# KB5120386: August 2026 security update

KB5120386, released August 11, 2026, fixes 131 CVEs across 2 products. One of them is being exploited (CVE-2026-68820); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/microsoft/kb5120386
- Platform: Microsoft
- Released: Aug 11, 2026
- Priority: Patch now (Closes CVE-2026-68820, exploited (CISA KEV))
- CVEs: 131, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://support.microsoft.com/help/5120386

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [Windows Server 2012](https://patchblox.com/security/data/product/microsoft/windows-server-2012.md) |  |  |
| [Windows Server 2012 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2012-server-core-installation.md) |  |  |

## CVEs this fix closes

| CVE | Priority | Component | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-68820](https://patchblox.com/security/data/cve/CVE-2026-68820.md) | Patch now | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0857 | CISA KEV |
| [CVE-2026-59132](https://patchblox.com/security/data/cve/CVE-2026-59132.md) | Urgent | Windows TCP/IP | 7.5 | 0.0117 | More likely |
| [CVE-2026-62878](https://patchblox.com/security/data/cve/CVE-2026-62878.md) | Urgent | Windows DNS | 9.8 | 0.0097 |  |
| [CVE-2026-62893](https://patchblox.com/security/data/cve/CVE-2026-62893.md) | Urgent | Windows Deployment Services | 9.8 | 0.0097 | More likely |
| [CVE-2026-65791](https://patchblox.com/security/data/cve/CVE-2026-65791.md) | Urgent | Windows iSCSI Target Service | 9.8 | 0.0097 |  |
| [CVE-2026-62818](https://patchblox.com/security/data/cve/CVE-2026-62818.md) | Urgent | Active Directory Certificate Services (AD CS) | 8.8 | 0.0091 |  |
| [CVE-2026-62735](https://patchblox.com/security/data/cve/CVE-2026-62735.md) | Urgent | Windows HTTP.sys | 7.8 | 0.0087 | More likely |
| [CVE-2026-62822](https://patchblox.com/security/data/cve/CVE-2026-62822.md) | Urgent | Windows GDI+ | 8.8 | 0.0082 |  |
| [CVE-2026-62824](https://patchblox.com/security/data/cve/CVE-2026-62824.md) | Urgent | Remote Desktop Client | 8.8 | 0.0082 |  |
| [CVE-2026-62819](https://patchblox.com/security/data/cve/CVE-2026-62819.md) | Urgent | Windows Routing and Remote Access Service (RRAS) | 8.1 | 0.0071 |  |
| [CVE-2026-62889](https://patchblox.com/security/data/cve/CVE-2026-62889.md) | Urgent | Windows Secure Socket Tunneling Protocol (SSTP) | 8.1 | 0.0071 |  |
| [CVE-2026-65679](https://patchblox.com/security/data/cve/CVE-2026-65679.md) | Urgent | Windows iSCSI Target Service | 8.1 | 0.0071 |  |
| [CVE-2026-65796](https://patchblox.com/security/data/cve/CVE-2026-65796.md) | Urgent | Windows iSCSI Target Service | 8.1 | 0.0071 |  |
| [CVE-2026-62816](https://patchblox.com/security/data/cve/CVE-2026-62816.md) | Urgent | Reliable Multicast Transport Driver (RMCAST) | 8.8 | 0.0054 |  |
| [CVE-2026-62823](https://patchblox.com/security/data/cve/CVE-2026-62823.md) | Urgent | Windows DHCP Server | 8.8 | 0.0054 | More likely |
| [CVE-2026-62698](https://patchblox.com/security/data/cve/CVE-2026-62698.md) | Urgent | Microsoft Digest Authentication | 7.8 | 0.0033 | More likely |
| [CVE-2026-62712](https://patchblox.com/security/data/cve/CVE-2026-62712.md) | Urgent | Windows Win32K | 7.8 | 0.0033 | More likely |
| [CVE-2026-62741](https://patchblox.com/security/data/cve/CVE-2026-62741.md) | Urgent | Windows HTTP.sys | 7.8 | 0.0033 | More likely |
| [CVE-2026-62890](https://patchblox.com/security/data/cve/CVE-2026-62890.md) | Urgent | Windows GDI+ | 7.8 | 0.0033 |  |
| [CVE-2026-66799](https://patchblox.com/security/data/cve/CVE-2026-66799.md) | Urgent | Windows Key Guard | 7.8 | 0.0033 |  |
| [CVE-2026-61925](https://patchblox.com/security/data/cve/CVE-2026-61925.md) | Urgent | Windows Installer | 7.8 | 0.0030 | More likely |
| [CVE-2026-62721](https://patchblox.com/security/data/cve/CVE-2026-62721.md) | Urgent | User-Mode Power Service (UMPS) | 7.8 | 0.0030 | More likely |
| [CVE-2026-61348](https://patchblox.com/security/data/cve/CVE-2026-61348.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0026 | More likely |
| [CVE-2026-70307](https://patchblox.com/security/data/cve/CVE-2026-70307.md) | Urgent | Windows Ancillary Function Driver for WinSock | 7.0 | 0.0026 | More likely |
| [CVE-2026-54113](https://patchblox.com/security/data/cve/CVE-2026-54113.md) | High | Windows Kernel | 7.5 | 0.0117 |  |
| [CVE-2026-62784](https://patchblox.com/security/data/cve/CVE-2026-62784.md) | High | Microsoft Local Security Authority Server (lsasrv) | 8.8 | 0.0091 |  |
| [CVE-2026-62790](https://patchblox.com/security/data/cve/CVE-2026-62790.md) | High | Windows SMB Server | 8.8 | 0.0091 |  |
| [CVE-2026-49179](https://patchblox.com/security/data/cve/CVE-2026-49179.md) | High | Windows Active Directory | 8.8 | 0.0086 |  |
| [CVE-2026-62785](https://patchblox.com/security/data/cve/CVE-2026-62785.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 8.8 | 0.0082 |  |
| [CVE-2026-62795](https://patchblox.com/security/data/cve/CVE-2026-62795.md) | High | Windows LDAP - Lightweight Directory Access Protocol | 8.8 | 0.0082 |  |
| [CVE-2026-62781](https://patchblox.com/security/data/cve/CVE-2026-62781.md) | High | RPC Runtime | 8.1 | 0.0071 |  |
| [CVE-2026-62792](https://patchblox.com/security/data/cve/CVE-2026-62792.md) | High | Windows TCP/IP | 8.1 | 0.0071 |  |
| [CVE-2026-59134](https://patchblox.com/security/data/cve/CVE-2026-59134.md) | High | Remote Desktop Client | 7.5 | 0.0068 |  |
| [CVE-2026-61363](https://patchblox.com/security/data/cve/CVE-2026-61363.md) | High | Remote Desktop Client | 7.5 | 0.0068 |  |
| [CVE-2026-62787](https://patchblox.com/security/data/cve/CVE-2026-62787.md) | High | Windows DNS | 7.5 | 0.0066 |  |
| [CVE-2026-62778](https://patchblox.com/security/data/cve/CVE-2026-62778.md) | High | Windows DNS | 8.1 | 0.0054 |  |
| [CVE-2026-54984](https://patchblox.com/security/data/cve/CVE-2026-54984.md) | High | Windows Imaging Component | 7.8 | 0.0047 |  |
| [CVE-2026-61352](https://patchblox.com/security/data/cve/CVE-2026-61352.md) | High | Remote Desktop Client | 7.5 | 0.0047 |  |
| [CVE-2026-62776](https://patchblox.com/security/data/cve/CVE-2026-62776.md) | High | Windows DHCP Server | 7.8 | 0.0037 |  |
| [CVE-2026-62803](https://patchblox.com/security/data/cve/CVE-2026-62803.md) | High | Windows DHCP Server | 7.8 | 0.0037 |  |
| [CVE-2026-62807](https://patchblox.com/security/data/cve/CVE-2026-62807.md) | High | Windows DHCP Server | 7.8 | 0.0037 |  |
| [CVE-2026-62812](https://patchblox.com/security/data/cve/CVE-2026-62812.md) | High | Windows DHCP Server | 7.8 | 0.0037 |  |
| [CVE-2026-61353](https://patchblox.com/security/data/cve/CVE-2026-61353.md) | High | Windows Telephony Service | 7.8 | 0.0033 |  |
| [CVE-2026-61926](https://patchblox.com/security/data/cve/CVE-2026-61926.md) | High | Windows USB Driver | 7.8 | 0.0033 |  |
| [CVE-2026-61937](https://patchblox.com/security/data/cve/CVE-2026-61937.md) | High | Windows HTTP.sys | 7.8 | 0.0033 |  |
| [CVE-2026-62692](https://patchblox.com/security/data/cve/CVE-2026-62692.md) | High | Windows Remote Desktop Services | 7.8 | 0.0033 |  |
| [CVE-2026-62700](https://patchblox.com/security/data/cve/CVE-2026-62700.md) | High | Windows NTFS | 7.8 | 0.0033 |  |
| [CVE-2026-62701](https://patchblox.com/security/data/cve/CVE-2026-62701.md) | High | Windows Telephony Service | 7.8 | 0.0033 |  |
| [CVE-2026-62711](https://patchblox.com/security/data/cve/CVE-2026-62711.md) | High | Windows Win32K | 7.8 | 0.0033 |  |
| [CVE-2026-62717](https://patchblox.com/security/data/cve/CVE-2026-62717.md) | High | Windows Message Queuing | 7.8 | 0.0033 |  |
| [CVE-2026-62719](https://patchblox.com/security/data/cve/CVE-2026-62719.md) | High | Windows Message Queuing | 7.8 | 0.0033 |  |
| [CVE-2026-62732](https://patchblox.com/security/data/cve/CVE-2026-62732.md) | High | Windows Telephony Service | 7.8 | 0.0033 |  |
| [CVE-2026-62733](https://patchblox.com/security/data/cve/CVE-2026-62733.md) | High | Windows Win32K | 7.8 | 0.0033 |  |
| [CVE-2026-62754](https://patchblox.com/security/data/cve/CVE-2026-62754.md) | High | Windows Kerberos | 7.8 | 0.0033 |  |
| [CVE-2026-62755](https://patchblox.com/security/data/cve/CVE-2026-62755.md) | High | Windows DHCP Client | 7.8 | 0.0033 |  |
| [CVE-2026-62758](https://patchblox.com/security/data/cve/CVE-2026-62758.md) | High | Windows Remote Access Connection Manager | 7.8 | 0.0033 |  |
| [CVE-2026-62768](https://patchblox.com/security/data/cve/CVE-2026-62768.md) | High | Windows Installer | 7.8 | 0.0033 |  |
| [CVE-2026-62770](https://patchblox.com/security/data/cve/CVE-2026-62770.md) | High | Windows Shell | 7.8 | 0.0033 |  |
| [CVE-2026-62797](https://patchblox.com/security/data/cve/CVE-2026-62797.md) | High | Windows NTFS | 7.8 | 0.0033 |  |
| [CVE-2026-62876](https://patchblox.com/security/data/cve/CVE-2026-62876.md) | High | Windows Win32K | 7.8 | 0.0033 |  |
| [CVE-2026-62880](https://patchblox.com/security/data/cve/CVE-2026-62880.md) | High | Windows NTFS | 7.8 | 0.0033 |  |
| [CVE-2026-62885](https://patchblox.com/security/data/cve/CVE-2026-62885.md) | High | Windows Win32K | 7.8 | 0.0033 |  |
| [CVE-2026-65774](https://patchblox.com/security/data/cve/CVE-2026-65774.md) | High | Windows Installer | 7.8 | 0.0033 |  |
| [CVE-2026-65790](https://patchblox.com/security/data/cve/CVE-2026-65790.md) | High | Windows Message Queuing | 7.8 | 0.0033 |  |
| [CVE-2026-65814](https://patchblox.com/security/data/cve/CVE-2026-65814.md) | High | Windows Storage Port Driver | 7.8 | 0.0033 |  |
| [CVE-2026-70345](https://patchblox.com/security/data/cve/CVE-2026-70345.md) | High | Windows Installer | 7.8 | 0.0033 |  |
| [CVE-2026-70346](https://patchblox.com/security/data/cve/CVE-2026-70346.md) | High | Windows Installer | 7.8 | 0.0033 |  |
| [CVE-2026-70347](https://patchblox.com/security/data/cve/CVE-2026-70347.md) | High | Windows Installer | 7.8 | 0.0033 |  |
| [CVE-2026-42976](https://patchblox.com/security/data/cve/CVE-2026-42976.md) | High | Windows RPC API | 7.8 | 0.0030 |  |
| [CVE-2026-61364](https://patchblox.com/security/data/cve/CVE-2026-61364.md) | High | Windows Remote Desktop Services | 7.8 | 0.0030 |  |
| [CVE-2026-61365](https://patchblox.com/security/data/cve/CVE-2026-61365.md) | High | Windows Remote Desktop Services | 7.8 | 0.0030 |  |
| [CVE-2026-61367](https://patchblox.com/security/data/cve/CVE-2026-61367.md) | High | Windows Remote Desktop Services | 7.8 | 0.0030 |  |
| [CVE-2026-50472](https://patchblox.com/security/data/cve/CVE-2026-50472.md) | High | Windows LUAFV | 7.0 | 0.0026 |  |
| [CVE-2026-61366](https://patchblox.com/security/data/cve/CVE-2026-61366.md) | High | Windows Network Connection Broker | 7.0 | 0.0026 |  |
| [CVE-2026-61939](https://patchblox.com/security/data/cve/CVE-2026-61939.md) | High | Winlogon | 7.0 | 0.0026 |  |
| [CVE-2026-62723](https://patchblox.com/security/data/cve/CVE-2026-62723.md) | High | Windows Telephony Service | 7.0 | 0.0026 |  |
| [CVE-2026-62724](https://patchblox.com/security/data/cve/CVE-2026-62724.md) | High | Windows Telephony Service | 7.0 | 0.0026 |  |
| [CVE-2026-62725](https://patchblox.com/security/data/cve/CVE-2026-62725.md) | High | Windows Telephony Service | 7.0 | 0.0026 |  |
| [CVE-2026-62726](https://patchblox.com/security/data/cve/CVE-2026-62726.md) | High | Windows Telephony Service | 7.0 | 0.0026 |  |
| [CVE-2026-62753](https://patchblox.com/security/data/cve/CVE-2026-62753.md) | High | Windows HTTP.sys | 7.0 | 0.0026 |  |
| [CVE-2026-62773](https://patchblox.com/security/data/cve/CVE-2026-62773.md) | High | Windows Kerberos | 7.0 | 0.0026 |  |
| [CVE-2026-59122](https://patchblox.com/security/data/cve/CVE-2026-59122.md) | High | Windows Telephony Service | 7.0 | 0.0020 |  |
| [CVE-2026-62727](https://patchblox.com/security/data/cve/CVE-2026-62727.md) | High | Windows Telephony Service | 7.0 | 0.0020 |  |
| [CVE-2026-62728](https://patchblox.com/security/data/cve/CVE-2026-62728.md) | High | Windows Common Log File System Driver | 7.0 | 0.0020 |  |
| [CVE-2026-62729](https://patchblox.com/security/data/cve/CVE-2026-62729.md) | High | Windows Telephony Service | 7.0 | 0.0020 |  |
| [CVE-2026-62734](https://patchblox.com/security/data/cve/CVE-2026-62734.md) | High | Windows Telephony Service | 7.0 | 0.0020 |  |
| [CVE-2026-62748](https://patchblox.com/security/data/cve/CVE-2026-62748.md) | High | Windows Telephony Service | 7.0 | 0.0020 |  |
| [CVE-2026-62908](https://patchblox.com/security/data/cve/CVE-2026-62908.md) | High | Windows Backup Engine | 7.0 | 0.0020 |  |
| [CVE-2026-59138](https://patchblox.com/security/data/cve/CVE-2026-59138.md) | Routine | Microsoft Remote Registry Service | 6.5 | 0.0114 |  |
| [CVE-2026-61345](https://patchblox.com/security/data/cve/CVE-2026-61345.md) | Routine | Microsoft Remote Registry Service | 6.5 | 0.0114 |  |
| [CVE-2026-68819](https://patchblox.com/security/data/cve/CVE-2026-68819.md) | Routine | Windows Network File System | 5.9 | 0.0098 |  |
| [CVE-2026-61918](https://patchblox.com/security/data/cve/CVE-2026-61918.md) | Routine | Remote Desktop Client | 6.5 | 0.0092 |  |
| [CVE-2026-61921](https://patchblox.com/security/data/cve/CVE-2026-61921.md) | Routine | Remote Desktop Client | 6.5 | 0.0092 |  |
| [CVE-2026-61924](https://patchblox.com/security/data/cve/CVE-2026-61924.md) | Routine | Remote Desktop Client | 6.5 | 0.0092 |  |
| [CVE-2026-65794](https://patchblox.com/security/data/cve/CVE-2026-65794.md) | Routine | Windows SMB Client | 6.5 | 0.0092 |  |
| [CVE-2026-62750](https://patchblox.com/security/data/cve/CVE-2026-62750.md) | Routine | Windows HTTP Protocol Stack | 6.5 | 0.0068 |  |
| [CVE-2026-62714](https://patchblox.com/security/data/cve/CVE-2026-62714.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62716](https://patchblox.com/security/data/cve/CVE-2026-62716.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62718](https://patchblox.com/security/data/cve/CVE-2026-62718.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62720](https://patchblox.com/security/data/cve/CVE-2026-62720.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62742](https://patchblox.com/security/data/cve/CVE-2026-62742.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62745](https://patchblox.com/security/data/cve/CVE-2026-62745.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-62814](https://patchblox.com/security/data/cve/CVE-2026-62814.md) | Routine | Windows DHCP Server | 6.5 | 0.0054 |  |
| [CVE-2026-61350](https://patchblox.com/security/data/cve/CVE-2026-61350.md) | Routine | Windows NTFS | 4.6 | 0.0047 |  |
| [CVE-2026-62699](https://patchblox.com/security/data/cve/CVE-2026-62699.md) | Routine | Windows Universal Disk Format File System Driver (UDFS) | 6.8 | 0.0044 |  |
| [CVE-2026-59128](https://patchblox.com/security/data/cve/CVE-2026-59128.md) | Routine | Windows Encrypting File System (EFS) | 5.5 | 0.0040 |  |
| [CVE-2026-59136](https://patchblox.com/security/data/cve/CVE-2026-59136.md) | Routine | Microsoft COM for Windows | 5.5 | 0.0040 |  |
| [CVE-2026-59137](https://patchblox.com/security/data/cve/CVE-2026-59137.md) | Routine | Windows Event Logging Service | 5.5 | 0.0040 |  |
| [CVE-2026-61347](https://patchblox.com/security/data/cve/CVE-2026-61347.md) | Routine | Windows Event Logging Service | 5.5 | 0.0040 |  |
| [CVE-2026-61360](https://patchblox.com/security/data/cve/CVE-2026-61360.md) | Routine | Windows GDI | 5.5 | 0.0040 |  |
| [CVE-2026-62709](https://patchblox.com/security/data/cve/CVE-2026-62709.md) | Routine | Windows GDI+ | 5.5 | 0.0040 |  |
| [CVE-2026-62730](https://patchblox.com/security/data/cve/CVE-2026-62730.md) | Routine | Windows Wired AutoConfig Service | 5.5 | 0.0040 |  |
| [CVE-2026-62738](https://patchblox.com/security/data/cve/CVE-2026-62738.md) | Routine | Windows Management Instrumentation | 5.5 | 0.0040 |  |
| [CVE-2026-62743](https://patchblox.com/security/data/cve/CVE-2026-62743.md) | Routine | Windows Win32K | 5.5 | 0.0040 |  |
| [CVE-2026-62746](https://patchblox.com/security/data/cve/CVE-2026-62746.md) | Routine | Windows Win32K | 5.5 | 0.0040 |  |
| [CVE-2026-62786](https://patchblox.com/security/data/cve/CVE-2026-62786.md) | Routine | Windows Win32K | 5.5 | 0.0040 |  |
| [CVE-2026-62793](https://patchblox.com/security/data/cve/CVE-2026-62793.md) | Routine | Windows NTFS | 5.5 | 0.0040 |  |
| [CVE-2026-62796](https://patchblox.com/security/data/cve/CVE-2026-62796.md) | Routine | Windows NTFS | 5.5 | 0.0040 |  |
| [CVE-2026-62887](https://patchblox.com/security/data/cve/CVE-2026-62887.md) | Routine | Windows NTFS | 5.5 | 0.0040 |  |
| [CVE-2026-65662](https://patchblox.com/security/data/cve/CVE-2026-65662.md) | Routine | Windows GDI | 5.5 | 0.0040 |  |
| [CVE-2026-65784](https://patchblox.com/security/data/cve/CVE-2026-65784.md) | Routine | Windows NTFS | 5.5 | 0.0040 |  |
| [CVE-2026-59135](https://patchblox.com/security/data/cve/CVE-2026-59135.md) | Routine | Microsoft Windows Search Component | 5.5 | 0.0035 |  |
| [CVE-2026-62769](https://patchblox.com/security/data/cve/CVE-2026-62769.md) | Routine | Windows DNS | 6.7 | 0.0035 |  |
| [CVE-2026-62881](https://patchblox.com/security/data/cve/CVE-2026-62881.md) | Routine | Windows DNS | 6.7 | 0.0035 |  |
| [CVE-2026-62883](https://patchblox.com/security/data/cve/CVE-2026-62883.md) | Routine | Windows DNS | 6.7 | 0.0035 |  |
| [CVE-2026-65797](https://patchblox.com/security/data/cve/CVE-2026-65797.md) | Routine | Windows DNS | 6.7 | 0.0035 |  |
| [CVE-2026-65798](https://patchblox.com/security/data/cve/CVE-2026-65798.md) | Routine | Windows DNS | 6.7 | 0.0035 |  |
| [CVE-2026-62757](https://patchblox.com/security/data/cve/CVE-2026-62757.md) | Routine | Windows Schannel | 5.3 | 0.0035 |  |
| [CVE-2026-65799](https://patchblox.com/security/data/cve/CVE-2026-65799.md) | Routine | Windows DNS | 6.7 | 0.0034 |  |
| [CVE-2026-70304](https://patchblox.com/security/data/cve/CVE-2026-70304.md) | Routine | Windows DNS | 6.7 | 0.0034 |  |
| [CVE-2026-70330](https://patchblox.com/security/data/cve/CVE-2026-70330.md) | Routine | Windows DNS | 6.7 | 0.0034 |  |

---

Data as of 2026-11-09T13:31:49Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.