August 2026 Patch Tuesday forecast: How do we deal with the patch apocalypse?

July 2026 Patch Tuesday was record-setting in so many ways. The sheer volume of security patches for almost every product in the Microsoft portfolio was the highest ever and, of course, well over 600 CVEs were identified in the Security Updates Guide.

Interestingly, only two CVEs were reported as exploited zero-days and only one as publicly disclosed, but we’ll get back to that later in this article. There were 405 CVEs reported against Windows 11 and Server 2025, and 337 logged for Windows 10 and its associated server versions. There were record numbers of CVEs for Microsoft SharePoint and Office, and also updates for SQL Server, Exchange Server, and .NET framework as well.

Did you catch the CVEs reported for Age of Empires and Minecraft Server? Many organizations are still struggling to test and deploy all these patches, and others are asking if there may be another wave coming next week.

The impact of AI on vulnerability identification is forcing IT administrators and security professionals to ask questions and drive changes in the patch management industry. Microsoft is even recommending a three-day turnaround on patching, with a two-day grace period to stay ahead of the ‘AI-accelerated’ threats as they continue to grow.

As you can imagine, this sparked a debate among several industry experts. They agree the threat will continue to grow but the challenge to meet a three-day requirement is that large enterprises are constrained by testing, change control, and compatibility requirements. That challenge needs to be addressed by building a process that can deploy patches in days for the vulnerabilities that matter most and stays disciplined with everything else.

Only a small fraction of disclosed vulnerabilities are ever confirmed as exploited in the wild. I mentioned in my introductory paragraph only three CVEs out of 600+ from July Patch Tuesday were known exploited or publicly disclosed, so there’s no need to focus heavily on all the other patches immediately or to treat every CVE as an emergency.

Focus on triaging the CVEs and patches accordingly, assessing your systems’ exposure to the highest vulnerabilities, testing as appropriate for the systems involved, and deploying in risk priority once you’ve completed your assessment. Traditional ring deployment included deployment of almost all patches starting with a small pilot group, then to less critical company systems, and finally installation organization wide.

The Patch Apocalypse requires a new approach with a more specific focus on risk:

• Identify the known exploited or internet facing vulnerabilities as the most critical
• Match those patches up with the systems in your organization that are at highest risk based on network location, data processed, business criticality, etc.
• Develop a quick test or an acceptance scenario to ensure the patches do not disrupt those systems. Once that is complete you can deploy this set and move on to the next set of lower priority systems. This approach is key to reducing risk in the Patch Apocalypse.

There were a few important items to note from this past month as we go into the August Patch Tuesday. If you are still catching up on deploying the updates from July, you should focus on getting the SharePoint patches out. The Microsoft Security Center announced that CVE-2026-50522, a remote code execution vulnerability, is now actively being exploited. Hackers can steal machine keys using this vulnerability and maintain access after the system is patched. With these keys, a remote attacker can execute code on the SharePoint system.

Speaking of hackers, the researcher, Nightmare Eclipse, is in the news again with a disclosed vulnerability being called LegacyHive. Per ACROS Security, ‘The vulnerability allows a regular non-admin user to mount any other user’s registry hive in full access mode, and then either access that user’s stored secrets or modify any values in their registry to affect what gets executed the next time they log in.’ This vulnerability in the Windows User Profile Service has been acknowledged by Microsoft and they are working on a fix. There is no CVE assigned yet, but this is one to look for in the upcoming August release.

And finally, if you have edge systems with outdated secure boot certificates, Microsoft has introduced some targeting improvements in the latest Windows 11 24H2 and 25H2 preview patch. This enhancement will ‘increase coverage’ of devices eligible to receive new Secure Boot certificates and should help you out next week with the cumulative updates.

There are several products reaching End of Servicing per Microsoft’s Modern Policy, meaning the continuous updates will cease and there is no extended support. Windows 11 Version 24H2 reaches End of Servicing in two months on October 13th, 2026. On November 10th, Windows 11 Version 23H2 Enterprise and Education Editions, as well as Windows 11 IoT Enterprise 23H2, will reach End of Servicing. Microsoft also announced the end of ESU support for Exchange Server 2016/2019 this October. The ESU support has been extended for a six-month period, but will not be extended again so plan accordingly per the announcement’s recommendations.

August 2026 Patch Tuesday forecast

• Microsoft has already said the large volume CVE trend will continue as AI identifies more vulnerabilities. With that already stated, we can expect another large set of updates with many new CVEs reported. I suspect Microsoft fixed a lot of the ‘low hanging fruit’ last month so maybe the number will be back to normal highs we’ve seen in the past. We may not see the entire portfolio updated but most of the products will receive updates again.
• Adobe had a small set of releases on July 28th for Format Plugins, Bridge, and the on-premise Campaign Classic. It’s hard to know what AI will find and Adobe will fix, but I would consider Photoshop, InCopy, InDesign, and Acrobat Reader high on the list of possibilities since they didn’t have updates in the last month.
• It’s unlikely Apple will release any updates next week. The last major release was on July 27th for macOS Tahoe 26.6, macOS Sequioa 15.7.8, and macOS Sonoma 14.8.9. These releases had large numbers of reported CVEs with Tahoe having 128 unique CVEs as an example. There was a minor release on August 6th with just CVE-2026-65400, a screen sharing vulnerability, addressed in each. Applying the latest patches will take care of the major release as well since they are cumulative.
• Google released Chrome Desktop 151.0.7922.108 for Windows on August 6th addressing 41 CVEs. They continue to release security updates weekly, but I suspect we see fewer CVEs with a minor update next week.
• It’s likely we’ll see Mozilla release some minor updates for Thunderbird and Firefox next week. The last major release was July 21st for Firefox and Thunderbird 153, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

Welcome to the patch apocalypse! Traditional patching based on vendor severity and flat CVSS values is rapidly being overcome by events. And those events are AI-driven.