation, which needs a one-time voice setup, and Korean language support.
• Touchpad: new scroll and zoom speed settings and accelerated scrolling, under Settings > Bluetooth & devices > Touchpad.
• File Explorer: file sizes in Details view use KB, MB and GB, and middle-click opens a folder in a new tab.
• Windows Search: better handling of typos and partial names when searching for installed apps.
• Windows Update: fewer restarts, by installing eligible updates together with the monthly security update where possible.

Enhanced Sign-in Security with an external fingerprint reader

Microsoft's Enhanced Sign-in Security (ESS) page says the scanner has to be an ESS-capable match-on-chip sensor with a Microsoft-issued certificate burned in during manufacturing, with drivers and firmware that support ESS. A fingerprint reader that is not ESS-capable does not qualify. The user-side path is Settings > Accounts > Sign-in options > Additional settings, where the “Enhanced sign-in security” entry reads “Pending set up” when the device is ready. Enrolling a fingerprint on the ESS scanner then turns ESS on.

References

• KB5121003: August 11, 2026 update for Windows 11 24H2 and 25H2
• KB5120994: August 11, 2026 Hotpatch update
• KB5120240: August 11, 2026 update for Windows 11 23H2
• KB5101684: July 28, 2026 preview update
• Windows 11, version 24H2 known issues and notifications
• Windows 11 release information
• CVE-2026-68820 in the Microsoft Security Update Guide
• CVE-2026-55040 in the Microsoft Security Update Guide
• Microsoft August 2026 security update data (CVRF, send Accept: application/json)
• Install a software update for SharePoint Server
• Windows Hello Enhanced Sign-in Security
• CISA Known Exploited Vulnerabilities Catalog