The New Normal Gets a Number: 400 CVEs Now Counts as a Light Month.

August 2026 Patch Tuesday arrived today with roughly 400 CVEs, making it the second-largest release in Microsoft history and still a thirty percent decline from July. One zero-day is under active exploitation, a Windows WinSock driver flaw that researchers note fits historical nation-state tradecraft, and two more were publicly disclosed before patches shipped. The second half of the SharePoint unauthenticated remote code execution chain we have tracked since July landed on schedule as CVE-2026-63520. Adobe shipped its second twice-monthly cycle, Oracle closed out a record quarterly update, and the Glasswing 90-day report missed its second deadline, having failed to appear at Black Hat. The most important trend in the data this month is a quiet one: discovery volume has exploded all year, and zero-day exploitation has not followed it. We updated our monthly analysis with verified August data and the full April through July record.

This is the fifth edition of the Brinqa Research Team monthly vulnerability landscape analysis. For new readers, the background: on April 7, Anthropic announced Project Glasswing and Claude Mythos Preview, a model capable of autonomously finding and chaining zero-day vulnerabilities at a scale and speed that previously required elite human researchers. Access was restricted to a coalition of vetted defenders, roughly 50 organizations at launch, expanded to more than 200 across 15 countries by July, including critical infrastructure operators. The April edition covered the initial patch surge. May documented the new elevated floor. June recorded what was then the largest release in history. July nearly tripled that record and produced the vendor confession we had been waiting for, when Microsoft confirmed in writing that its MDASH AI discovery pipeline would drive permanently higher patch volumes, five days before shipping 570 core CVEs.

The July edition closed with one instruction: plan August as the compound event July was supposed to be. Most of that stack arrived on schedule. Oracle delivered the largest quarterly update in its history, Adobe ran its new twice-monthly cadence without a hitch, the SharePoint exploit chain completed exactly as forecast, and August Patch Tuesday itself would have been the largest release ever recorded in any month before July. What did not arrive, for the second consecutive edition, is the headliner. The Glasswing 90-day report missed its original early July target, then missed the close of the expanded disclosure window at Black Hat. The compound event happened. It just happened without the event everyone was watching for, which points to where the volume is actually coming from: the vendors themselves.

Here is the verified monthly data and what it means for your exposure management program.

The Numbers: The Second-Largest Release in History Feels Like a Slow Month

Each month we pull vendor advisory data and cross-reference it against independent analysis from Tenable, Qualys, Rapid7, CrowdStrike, BleepingComputer, SANS, and the Zero Day Initiative. The methodology spread that widened in July has not closed. BleepingComputer counts 400 CVEs released on the day, excluding fixes Microsoft shipped earlier in the month for Teams, Azure, Entra, Office, and Power Apps. Tenable counts 398, having excluded two MITRE-assigned CVEs in the TPM 2.0 reference implementation. SANS counts 418, and Qualys and SecurityWeek land on 421. Even the Critical count diverges: BleepingComputer and Tenable count 42, while ZDI, Qualys, and SANS count 62, reflecting different treatment of the same advisories. ZDI’s Dustin Childs, who has spent two decades getting these counts right, conceded publicly that between July’s revisions and the cloud fixes, precision has become guesswork. When the most experienced counter in the industry shrugs, precision has stopped being the point.

By product family, Windows absorbed 236 CVEs, Office roughly 196 across current and 2016 servicing streams, SharePoint 30, developer tools 26, Azure 17, and Exchange Server 7. Elevation of privilege led the release at 40.7% with remote code execution at 27.1% by Tenable’s breakdown. Two oddities stand out. Microsoft shipped zero Edge or Chromium CVEs this month, after 468 in July, a reminder that browser volume moves on Google’s cycle rather than Microsoft’s. And for trivia continuity from July’s Minecraft and Age of Empires entries, ZDI notes Minecraft is absent this month, though AMD Zen processor flaws and the TPM 2.0 reference implementation both make appearances.

The trendline through eight months of 2026 now reads:

Core counts follow BleepingComputer’s day-of-release methodology for month-over-month consistency. Tenable, SANS, and Qualys counts for August (398, 418, and 421 respectively) reflect differing inclusion rules for MITRE-assigned CVEs and fixes released earlier in the month.

August declined thirty percent from July and still doubled June, which was itself the all-time record when it shipped nine weeks ago. It runs 4.8 times the Q1 monthly baseline of 84. The year-to-date core total now stands at roughly 1,708, which passed Microsoft’s previous full-year record of 1,245 sometime in mid July with five months of 2026 remaining. Tenable’s Satnam Narang projected in July that Microsoft could exceed two thousand and potentially three thousand CVEs this year, and the August number keeps that pace. When the second-largest release in history lands and the operational mood across the industry is closer to relief than alarm, the old baseline is simply gone.

The Trend That Matters: Discovery Exploded. Exploitation Did Not.

This series has spent five months documenting the volume curve, and the more interesting curve sits underneath it. Childs made the observation directly in his August review, writing that “this volume of updates indeed seems to be the new normal” while noting something the panic headlines have missed: the explosion in bugs being reported and fixed has produced no equivalent increase in bugs being actively exploited as zero-days. The August data bears him out. One actively exploited flaw out of roughly 400. July had two out of 570. May had none at all. Across the five releases since the Glasswing announcement, monthly volume ran 167, 120, 200, 570, and 400, while actively exploited zero-days in those same releases ran two, zero, one, two, and one.

That is the strongest evidence yet for the position this series has argued since April. The AI discovery engines at Microsoft, Oracle, Adobe, and the Glasswing coalition are finding vulnerabilities orders of magnitude faster than attackers are using them in real attacks, at least so far. Independent tracking supports the pattern: VulnCheck’s first-half 2026 exploitation report found roughly 200 CVEs reaching the KEV catalog within 31 days of publication, steady against prior periods despite the surge in supply. The caution is that the capability exists even where the usage does not. Anthropic’s own red team produced working exploits for 13 of 14 flaws Microsoft had rated unlikely to be exploited, so the flat trend reflects attacker adoption lag, not attacker inability, and adoption lag is not a defense. Narang made the same point in July when he cautioned that the surge reflects how good the tools have become at finding bugs rather than how many pose real risk. The implication for defenders cuts two ways. The reassuring half is that the thousand-CVE months are not thousand-fire months, and a program that can separate the exploited handful from the discovered mass is under far less pressure than the raw counts suggest. The uncomfortable half is that the separation itself is the work, the haystack is growing faster than the needles, and every needle that does appear, like this month’s WinSock flaw, arrives with less time to respond. Exposure management was always about finding the signal. The noise floor has risen roughly fivefold since spring.

One Exploited Zero-Day, Two Public Disclosures, and a Nation-State Signature

• CVE-2026-68820: Windows Ancillary Function Driver for WinSock (afd.sys) elevation of privilege, CVSS 7.0, rated only Important, and under active exploitation. A use-after-free race condition lets a locally authenticated attacker gain SYSTEM privileges with no user interaction. Tenable’s Satnam Narang notes that historical tradecraft against afd.sys flaws points toward nation-state actors, and Microsoft has shared no detail on the observed attacks. Two further elevation of privilege flaws in the same driver were patched alongside it, suggesting the fix came with a sweep of the surrounding code. The series pattern holds for a fifth straight month: the exploited flaw is never the highest-scored flaw, and an Important-rated 7.0 is once again the single most urgent item in the release.
• CVE-2026-62832: Publicly disclosed before patches shipped, with Microsoft assessing exploitation as likely to follow. Public disclosure ahead of a fix compresses the window between patch availability and working exploit code, so this belongs in the first deployment ring even without confirmed attacks.
• CVE-2026-72971: A link-following tampering flaw in the Windows Container Isolation file system filter driver (unionfs.sys), CVSS 5.5, publicly disclosed, affecting Windows 11 version 26H1. Microsoft assesses exploitation as unlikely, and for once we have no quarrel with the assessment, though container infrastructure operators should note the attack surface.

The SharePoint Chain Closes, Exactly as Forecast

In July we wrote that the most consequential fix in that release might be a security feature bypass, because it broke the first half of an unauthenticated remote code execution chain whose second half would not be patched until August. That second half arrived today. CVE-2026-63520, CVSS 8.1, is an unsafe .NET type instantiation flaw in SharePoint’s Business Connectivity Services, disclosed jointly by Microsoft and Rapid7, whose researcher Stephen Fewer built the full chain for Pwn2Own Berlin. Chained with July’s JWT authentication bypass (CVE-2026-55040), it yields full remote code execution against on-premises SharePoint Server 2016, 2019, and Subscription Edition with no credentials whatsoever. Reporting on the disclosure also describes the research itself as AI-assisted, meaning the defenders’ tooling arms race is running on both sides of the disclosure table.

The operational lesson is the one we flagged last month, now with its proof attached. Organizations that patched July’s 55040 broke the chain a full month before the RCE half was even public, which is precisely why authentication bypasses deserve better treatment than their severity labels suggest. Organizations that deferred July’s SharePoint fixes now face both halves of a fully documented chain at once, with Rapid7’s thirty-day technical embargo from July 14 expiring imminently and full technical details expected within days. SharePoint absorbed 30 CVEs this month on top of July’s record, it remains the platform where two of the past sixty days’ exploited zero-days lived, and CISA’s hardening guidance from July still applies. If your on-premises SharePoint estate is not fully current within this deployment window, treat it as your most exposed asset.

Notable Vulnerabilities Beyond the Headliners

• CVE-2026-62893, Windows Deployment Services TFTP Server RCE. A ZDI-submitted flaw allowing unauthenticated code execution over UDP port 69 against any WDS server serving Windows Imaging Format files, which is to say the standard PXE boot scenario in most enterprises. The port should be blocked at the perimeter, but ZDI’s analysis flags the realistic risk as lateral movement inside the network, where PXE infrastructure is rarely segmented from the clients it serves.
• CVE-2026-62878 and CVE-2026-62815, DNS Server and Microsoft QUIC RCEs. Critical, network-reachable code execution on core Windows networking infrastructure, continuing a monthly pattern of DNS, DHCP, and now QUIC flaws that make internal network services a standing patch priority rather than an afterthought behind the perimeter.
• CVE-2026-62911, Exchange Server elevation of privilege. One of seven Exchange fixes this month. After July’s OWA stored cross-site scripting and the year’s running pattern of identity and mail infrastructure exploitation, Exchange stays in the accelerated ring.
• The AI tooling cluster, month four. GitHub Copilot and Visual Studio Code fixes continue the thread we opened in May, alongside Dynamics 365 Business Central. The volume is smaller than July’s cluster, but the category is now a permanent fixture of the patch stream, and programs that have not yet added Copilot clients, IDE extensions, and agentic infrastructure to their inventories are accumulating the same invisible surface we warned about in June.
• CVE-2026-6726 and CVE-2026-6727, TPM 2.0 reference implementation. Spoofing and information disclosure flaws in code Microsoft ships but MITRE assigned, which is why they appear in some counts and not others. Hardware trust anchors making Patch Tuesday appearances is a trend worth keeping half an eye on.

What the Security Industry Is Saying

Zero Day Initiative, Dustin Childs (August 11, 2026): Back from what he called Hacker Summer Camp with a new outlook on patch density, Childs declared this volume of updates the new normal, at least for now, and made the month’s sharpest analytical point: the explosion in reported and fixed bugs has produced no equivalent rise in active zero-day exploitation. He also noted that even Linus Torvalds has taken to describing huge updates as the new normal, and conceded that between July’s revisions and cloud fixes, a precise count has become anyone’s guess. Eight of the month’s bugs came through the ZDI program.

Tenable, Satnam Narang, Senior Staff Research Engineer (August 11, 2026): Narang flagged the exploited WinSock driver flaw as consistent with historical nation-state tradecraft against afd.sys, a driver with a long exploitation pedigree. Tenable’s count of 398 came with the transparency note that it excludes the two MITRE-assigned TPM CVEs, the kind of methodology footnote that has become mandatory this year.

Rapid7, Stephen Fewer and team (August 11, 2026): Rapid7 completed its coordinated two-cycle disclosure of the SharePoint chain, documenting how the July authentication bypass fix pre-emptively broke the unauthenticated RCE chain completed by today’s CVE-2026-63520. The firm’s July observation stands as the year’s thesis statement: exploding vulnerability report counts, with remediations arriving as a trailing indicator.

Action1 (August 2026): Action1’s analysis argued that this cycle is less about counting patches than about quickly identifying which vulnerabilities create the greatest exposure and deploying the highest-risk fixes first, which is as close as the patch management industry has come to writing this series’ thesis into its own release notes.

Ivanti, Todd Schell (August 7, 2026 forecast): Schell’s pre-release forecast asked how teams deal with the patch apocalypse now that it is standing policy, and flagged the lifecycle clock that matters next: Windows 11 version 24H2 reaches end of servicing on October 13, with 23H2 following in November, adding migration workload to teams already absorbing record patch volume.

The Four Weeks Between the Releases: The Rest of the Stack Arrived on Schedule

The July edition predicted that the weeks before this release would stack vendor events on top of the still-pending Glasswing wave, and the vendor half of that stack delivered on schedule and at record scale.

Oracle’s July 21 Critical Patch Update was the largest in the company’s history: 1,449 security patches, which Tenable maps to 1,235 unique CVEs and Oracle itself describes as 1,434 unique CVEs across 334 products, with the difference reflecting counting rules for third-party components. Roughly 600 of the patched flaws are remotely exploitable without authentication, 261 patches carry critical severity, and E-Business Suite alone absorbed 410 patches with Fusion Middleware close behind at 355. The detail that matters most for this series came from SecurityWeek’s analysis: external researchers were credited for only a few dozen of the findings, meaning the overwhelming majority were discovered internally, very likely with AI assistance. Oracle has now joined Microsoft in shipping AI-scale discovery output, whether or not it uses the word.

Adobe’s first fourth-Tuesday release landed July 28 as promised, covering Bridge, Format Plugins, and other Creative Cloud components with critical arbitrary code execution fixes and no known exploitation. The cadence change itself is the story. Adobe’s own announcement was unusually direct about the cause, stating that “twice-monthly bulletins will enable us to keep pace with the era of frontier AI” and that a once-monthly window is no longer fast enough to stay ahead of adversaries. Today Adobe ran its second-Tuesday cycle again, a smaller release led by ColdFusion and Campaign Classic fixes that Adobe urged customers to patch immediately, with the next fourth-Tuesday installment due August 25. Elsewhere on the same day, SAP patched critical code injection and memory corruption flaws, Zoom fixed a zero-click code execution vulnerability, and Check Point warned of an actively exploited SmartConsole zero-day, a reminder that the cross-vendor pattern of edge, identity, and management-plane exploitation has not paused while Microsoft absorbs the headlines.

One cross-vendor data point comes courtesy of ZDI’s newly launched monthly Apple review: Apple shipped 37 CVEs in June and 210 in July, a nearly sixfold jump in a single month, with ZDI observing that Apple is not immune to the same discovery surge affecting everyone else. Apple is also reportedly weighing the same split-cadence approach Adobe adopted. The structural numbers we have cited since May remain the operating reality: Qualys found 88% of critical actively weaponized vulnerabilities were remediated slower than attackers exploited them, CrowdStrike’s fastest recorded breakout stands at 27 seconds, and Google M-Trends puts average time-to-exploit for the most serious flaws at minus seven days.

The Glasswing Watch: Two Deadlines Down, and the Skeptics Get Their Innings

The 90-day public report Anthropic committed to at Glasswing’s April launch has now missed two windows. It did not appear at its original early July target, which the July edition recorded, and it did not appear at the close of the expanded disclosure window around Black Hat on August 5 and 6, which most observers treated as the natural venue. As of publication, no report has been released. What did happen during the window is quieter and possibly more important: Red Hat published a customer FAQ confirming it is actively analyzing disclosed Glasswing findings for impact across RHEL and OpenShift, staging behavior that suggests vendors are preparing for disclosures they can see coming through coordinated channels even while the public summary stays unpublished.

While the report has been pending, the independent data quantifying the wave has improved considerably. Epoch AI’s analysis found that in June, 21 notable organizations published roughly 1,500 high- and critical-severity CVEs, more than 3.5 times the monthly record from before Mythos was announced. That is third-party measurement rather than vendor claim, and it confirms from outside the Microsoft ecosystem what our trendline shows from inside it. Anthropic’s own disclosure dashboard, as of its May update, showed 1,596 vulnerabilities disclosed across 281 open-source projects, of which 97 were known patched, set against more than 10,000 high- or critical-severity findings across partners. Coverage has consistently noted that fewer than one percent of discovered vulnerabilities have been patched, and Anthropic itself has acknowledged that overloaded maintainers asked it to slow disclosure.

Critics of Glasswing have a stronger case than they did in the spring, and it is worth taking seriously. Security expert Bruce Schneier called the program a “fantastic PR move” back in June, and his argument is simple: Anthropic’s AI is finding flaws far faster than anyone can fix them, and every flaw that is found but not yet fixed is a known hole that attackers could find too. On that view, the program is making software less safe in the short term, not more. Two missed report deadlines make that argument harder to dismiss, whatever you think of Anthropic’s intentions. That said, the critics have not been proven right on everything. The big fear was that attackers would start using AI-discovered flaws in real attacks, and the exploitation numbers show that has not happened so far. For your program, none of this debate changes what to do. The flaws are real, the timing of their disclosure is out of your hands, and major vendors are already preparing. When the held-back findings are finally published, expect months that look like July. Plan your capacity for that now, and when the report eventually arrives, read it as a schedule of what is coming rather than as news.

The Instinct to Add More Scanners Is Still Wrong, and August Is the Cleanest Proof Yet

Your scanners answer one question: what vulnerabilities exist in my environment? The question your team actually needs answered is which of these represent real, exploitable risk to my business right now, with my compensating controls, against my most critical assets.: which of these represent real, exploitable risk to my business right now, with my compensating controls, against my most critical assets. August separates those two questions more cleanly than any month this year: the release contains roughly 400 findings and exactly one confirmed fire. The exploited flaw is an Important-rated 7.0 that outranks all 42, or 62, Criticals depending on whose count you prefer, and even that disagreement between professional counting houses makes the point. An 8.1 SharePoint flaw matters more than most of the Criticals because it completes a publicly documented chain with an embargo about to lift. A publicly disclosed flaw with no observed exploitation belongs in the first ring anyway because disclosure compresses the exploit timeline. And the month’s one truly new risk, the WDS TFTP flaw, hides behind a protocol most asset inventories do not even track. Severity scores alone get every one of those calls wrong. It takes environmental context to get them right, and at one fire per four hundred findings, a program that cannot make that separation automatically is not doing four hundred units of useful work.

Where Brinqa Fits in This Environment

This is where Continuous threat exposure management (CTEM) does the work: turning a record volume of findings into a program that stays operational instead of overwhelming.turning a record volume of findings into a program that stays operational instead of overwhelming. Brinqa’s CyberRisk Graph™ normalizes findings from across your scanner ecosystem, including Tenable, Qualys, Rapid7, CrowdStrike, Microsoft Defender, and 260+ other sources, and correlates them against asset context, business criticality, compensating controls, and real-world exploit intelligence. That correlation is what turns a record month into a prioritized, defensible work queue.

AI-powered deduplication at ingestion. When August delivers roughly 400 Microsoft CVEs whose count varies by more than twenty depending on the source, and your scanners each report overlapping subsets, Brinqa’s AI Deduplication Agent consolidates findings into unified exposure records with confidence scoring, so five tools flagging CVE-2026-68820 produce one prioritized exposure instead of five tickets.

Context-aware prioritization. The exploited 7.0 on every Windows endpoint outranks the unexploited Criticals, and the 8.1 SharePoint chain-completer on an internet-facing farm outranks both. Brinqa’s AI layer weighs exploitability, reachability, and mitigating controls so teams work in that order without a human re-deriving it from forty advisories.

Ownership inference. At this volume, findings without owners are findings without remediation. Brinqa’s inference capability analyzes patterns across exposure and asset data to identify likely owners for unassigned findings, closing a routing gap manual triage cannot close at four hundred CVEs a month.

SmartFlow-driven remediation routing. Findings route automatically to the right teams with context, SLA enforcement, and escalation, the operational answer when 88% of critical exploited flaws are remediated slower than attackers move and vendor deployment guidance is now measured in days.

Five Recommendations Before the September Window

1. Patch the WinSock zero-day and both SharePoint fixes first, in the same emergency change.

CVE-2026-68820 is being exploited right now, and the affected driver ships with every supported version of Windows, so this fix applies to essentially every Windows machine you own. The SharePoint situation is just as urgent: full technical details of the attack chain become public when Rapid7’s thirty day embargo ends this week. Patch both, check your logs for signs that someone has already used the WinSock flaw to gain higher privileges, and confirm every on-premises SharePoint server carries both the July fix and the August fix. Either fix on its own stops the full attack chain, but you need both to close the underlying holes.

2. Treat publicly disclosed flaws as if attacks have already started.

Two of this month’s three zero-days were made public before a patch existed, and Microsoft expects attackers to begin exploiting one of them, CVE-2026-62832. Once a flaw is public, the clock on working exploit code starts whether or not attacks have been observed yet. Deploy these fixes with your first wave, not on the normal monthly schedule.

3. Move your deployment and management systems up the priority list.

Several of this month’s most serious flaws sit on the plumbing that runs everything else. The Windows Deployment Services flaw is reachable with no password over a protocol most inventories do not track, the DNS and QUIC fixes cover core network services, and outside Microsoft, Check Point’s management console is under active attack. These systems rarely rank high on business criticality lists, yet they are exactly where attackers move sideways through a network. If you cannot say today which of your servers accept TFTP traffic, treat that gap as a problem in its own right.

4. Plan capacity around the real pattern: many findings, few fires.

The data now confirms it month after month. Discovery volume is permanently high, and Microsoft has said so in writing, but only a handful of flaws each month are actually being attacked. Build your process around that split: let automation handle the bulk, and point your people at the small set that is exploited, publicly disclosed, part of a known attack chain, or sitting on an exposed system. The measure that matters is simple. How long does it take, from the moment an exploitable flaw shows up in your environment, until it is confirmed fixed? If closing this month’s one exploited flaw takes as long as closing hundreds of routine ones, the automation is aimed at the wrong end.

5. Keep room in September for the disclosure wave that is now twice overdue.

Anthropic’s Glasswing report has missed two deadlines, disclosure embargoes keep expiring through the rest of the year, and Red Hat is already reviewing Glasswing findings against its products, a sign that vendors can see disclosures coming through private channels. Add Adobe’s next release on August 25 and the end of support for Windows 11 24H2 on October 13, which puts migration work on the same teams. August showed that the vendor pipelines alone can fill a record month. When the held-back findings finally land, they will land on top of that.

April tied the record. May confirmed the floor. June broke the record outright. July nearly tripled it and made the cause official. August is the first month of the new normal in operation: the second-largest release in history arrived, the industry processed it as a quiet month, and the one flaw that actually mattered carried a severity score that would not have made a top-forty list. The counting era ended this summer, and even the people who built their careers on counting say so. What replaces it is the discipline this series has argued for from the first edition: knowing which handful of the four hundred are reachable, exploited, chained, or exposed in your environment, and moving on those at machine speed while the rest flow through automation. The teams that internalize the two-curve reality, exploding discovery and stubbornly scarce exploitation, will spend the AI era patching efficiently. The teams that keep treating every CVE as equal will drown in a flood that was, in the end, mostly water.

We will publish the September edition on the next Patch Tuesday.

If you’re working through what AI-driven CVE volume means for your program, speak with a Brinqa Expert about where it stands today.

Meet with a Brinqa Expert

FAQs

SOURCES AND REFERENCES (UPDATED AUGUST 11, 2026)

1. BleepingComputer, Microsoft August 2026 Patch Tuesday Fixes 400 Flaws, 3 Zero-Days, August 11, 2026. 400 day-of-release CVEs; 42 Critical; one exploited and two publicly disclosed zero-days; earlier-month cloud fixes excluded. bleepingcomputer.com

2. Zero Day Initiative, The August 2026 Security Update Review, Dustin Childs, August 11, 2026. 62 Critical, 1 Moderate; new normal assessment; flat zero-day exploitation observation; WDS TFTP analysis; 8 ZDI submissions; Minecraft absent. zerodayinitiative.com

3. Tenable, Microsoft’s August 2026 Patch Tuesday Addresses 398 CVEs, August 11, 2026. 42 Critical, 355 Important, 1 Moderate; two MITRE-assigned TPM CVEs excluded; EoP 40.7%, RCE 27.1%; CVE-2026-68820 analysis. tenable.com

4. SecurityWeek, August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day, August 11, 2026. 421 total; product-family breakdown; Narang on afd.sys nation-state tradecraft; TPM 2.0 CVEs; Childs notable-CVE callouts. securityweek.com

5. Qualys, Microsoft Patch Tuesday, August 2026 Security Update Review, August 11, 2026. 421 CVEs, 62 critical; zero Edge/Chromium CVEs this month; product coverage including GitHub Copilot and VS Code. blog.qualys.com

6. SANS Internet Storm Center, Microsoft Patch Tuesday August 2026, August 11, 2026. 418 patches, 62 critical; CVE-2026-68820 and CVE-2026-72971 technical detail. isc.sans.edu

7. Action1, Patch Tuesday August 2026, August 11, 2026. 398 count; exposure-first prioritization commentary; CVE-2026-62832 public disclosure status. action1.com

8. The Hacker News, Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE, August 11, 2026. CVE-2026-63520 (CVSS 8.1) in Business Connectivity Services; chain mechanics with CVE-2026-55040; affected editions. thehackernews.com

9. Rapid7, CVE-2026-55040: Microsoft SharePoint JWT Token Authentication Bypass (FIXED), Stephen Fewer, updated August 2026. Two-cycle coordinated disclosure; chain-breaking rationale; 30-day technical embargo from July 14; Pwn2Own Berlin origin. rapid7.com

10. Qualys, Oracle Critical Patch Update, July 2026 Security Update Review, July 22, 2026, and Tenable, Oracle July 2026 CPU Addresses 1235 CVEs. 1,449 patches, largest CPU on record; 261 critical; E-Business Suite 410, Fusion Middleware 355. blog.qualys.com / tenable.com

11. SecurityWeek, Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates, July 2026. 1,434 unique CVEs across 334 products; roughly 600 unauthenticated remotely exploitable; few dozen external researcher credits. securityweek.com

12. Computerworld, Adobe Premieres a Second Patch Tuesday Each Month to Deliver Fixes Faster, July 2026. Adobe blog statement on twice-monthly cadence and frontier AI. computerworld.com

13. Adobe PSIRT, July 28 and August 11, 2026 security bulletins. Fourth-Tuesday debut (Bridge, Format Plugins); August ColdFusion and Campaign Classic critical fixes urged for immediate patching. helpx.adobe.com

14. SecurityWeek and BleepingComputer same-day coverage, August 11, 2026. SAP critical code injection and memory corruption fixes; Zoom zero-click patch; Check Point SmartConsole zero-day exploitation. securityweek.com / bleepingcomputer.com

15. ZDI, The July 2026 Apple Security Update Review, August 2026. Apple 37 CVEs in June versus 210 in July; cross-vendor surge confirmation. zerodayinitiative.com

16. Epoch AI, Disclosed CVEs: 3.5x Spike After Claude Mythos, updated July 2, 2026. Roughly 1,500 high- and critical-severity CVEs from 21 notable organizations in June, more than 3.5 times the pre-Mythos monthly record. epoch.ai

17. Red Hat Customer Portal, Navigating Mythos and Project Glasswing Findings, 2026. Active analysis of disclosed Glasswing findings across RHEL and OpenShift. access.redhat.com

18. Bruce Schneier, June 2026 commentary via Memeburn, Project Glasswing Explained. PR-move critique; discovery-to-patch gap; sub-1% patch rate. schneier.com / memeburn.com

19. Anthropic, Project Glasswing: An Initial Update, May 22, 2026. Disclosure dashboard figures; 10,000+ partner findings; maintainer overload. anthropic.com/research

20. Help Net Security, August 2026 Patch Tuesday Forecast, Todd Schell (Ivanti), August 7, 2026. patch apocalypse forecast question; Windows 11 24H2 end of servicing October 13, 2026. helpnetsecurity.com

21. CyberScoop, July 14, 2026 (Narang) and KrebsOnSecurity, July 14, 2026. Full-year projection of 2,000 to 3,000+ Microsoft CVEs against the 1,245 record of 2020; tool-effectiveness caution. cyberscoop.com / krebsonsecurity.com

22. VulnCheck, State of Exploitation 1H-2026, August 2026. Roughly 200 CVEs reached the KEV catalog within 31 days of publication in the first half of 2026, holding steady against prior periods; coverage of AI-discovered vulnerabilities. vulncheck.com

23. Qualys, The Broken Physics of Remediation, March 2026; CrowdStrike 2026 Global Threat Report; Google M-Trends 2026. Structural exploitation statistics cited series-wide.