Patch Tuesday

August 2026

On the second Tuesday of each month Microsoft, Adobe, SAP, Siemens and Schneider Electric publish in bulk; Oracle on the third Tuesday of January, April, July and October. Records published that day, from our own database, sorted by action score: KEV and mature exploits first.

How it is computed: CNA stamp + publication date (two-day window, UTC). No claim of a one-to-one match with the vendor bulletin; out-of-band updates land on other days.

470 records · 3 KEV

Affecting your stack

This month's records that match the products and versions in your stack.

Microsoft · August 11

400 · 2 KEV · 9 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
66This week	CVE-2026-65660Weaponized	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-94 RCE	High8.8	KEV	2.1%	Aug 11, 2026
58Plan	CVE-2026-68820Weaponized	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-416 Local privilege escalation Memory safety	High7.0	KEV	0.3%	Aug 11, 2026
39Monitor	CVE-2026-59124No exploit	Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerabilitymicrosoft · windows app · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	1.5%	Aug 11, 2026
39Monitor	CVE-2026-62815No exploit	Microsoft QUIC Remote Code Execution Vulnerabilitymicrosoft · windows 11 23h2 · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Aug 11, 2026
39Monitor	CVE-2026-62878Proof of concept	Windows DNS Server Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-121 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Aug 11, 2026
39Monitor	CVE-2026-62893No exploit	Windows Deployment Services TFTP Server Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Aug 11, 2026
39Monitor	CVE-2026-65768No exploit	Microsoft Teams Remote Code Execution Vulnerabilitymicrosoft · teams · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	0.9%	Aug 11, 2026
39Monitor	CVE-2026-65791No exploit	Windows iSCSI Target Service Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607 · CWE-122 pre-auth RCE Memory safety	Critical9.8	—	1.0%	Aug 11, 2026
38Monitor	CVE-2026-57104No exploit	Azure Storage Explorer Elevation of Privilege Vulnerabilitymicrosoft · azure storage explorer · CWE-79 Pre-auth XSS	Critical9.6	—	0.9%	Aug 11, 2026
37Monitor	CVE-2026-50516No exploit	Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerabilitymicrosoft · azure kubernetes service · CWE-306 Pre-auth Auth bypass	Critical9.4	—	0.8%	Aug 11, 2026
37Monitor	CVE-2026-70306No exploit	Microsoft Office SharePoint Spoofing Vulnerabilitymicrosoft · sharepoint server · CWE-79 Pre-auth XSS	Critical9.3	—	1.0%	Aug 11, 2026
36Monitor	CVE-2026-63514No exploit	Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint server · CWE-502 RCE Deserialization	High8.8	—	2.0%	Aug 11, 2026

CVE-2026-65660
66This week
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 8.8KEVWeaponizedEPSS 2%
- RCE
microsoft · sharepoint serverAug 11, 2026
CVE-2026-68820
58Plan
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
HighCVSS 7.0KEVWeaponizedEPSS 0%
- Local privilege escalation
- Memory safety
microsoft · windows 10 1607Aug 11, 2026
CVE-2026-59124
39Monitor
Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
- Deserialization
microsoft · windows appAug 11, 2026
CVE-2026-62815
39Monitor
Microsoft QUIC Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 11 23h2Aug 11, 2026
CVE-2026-62878
39Monitor
Windows DNS Server Remote Code Execution Vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Aug 11, 2026
CVE-2026-62893
39Monitor
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Aug 11, 2026
CVE-2026-65768
39Monitor
Microsoft Teams Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Path traversal
microsoft · teamsAug 11, 2026
CVE-2026-65791
39Monitor
Windows iSCSI Target Service Remote Code Execution Vulnerability
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
microsoft · windows 10 1607Aug 11, 2026
CVE-2026-57104
38Monitor
Azure Storage Explorer Elevation of Privilege Vulnerability
CriticalCVSS 9.6No exploitEPSS 1%
- Pre-auth
- XSS
microsoft · azure storage explorerAug 11, 2026
CVE-2026-50516
37Monitor
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
CriticalCVSS 9.4No exploitEPSS 1%
- Pre-auth
- Auth bypass
microsoft · azure kubernetes serviceAug 11, 2026
CVE-2026-70306
37Monitor
Microsoft Office SharePoint Spoofing Vulnerability
CriticalCVSS 9.3No exploitEPSS 1%
- Pre-auth
- XSS
microsoft · sharepoint serverAug 11, 2026
CVE-2026-63514
36Monitor
Microsoft SharePoint Server Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Deserialization
microsoft · sharepoint serverAug 11, 2026

+388 moreAll records of the vendor

Adobe · August 11

52 · 1 KEV · 6 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
92Now	CVE-2026-71362Weaponized	Adobe Commerce \| Incorrect Authorization (CWE-863)adobe · commerce · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.1	KEV	87.5%	Aug 11, 2026
41Plan	CVE-2026-48362No exploit	ColdFusion \| Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)adobe · coldfusion · CWE-78 pre-auth RCE Command injection	Critical10.0	—	3.5%	Aug 11, 2026
40Plan	CVE-2026-27302No exploit	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)adobe · campaign · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical10.0	—	1.2%	Aug 11, 2026
40Plan	CVE-2026-71398No exploit	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)adobe · campaign · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical10.0	—	1.2%	Aug 11, 2026
38Monitor	CVE-2026-71384No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.5%	Aug 11, 2026
36Monitor	CVE-2026-48381No exploit	Adobe Campaign Classic (ACC) \| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)adobe · campaign · CWE-89 pre-auth RCE SQL injection	Critical9.0	—	0.8%	Aug 11, 2026
35Monitor	CVE-2026-71386No exploit	ColdFusion \| Cross-site Scripting (XSS) (CWE-79)adobe · coldfusion · CWE-79 pre-auth RCE XSS	High8.8	—	0.6%	Aug 11, 2026
35Monitor	CVE-2026-71387No exploit	ColdFusion \| Incorrect Authorization (CWE-863)adobe · coldfusion · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.5%	Aug 11, 2026
34Monitor	CVE-2026-21273No exploit	ColdFusion \| Improper Input Validation (CWE-20)adobe · coldfusion · CWE-20	High8.7	—	0.9%	Aug 11, 2026
34Monitor	CVE-2026-48397No exploit	Lightroom Classic \| Deserialization of Untrusted Data (CWE-502)adobe · lightroom · CWE-502 RCE Deserialization	High8.6	—	1.0%	Aug 11, 2026
34Monitor	CVE-2026-48413No exploit	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)adobe · commerce · CWE-79 XSS	High8.7	—	0.7%	Aug 11, 2026
34Monitor	CVE-2026-48414No exploit	Adobe Commerce \| Cross-site Scripting (Stored XSS) (CWE-79)adobe · commerce · CWE-79 XSS	High8.7	—	0.3%	Aug 11, 2026

CVE-2026-71362
92Now
Adobe Commerce | Incorrect Authorization (CWE-863)
CriticalCVSS 9.1KEVWeaponizedEPSS 88%
- Pre-auth
- Broken access control (IDOR)
adobe · commerceAug 11, 2026
CVE-2026-48362
41Plan
ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
CriticalCVSS 10.0No exploitEPSS 4%
- pre-auth RCE
- Command injection
adobe · coldfusionAug 11, 2026
CVE-2026-27302
40Plan
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Broken access control (IDOR)
adobe · campaignAug 11, 2026
CVE-2026-71398
40Plan
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Broken access control (IDOR)
adobe · campaignAug 11, 2026
CVE-2026-71384
38Monitor
ColdFusion | Incorrect Authorization (CWE-863)
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
adobe · coldfusionAug 11, 2026
CVE-2026-48381
36Monitor
Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
CriticalCVSS 9.0No exploitEPSS 1%
- pre-auth RCE
- SQL injection
adobe · campaignAug 11, 2026
CVE-2026-71386
35Monitor
ColdFusion | Cross-site Scripting (XSS) (CWE-79)
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
- XSS
adobe · coldfusionAug 11, 2026
CVE-2026-71387
35Monitor
ColdFusion | Incorrect Authorization (CWE-863)
HighCVSS 8.8No exploitEPSS 1%
- pre-auth RCE
- Broken access control (IDOR)
adobe · coldfusionAug 11, 2026
CVE-2026-21273
34Monitor
ColdFusion | Improper Input Validation (CWE-20)
HighCVSS 8.7No exploitEPSS 1%
adobe · coldfusionAug 11, 2026
CVE-2026-48397
34Monitor
Lightroom Classic | Deserialization of Untrusted Data (CWE-502)
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Deserialization
adobe · lightroomAug 11, 2026
CVE-2026-48413
34Monitor
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
HighCVSS 8.7No exploitEPSS 1%
- XSS
adobe · commerceAug 11, 2026
CVE-2026-48414
34Monitor
Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
HighCVSS 8.7No exploitEPSS 0%
- XSS
adobe · commerceAug 11, 2026

+40 moreAll records of the vendor

SAP · August 11

1 · 0 KEV · 1 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-58231Proof of concept	Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)sap_se · sap commerce cloud (data hub adapter) · CWE-94 pre-auth RCE	Critical10.0	—	0.9%	Aug 11, 2026

CVE-2026-58231
40Plan
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
CriticalCVSS 10.0Proof of conceptEPSS 1%
- pre-auth RCE
sap_se · sap commerce cloud (data hub adapter)Aug 11, 2026

All records of the vendor

Siemens · August 11

17 · 0 KEV · 1 critical

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-58115No exploit	A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Nodsiemens · simatic iot2050 advanced · CWE-306 pre-auth RCE Auth bypass	Critical10.0	—	1.0%	Aug 11, 2026
34Monitor	CVE-2026-69109No exploit	A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3).siemens · siemens license server (sls) · CWE-35 Pre-auth Path traversal	High8.7	—	0.6%	Aug 11, 2026
33Monitor	CVE-2026-69108No exploit	A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1).siemens · siemens license server (sls) · CWE-732 RCE Local privilege escalation	High8.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50058No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-125 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50059No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-787 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50060No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-416 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50061No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-416 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50062No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-125 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50063No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-125 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-50064No exploit	A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update siemens · solid edge se2025 · CWE-787 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-59086No exploit	A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606).siemens · simcenter femap · CWE-121 Memory safety	High7.3	—	0.2%	Aug 11, 2026
29Monitor	CVE-2026-59700No exploit	A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001).siemens · simcenter femap · CWE-125 Memory safety	High7.3	—	0.2%	Aug 11, 2026

CVE-2026-58115
40Plan
A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4.1 running Industrial OS with Nod
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
siemens · simatic iot2050 advancedAug 11, 2026
CVE-2026-69109
34Monitor
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3).
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Path traversal
siemens · siemens license server (sls)Aug 11, 2026
CVE-2026-69108
33Monitor
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1).
HighCVSS 8.3No exploitEPSS 0%
- RCE
- Local privilege escalation
siemens · siemens license server (sls)Aug 11, 2026
CVE-2026-50058
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50059
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50060
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50061
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50062
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50063
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-50064
29Monitor
A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · solid edge se2025Aug 11, 2026
CVE-2026-59086
29Monitor
A vulnerability has been identified in Simcenter Femap (All versions < V2606), Simcenter Nastran (All versions < V2606).
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · simcenter femapAug 11, 2026
CVE-2026-59700
29Monitor
A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001).
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
siemens · simcenter femapAug 11, 2026

+5 moreAll records of the vendor

Schneider Electric · August 11

0 · 0 KEV · 0 critical

No records in this window.