Microsoft security updates
Microsoft Security Patch Roundup — Week of August 25, 2026
Official Microsoft Security Response Center updates published during the past week, collected for patch planning and review.
Published 25 August 2026 · RCW IT Training
Important: Review the linked Microsoft advisory, affected-product information and available mitigations before deployment. This roundup is an index of official notices, not a substitute for change testing or incident response guidance.
Official MSRC updates
- CVE-2026-70337 Microsoft PowerShell Remote Code Execution Vulnerability (25 Aug 2026)
- CVE-2026-62747 Windows Device Association Service Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-62728 Windows Common Log File System Driver Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-61939 Winlogon Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-59127 Windows Installer Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-55137 Microsoft Excel Remote Code Execution Vulnerability (25 Aug 2026)
- CVE-2026-50448 Windows NTFS Remote Code Execution Vulnerability (25 Aug 2026)
- CVE-2026-50333 Windows Spaceport.sys Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-49183 Windows Clipboard Server Elevation of Privilege Vulnerability (25 Aug 2026)
- CVE-2026-65787 Desktop Window Manager Elevation of Privilege Vulnerability (24 Aug 2026)
- CVE-2026-50661 Windows BitLocker Security Feature Bypass Vulnerability (24 Aug 2026)
- CVE-2026-47292 Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability (24 Aug 2026)
- CVE-2026-70335 GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability (21 Aug 2026)
- CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability (21 Aug 2026)
- CVE-2026-68801 Microsoft Excel Remote Code Execution Vulnerability (21 Aug 2026)
- CVE-2026-64903 Microsoft Office Remote Code Execution Vulnerability (21 Aug 2026)
- CVE-2026-64899 Microsoft Office Information Disclosure Vulnerability (21 Aug 2026)
- CVE-2026-58547 Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (21 Aug 2026)
- CVE-2026-55134 Microsoft Word Remote Code Execution Vulnerability (21 Aug 2026)
- CVE-2026-54981 Visual Studio Code Python Extension Security Feature Bypass Vulnerability (21 Aug 2026)
- CVE-2026-50466 Microsoft Brokering File System Elevation of Privilege Vulnerability (21 Aug 2026)
- CVE-2026-49183 Windows Clipboard Server Elevation of Privilege Vulnerability (21 Aug 2026)
- CVE-2026-32202 Windows Shell Spoofing Vulnerability (21 Aug 2026)
- CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (20 Aug 2026)
- CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (20 Aug 2026)
- CVE-2026-71331 Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability (20 Aug 2026)
- CVE-2026-70105 Microsoft Word Information Disclosure Vulnerability (20 Aug 2026)
- CVE-2026-69855 Microsoft Copilot in Azure Information Disclosure Vulnerability (20 Aug 2026)
- CVE-2026-69851 Microsoft Entra ID Elevation of Privilege Vulnerability (20 Aug 2026)
- CVE-2026-69836 Microsoft Entra ID Remote Code Execution Vulnerability (20 Aug 2026)
Recommended next steps
- Identify affected assets and confirm update applicability.
- Prioritise actively exploited or internet-facing risk according to your organisation’s process.
- Test patches in a representative ring, deploy in approved windows and verify service health.
- Record exceptions, mitigations and the next review date.