Microsoft August 2026 Patch Tuesday: 421 CVEs, Active Exploitation, and Critical SharePoint RCE — Prioritization and Detection Guide

Microsoft's August 2026 Patch Tuesday publishes fixes for 421 vulnerabilities, including 236 in Windows alone. While that's a step down from last month's record-breaking release, it remains one of the largest Patch Tuesday totals in history — and there is no indication Microsoft will return to the lower monthly volumes we saw before 2026. If your patch management program was built around 80–120 CVEs per month, it is now structurally undersized for reality.

Three facts from this release demand immediate attention:

1. One vulnerability published today is confirmed exploited in the wild. Treat it as a zero-day until your fleet is patched.
2. Two additional vulnerabilities were publicly disclosed before patches shipped, giving attackers a head start on weaponization. Notably, Microsoft's own "Notable CVEs" section in the Security Update Guide omits one of these — do not rely solely on Microsoft's highlighting to build your priority list.
3. SharePoint receives a critical remote code execution fix. SharePoint remains one of the most consistently targeted enterprise surfaces for initial access, and a critical RCE in it belongs at the top of every remediation queue.

Curiously, Microsoft has not published desktop browser security patches so far this month — unusual, but not a reason to relax. Browser CVEs are excluded from the 421 count regardless, and Edge/Chrome updates typically land out of band.

This post gives you a defensible prioritization model, detection content for post-exploitation behavior against SharePoint and Windows, and a verification script to confirm patch deployment.

Technical Analysis

What's in the Release

• Total CVEs: 421
• Windows CVEs: 236 (the dominant share of the release)
• Exploited in the wild: 1 CVE (Microsoft-confirmed)
• Publicly disclosed pre-patch: 2 CVEs
• SharePoint: Critical remote code execution
• Browsers: No desktop browser security patches published at time of writing

Because Microsoft's summary-level guidance underreports at least one of the publicly disclosed issues, defenders should pull the full Security Update Guide data programmatically (the CVRF/API feed) rather than trusting the rendered "Notable" views.

Why the SharePoint RCE Is Your First Priority

SharePoint exploitation follows a well-worn attack chain that every SOC should have detections for:

1. Initial access: Unauthenticated or weakly authenticated HTTP request to a vulnerable SharePoint endpoint reaches the IIS worker process (w3wp.exe) hosting the SharePoint application pool.
2. Code execution: The vulnerability executes attacker-controlled code in the context of the SharePoint service account — frequently a highly privileged account with broad farm and database access.
3. Post-exploitation: Attackers almost universally pivot to command execution (cmd.exe, powershell.exe), web shell deployment into the SharePoint LAYOUTS or TEMPLATE directories, and credential harvesting from the server.
4. Lateral movement: SharePoint servers sit deep inside the network, domain-joined, with trusted paths to SQL backends and file shares.

The exploitation requirement that matters to defenders: the vulnerable component is reachable over HTTP/HTTPS from wherever your SharePoint is exposed — and many organizations still expose SharePoint on-premises to the internet for hybrid collaboration scenarios.

The Exploited-in-the-Wild Windows CVE

With 236 Windows CVEs and one already being used by attackers, assume the exploited bug is in a widely deployed component. Historically, in-the-wild Patch Tuesday issues cluster in the Windows Kernel, the Windows Scripting Engines, MSHTML, NTLM/auth paths, and CLFS — privilege escalation chains that pair with an initial access vector. Until Microsoft and CISA publish full details (expect a CISA KEV addition with a three-week remediation deadline for federal civilian agencies, which you should adopt as your own SLA), the correct posture is: patch the exploited CVE everywhere, prioritizing internet-facing and Tier-0 assets.

Detection & Response

Patching takes time. Detection coverage is what protects you during the gap. The detections below target the highest-fidelity observable behavior from the SharePoint attack chain and generic post-exploitation on Windows servers — behaviors that hold regardless of which specific CVE is the entry point.

Sigma Rules

---
title: SharePoint IIS Worker Process Spawning Command Shell or PowerShell
id: 8f3c2a71-4b6d-4e9a-b2f1-7c5d9e0a3f48
status: experimental
description: Detects the SharePoint/IIS worker process (w3wp.exe) spawning command interpreters, a hallmark of post-exploitation following remote code execution against SharePoint. Legitimate SharePoint operation virtually never spawns cmd.exe or powershell.exe from w3wp.
references:
  - https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
  condition: selection
falsepositives:
  - Rare SharePoint administrative tooling or custom solutions that invoke scripts from the app pool — validate against the application pool identity and server role before tuning
level: critical
---
title: Web Shell Dropped Into SharePoint LAYOUTS or TEMPLATE Directories
id: 2d7e9b14-6a3f-4c8d-91e5-0b4a6c8d2f17
status: experimental
description: Detects creation of script files (.aspx, .asp, .ashx, .js) in SharePoint web-accessible directories, consistent with web shell deployment after exploitation of a SharePoint RCE.
references:
  - https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\Microsoft Shared\Web Server Extensions\'
      - '\TEMPLATE\LAYOUTS\'
      - '\TEMPLATE\CONTROLTEMPLATES\'
      - '\inetpub\wwwroot\wss\'
  selection_ext:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asp'
      - '.asmx'
      - '.js'
  condition: all of selection_*
falsepositives:
  - Legitimate SharePoint solution deployments (WSP installs) and custom branding — correlate with change windows and deployment accounts
level: high
---
title: Suspicious Child Process From IIS Worker Process Indicating Post-Exploitation Reconnaissance
id: 5b1f8c63-2e7a-4d49-83c6-9f0e2a5b7d31
status: experimental
description: Detects reconnaissance and discovery commands executed as children of w3wp.exe, typical of hands-on-keyboard activity after web application compromise, including SharePoint RCE exploitation.
references:
  - https://www.rapid7.com/blog/post/em-patch-tuesday-august-2026
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/08/11
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    CommandLine|contains:
      - 'whoami'
      - 'ipconfig'
      - 'net user'
      - 'net group'
      - 'net localgroup'
      - 'nltest'
      - 'quser'
      - 'systeminfo'
      - 'tasklist'
      - 'netstat'
  condition: selection
falsepositives:
  - Extremely rare in production; health-monitoring scripts on some legacy app pools — scope the rule to SharePoint servers for best fidelity
level: high

KQL — Microsoft Sentinel / Defender

This query hunts the SharePoint exploitation chain in Defender XDR data: IIS worker processes spawning shells or reconnaissance tooling, joined against recent file drops in SharePoint web directories. Run it across all SharePoint and IIS front-end servers for the past 14 days, and re-run it the moment Microsoft confirms which CVE is exploited in the wild.

let lookback = 14d;
let ShellProcs = dynamic(["cmd.exe","powershell.exe","pwsh.exe","mshta.exe","cscript.exe","wscript.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","net.exe","whoami.exe","nltest.exe"]);
let SuspiciousChildren =
    DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName =~ "w3wp.exe"
    | where FileName in~ (ShellProcs)
    | project ProcTime=Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, DeviceId;
let WebShellDrops =
    DeviceFileEvents
    | where Timestamp > ago(lookback)
    | where FolderPath has_any ("Web Server Extensions", "LAYOUTS", "CONTROLTEMPLATES", "wss")
    | where FileName endswith_cs ".aspx" or FileName endswith_cs ".ashx" or FileName endswith_cs ".asmx" or FileName endswith_cs ".asp"
    | project FileTime=Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessAccountName;
SuspiciousChildren
| join kind=leftouter (WebShellDrops) on DeviceName, SHA256
| project ProcTime, DeviceName, AccountName, FileName, ProcessCommandLine, WebShellPath=FolderPath, WebShellFile=FileName1, SHA256
| order by ProcTime desc;

For environments ingesting IIS logs into Sentinel (W3CIISLog), this companion query surfaces anomalous request patterns against SharePoint endpoints — bursts of POST requests to web service endpoints from single sources are a strong exploitation signal:

W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ("_vti_bin", "_layouts", "_api", "client.svc", ".aspx")
| where csMethod == "POST"
| summarize RequestCount = count(), DistinctUris = dcount(csUriStem), DistinctUserAgents = dcount(csUserAgent) by cIP, csSiteName, bin(TimeGenerated, 1h)
| where RequestCount > 100 or DistinctUris > 25
| order by RequestCount desc;

Tune the thresholds against your baseline — the goal is catching scanning/exploitation bursts, not legitimate user traffic.

Velociraptor VQL

Use this hunt artifact across your SharePoint and Windows server fleet to identify post-exploitation process trees and recently dropped script files in web-accessible paths — the two artifacts that survive even when attackers clean logs.

-- Hunt for post-exploitation indicators on SharePoint/IIS servers:
-- 1) w3wp.exe spawning shells or recon tools
-- 2) Recently created script files in SharePoint web directories
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Ppid IN (
    SELECT Pid FROM pslist() WHERE Name =~ '(?i)w3wp\.exe'
)
AND Name =~ '(?i)(cmd|powershell|pwsh|mshta|cscript|wscript|rundll32|certutil|net|whoami|nltest)\.exe'

-- Enumerate recent script file drops in SharePoint web-accessible paths (last 30 days)
SELECT FullPath, Size, Mtime, Atime, Ctime
FROM glob(globs=[
    'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/**/LAYOUTS/*.aspx',
    'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/**/LAYOUTS/*.ashx',
    'C:/Program Files/Common Files/Microsoft Shared/Web Server Extensions/**/CONTROLTEMPLATES/*.aspx',
    'C:/inetpub/wwwroot/wss/**/*.aspx'
])
WHERE Mtime > now() - (30 * 24 * 3600)
ORDER BY Mtime DESC

Any hit from the second query that does not map to a documented SharePoint solution deployment or patch installation is a triage candidate — pull the file, hash it, and check it against your threat intel and sandbox tooling.

Patch Verification and Triage Script

With 421 CVEs, "did it patch?" is a fleet-wide question, not a spot check. This PowerShell inventories installed August 2026 hotfixes, flags SharePoint servers for priority validation, and exports results for your vulnerability management platform.

# August 2026 Patch Tuesday verification — run elevated via your RMM/ConfigMgr/Intune
# Exports per-host patch state for the August 2026 cumulative window

$Aug2026Start = Get-Date '2026-08-11'
$results = @()

# 1) Hotfixes installed on/after August 2026 Patch Tuesday
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -ge $Aug2026Start }

# 2) Pending reboot check — patches installed but not active are not protection
$pendingReboot = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or
                 (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired')

# 3) SharePoint presence — prioritize these hosts for the critical RCE fix
$isSharePoint = $false
$spPaths = @(
    "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\16",
    "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions\15"
)
foreach ($p in $spPaths) { if (Test-Path $p) { $isSharePoint = $true } }

# 4) OS build for sanity-checking against August 2026 cumulative update baselines
$os = Get-CimInstance Win32_OperatingSystem
$ubr = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR

$results += [PSCustomObject]@{
    Hostname           = $env:COMPUTERNAME
    OSVersion          = "$($os.Version).$ubr"
    Aug2026HotfixCount = ($hotfixes | Measure-Object).Count
    LatestHotfix       = ($hotfixes | Sort-Object InstalledOn -Descending | Select-Object -First 1 -ExpandProperty HotFixID) -join ''
    PendingReboot      = $pendingReboot
    IsSharePointServer = $isSharePoint
    CheckedAt          = Get-Date -Format o
}

$results | Export-Csv -Path "C:\Windows\Temp\Aug2026-PatchState-$env:COMPUTERNAME.csv" -NoTypeInformation
$results | Format-List

# SharePoint servers: also confirm the farm build after the August 2026 security update
if ($isSharePoint) {
    Write-Host '[!] SharePoint detected — validate farm build against the August 2026 security update baseline.'
    Get-ChildItem "$env:CommonProgramFiles\Microsoft Shared\Web Server Extensions" -ErrorAction SilentlyContinue |
        Select-Object FullName, LastWriteTime
}

Any host reporting PendingReboot = $true or Aug2026HotfixCount = 0 forty-eight hours after deployment begins is a remediation escalation, not a ticket to age.

Remediation

1. Patch the exploited-in-the-wild CVE first, everywhere. Until Microsoft and CISA publish specifics, apply the full August 2026 cumulative update — the exploited fix rides inside it. Expect a CISA KEV entry with a ~3-week federal deadline; adopt that as your internal SLA. Check CISA KEV daily this week: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
2. Patch SharePoint now. The critical RCE fix should not wait for a maintenance window if your SharePoint is reachable from the internet or broad internal segments. Follow the SharePoint security update guidance in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide) — note that SharePoint security updates are separate from OS cumulative updates and require farm build verification post-install. Run the Product Configuration Wizard / psconfig after applying SharePoint patches or the fix is not fully active.
3. Pull the full CVE list programmatically. Because the Security Update Guide's "Notable CVEs" view omitted one of the publicly disclosed issues, retrieve the complete CVRF/API feed and diff it against your asset inventory. Do not triage from blog summaries — including Microsoft's own.
4. Prioritize the two publicly disclosed CVEs alongside the exploited one. Public disclosure means working exploit code or technical detail is already circulating; weaponization is a matter of days, not months.
5. Workaround if you cannot patch SharePoint immediately: Remove or ACL internet exposure of on-premises SharePoint (place it behind a VPN/ZTNA gateway), restrict _vti_bin and web service endpoints at the WAF, and deploy the Sigma/KQL detections above while you schedule the patch. This is risk reduction, not remediation — the patch is the only fix.
6. Force reboots to completion. Cumulative updates are not active until restart. Build reboot compliance into your patch SLAs, especially on servers where teams habitually defer.
7. Don't wait on browser patches. No desktop browser security updates shipped this month so far — monitor for out-of-band Edge/Chrome releases and apply them on arrival rather than holding for the September cycle.
8. Reset your program's throughput assumptions. 300–420+ CVEs per month is the 2026 baseline. If your vulnerability management cycle still assumes monthly manual triage, automate ingestion (CVRF feed → CMDB → deployment rings) or you will fall permanently behind.

The Bottom Line

August 2026 is lighter than July's record release and still one of the biggest Patch Tuesdays ever shipped. The combination of one confirmed exploited CVE, two publicly disclosed issues (one quietly omitted from Microsoft's own highlights), and a critical SharePoint RCE means your first 72 hours should be spent on SharePoint, internet-facing Windows, and reboot enforcement — with detections live before patches finish rolling out.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub