August 2026 Patch Tuesday briefing

Executive briefing

Executive Summary

One Windows privilege-escalation flaw is confirmed exploited in the wild this month (1 CVE), and two vulnerabilities carry CISA KEV-driven patch urgency. While the exploited count is lower than last month (1 vs. 3), the presence of multiple “wormable-style” server-side remote code execution paths (DNS, QUIC, WDS TFTP, iSCSI) makes this release operationally high-impact for enterprises with exposed or broadly reachable Windows services.

Microsoft shipped 405 CVEs in August 2026, down from 571 in July. This is an elevated-risk month: fewer total CVEs than July, but a concentration of issues that can enable rapid compromise (remote code execution on infrastructure services) plus an actively exploited Windows elevation-of-privilege bug that can turn an initial foothold into full control.

Bottom line: Patch the in-the-wild Windows elevation-of-privilege (CVE-2026-68820) immediately, then prioritize Windows server RCE exposure (DNS/QUIC/WDS/iSCSI) and the KEV-listed SharePoint Server RCE (CVE-2026-65660).

Key Risks

CVE-2026-68820 — Windows WinSock Driver Elevation of Privilege

Actively exploited / CISA KEV deadline: 2026-08-25. This is the classic “turn a foothold into full control” vulnerability: once an attacker is already executing code on a Windows machine (often via phishing, a stolen VPN credential, or a compromised endpoint), they can use this flaw to escalate privileges and operate as a highly trusted user—enabling credential theft, disabling security tools, and pushing ransomware broadly.

What the attacker needs: Existing access on the device (even as a low-privilege user). No user click is required at exploitation time—the click typically happens earlier in the intrusion chain (e.g., opening a malicious attachment) to get the initial foothold. Why it matters: privilege escalation is a major accelerator for ransomware and domain takeover because it removes the barriers that normally slow lateral movement and persistence.

CVE-2026-65660 — SharePoint Server Remote Code Execution

CISA KEV deadline: 2026-09-28. This enables an attacker to run code on a SharePoint Server—a high-value target that often sits close to sensitive documents, internal workflows, and authentication paths. A successful compromise can become a launchpad for data theft, tampering with business content, and lateral movement into the broader Windows environment.

What the attacker needs: Network reachability to SharePoint plus some level of authenticated access (in business terms: a stolen user account, a compromised contractor account, or an attacker who already has a foothold and can reuse credentials). No user interaction is required once the attacker can reach the server and authenticate. Why it matters: SharePoint compromise frequently leads to broad internal discovery and rapid expansion because it is both trusted and data-rich.

CVE-2026-62878 — Windows DNS Server Remote Code Execution

This targets Windows DNS Server, a foundational service that is often reachable across large portions of the enterprise network. An attacker who can reach the DNS service could potentially execute code on the DNS server, turning core infrastructure into an attacker-controlled asset.

What the attacker needs: Remote network access to the DNS service—typically possible from many internal segments, and sometimes from partner networks depending on architecture. No user click is required. Why it matters: DNS servers are high-leverage: compromise can enable widespread internal reconnaissance, traffic manipulation, credential interception opportunities, and fast lateral movement—raising the blast radius well beyond a single host.

CVE-2026-62815 — Microsoft QUIC Remote Code Execution

This vulnerability affects Microsoft’s QUIC implementation and can allow remote code execution in scenarios where QUIC is enabled and reachable. In practical terms, this is a risk for systems using QUIC-enabled services where an attacker can send crafted network traffic to trigger compromise.

What the attacker needs: Remote network reachability to a QUIC-enabled service on the target. No user interaction is required. Why it matters: network-triggered code execution is prized by attackers because it can be automated for rapid scanning and exploitation, especially inside flat networks or where service exposure is broad.

CVE-2026-62893 — Windows Deployment Services (WDS) TFTP Server Remote Code Execution

This impacts the TFTP service used by Windows Deployment Services, commonly present in imaging/provisioning environments. If reachable, an attacker can potentially execute code on the WDS server, which often has privileged network placement and access to deployment assets.

What the attacker needs: Remote network access to the WDS TFTP service. No user click is required. Why it matters: deployment infrastructure is a supply-chain-like pivot point inside the enterprise—compromise can enable tampering with images, persistence, or broad internal movement, especially in environments that rely on centralized provisioning.

Threat Landscape

Compared to July, Microsoft shipped fewer total CVEs (405 vs. 571) and fewer confirmed exploited vulnerabilities (1 vs. 3). However, the mix is what drives risk this month: Windows dominates the release (and ESU coverage is substantial), and the most consequential issues cluster around enterprise infrastructure services—DNS, QUIC networking, deployment services, and storage networking—where exploitation can be remote and non-interactive.

Attackers continue to favor a two-step playbook: initial access (phishing, credential theft, exposed services) followed by privilege escalation to seize control and spread. The confirmed exploitation of a Windows elevation-of-privilege vulnerability aligns tightly with that pattern, while the KEV-listed SharePoint Server RCE reinforces that collaboration platforms remain a high-value target for both data theft and lateral movement.

Recommended Actions

1. Patch immediately (Endpoint/Server Ops + SecOps): CVE-2026-68820 across Windows and ESU fleets, prioritizing privileged user workstations, jump boxes, and servers. Meet the CISA KEV deadline: 2026-08-25.
2. Accelerate SharePoint remediation (Collaboration/Platform Team): Patch CVE-2026-65660 on all SharePoint Servers, and validate that internet exposure is intentional and tightly controlled. Meet the CISA KEV deadline: 2026-09-28.
3. Reduce “reachable surface area” while patching (Network + Server Teams): Identify where DNS Server, QUIC-enabled services, WDS TFTP, and iSCSI Target are reachable from broad internal segments; restrict access to only required subnets and block unnecessary inbound paths until patch completion (targets: CVE-2026-62878, CVE-2026-62815, CVE-2026-62893).
4. Hunt for post-compromise signals (SecOps/IR): Because the exploited issue is privilege escalation, review recent suspicious local admin elevation, credential dumping indicators, and unusual service/driver activity on high-value systems—especially where initial access is plausible (VPN endpoints, email-heavy user groups, IT admin workstations).
5. Prioritize patch waves by business blast radius (IT Leadership): Patch domain-adjacent and infrastructure servers first (DNS, SharePoint, deployment services), then broad endpoint rollout—this sequencing reduces the chance that a single compromised endpoint becomes an enterprise-wide incident.

Technical briefing

Technical Summary

Microsoft’s August 2026 Patch Tuesday addresses 405 CVEs across the ecosystem, led by 270 High, 124 Medium, 7 Critical, and 4 unrated issues. This is a month-over-month decrease from 571 CVEs in July 2026, and a sharp drop in Critical volume (7 vs. 19 last month). Despite the lower headline count, the release still contains multiple unauthenticated, network-reachable RCEs in core Windows services—conditions that historically drive rapid weaponization in enterprise environments.

There is 1 actively exploited CVE this month and 2 CVEs in CISA KEV. Microsoft also flags 2 publicly disclosed issues. Dominant themes are consistent with recent attacker tradecraft: Elevation of Privilege (160) to convert initial access into SYSTEM-level control, and Remote Code Execution (111) concentrated in server-exposed Windows components (DNS, QUIC, WDS/TFTP, iSCSI) and SharePoint. Operationally, the risk is amplified by the footprint: Windows (229) and ESU (189) dominate, with Microsoft Office/SharePoint (122) providing high-value enterprise entry points.

Key finding: Multiple unauthenticated, network-reachable Windows server RCEs (CVSS 9.8) ship alongside an actively exploited Windows EoP, creating a realistic path from foothold to full domain impact in poorly segmented environments.

Critical & Exploited Vulnerabilities

CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

This is a High-severity local Elevation of Privilege flaw in the Windows AFD (Ancillary Function Driver for WinSock) with CVSS 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, mapped to CWE-416 (Use After Free). In practical terms, an attacker needs local code execution with low privileges (e.g., a compromised standard user via phishing, drive-by, or a low-priv service account) and can then trigger a kernel-adjacent memory safety condition through WinSock/AFD interactions to escalate privileges—typically to SYSTEM—without user interaction.

Status is unambiguous: Actively exploited and CISA KEV deadline: 2026-08-25. This is the kind of post-compromise primitive that reliably turns “one workstation” into “enterprise incident,” enabling credential theft, EDR tampering attempts, LSASS access (where protections allow), and lateral movement. Expect it to be paired with commodity initial access (malicious documents, stolen VPN creds, exposed RDP) and then used to harden persistence (services, scheduled tasks) under elevated context.

Detection coverage: 4 GitHub PoCs available, which materially lowers the barrier for copycat exploitation and increases the likelihood of broad criminal adoption.

CVE-2026-62815 — Microsoft QUIC Remote Code Execution Vulnerability

This Critical RCE in Microsoft QUIC carries CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is a CWE-416 (Use After Free) memory corruption issue. The vector translates to a worst-case scenario: network-reachable, unauthenticated, no user interaction. Any Windows system exposing QUIC-enabled services (or where QUIC is reachable as part of application stacks using it) becomes a candidate for pre-auth remote code execution.

Real-world risk centers on edge exposure and lateral movement. Attackers scan for reachable services, deliver a crafted QUIC interaction to corrupt memory, and execute code in the context of the vulnerable service. From there, they can deploy loaders, establish C2, dump credentials, and pivot. In environments where QUIC is used to improve performance (including modern app stacks and proxies), defenders should assume rapid scanning and opportunistic exploitation once reliable exploit paths emerge.

CVE-2026-62878 — Windows DNS Server Remote Code Execution Vulnerability

This is a Critical Windows DNS Server RCE with CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, tied to CWE-121 (Stack-based Buffer Overflow). The prerequisites are minimal: an attacker only needs network reachability to a DNS server—no authentication, no user interaction. That makes this particularly dangerous in enterprises where DNS servers are reachable from broad internal segments, branch networks, or (in misconfigurations) from the internet.

The most credible exploitation path is internal compromise amplification: once an attacker lands anywhere inside the network, DNS is a high-leverage target because it is ubiquitous, trusted, and often runs with elevated privileges. Successful exploitation can yield code execution on a core infrastructure server, enabling credential harvesting, manipulation of name resolution for traffic interception, and rapid lateral movement. Even without direct internet exposure, this is a prime candidate for wormable-like internal propagation patterns in flat networks.

Detection coverage: 1 GitHub PoC available, increasing the likelihood of fast operationalization by red teams and threat actors.

CVE-2026-62893 — Windows Deployment Services TFTP Server Remote Code Execution Vulnerability

This Critical RCE affects Windows Deployment Services (WDS) TFTP Server with CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and CWE-416 (Use After Free). The attack scenario is straightforward: if WDS/TFTP is reachable (commonly on imaging networks, PXE environments, or poorly segmented admin VLANs), an unauthenticated attacker can send crafted TFTP traffic to trigger memory corruption and execute code.

Real-world risk is highest where imaging infrastructure is not isolated. WDS servers often sit close to privileged tooling, golden images, driver repositories, and deployment credentials. Compromise here can become a supply-chain-like event inside the enterprise: attackers can tamper with deployment artifacts, implant backdoors into images, or use the server as a pivot into management networks.

CVE-2026-65791 — Windows iSCSI Target Service Remote Code Execution Vulnerability

This Critical RCE in Windows iSCSI Target Service is scored CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and maps to CWE-122 (Heap-based Buffer Overflow). Exploitation requires only network access to the iSCSI target service—no credentials and no user interaction—making it a high-impact issue in datacenter environments where iSCSI is used for storage provisioning.

From an attacker’s perspective, iSCSI targets are attractive because they often run on storage-adjacent servers with high availability expectations and privileged connectivity. RCE here can enable disruption (availability impact), data access, or a stealthy foothold in infrastructure tiers that are less monitored than endpoints. In ransomware playbooks, compromising storage/control-plane systems can accelerate encryption impact and recovery denial.

CVE-2026-59124 — Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

This Critical RCE in Microsoft HPC Pack is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and is classified as CWE-502 (Deserialization of Untrusted Data). The practical prerequisite is network reachability to an HPC Pack component that accepts attacker-controlled serialized input. Where HPC clusters exist (research, engineering, financial compute), exposed management or job submission interfaces can become a direct path to remote code execution.

The real-world risk is twofold: (1) HPC environments often have high-bandwidth access to sensitive datasets, and (2) they frequently integrate with Active Directory and shared storage, making them valuable pivots. Deserialization bugs are commonly exploited to achieve reliable code execution, after which attackers can harvest credentials, move laterally into corporate networks, or exfiltrate proprietary data.

CVE-2026-59118 — Copilot Cowork Elevation of Privilege Vulnerability

This Critical Elevation of Privilege issue in Microsoft Dynamics (Copilot Cowork) is scored CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N and maps to CWE-285 (Improper Authorization). The vector indicates network-based exploitation without authentication, but it requires user interaction and has scope change, consistent with scenarios where a victim is induced to perform an action (e.g., clicking a crafted link, approving a workflow, or interacting with a maliciously prepared Copilot/Dynamics artifact) that results in privilege gain across a trust boundary.

In real-world terms, this is a strong candidate for business process compromise: attackers target Dynamics users (sales, finance, operations) to elevate privileges and access sensitive CRM/ERP data, modify records, or abuse integrations (email, workflows, connectors) to expand access. Because the impact is C:H/I:H without availability loss, the most likely outcomes are data theft, fraud enablement, and persistence via privileged app configurations rather than immediate disruption.

CVE-2026-70306 — Microsoft Office SharePoint Spoofing Vulnerability

This Critical Spoofing vulnerability in SharePoint is CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N and is associated with CWE-79 (XSS). The scenario is classic enterprise targeting: an attacker crafts SharePoint content or a link that, when opened by a user, triggers script execution in a context that enables credential theft, session hijacking, or UI redressing—and because scope changes, the blast radius can extend beyond a single site context depending on tenant configuration and trust relationships.

Real-world risk is driven by SharePoint’s role as a collaboration hub. Attackers can use spoofing/XSS to steal tokens, impersonate users, and then leverage SharePoint as a staging ground for internal phishing, malicious file distribution, or abuse of workflows and integrations. This pairs naturally with post-compromise objectives: once a user session is captured, attackers can enumerate sites, locate sensitive documents, and pivot into Teams/Office ecosystems.

CVE-2026-65660 — Microsoft SharePoint Server Remote Code Execution Vulnerability

Although not Critical, this CISA KEV-listed SharePoint Server RCE warrants treatment as top-tier risk. It is CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and maps to CWE-94 (Code Injection). Exploitation requires network access and low privileges—meaning any attacker who can obtain a basic SharePoint account (stolen creds, password spraying, OAuth abuse, or compromised contractor accounts) can potentially achieve server-side code execution without user interaction.

CISA KEV deadline: 2026-09-28. In practice, SharePoint RCE is frequently used as a beachhead on a server that already has strong connectivity to file shares, AD-integrated services, and backup infrastructure. Once code execution is achieved, attackers commonly deploy webshells, dump configuration secrets, and pivot laterally. This CVE also pairs dangerously with SharePoint spoofing/social engineering paths (e.g., using CVE-2026-70306 to steal a user session, then leveraging that access to meet the PR:L prerequisite).

Detection coverage: 2 GitHub PoCs available, increasing the likelihood of broad testing and opportunistic exploitation.

CVE-2026-62832 — Windows User Profile Service Elevation of Privilege Vulnerability

This issue is publicly disclosed and affects the Windows User Profile Service, with CWE-59 (Link Following). The most realistic exploitation pattern for link-following bugs in Windows services is local privilege escalation via crafted reparse points/symlinks/hardlinks that redirect privileged file operations to attacker-chosen targets. Attackers typically need local execution and the ability to manipulate filesystem objects in locations the service touches during profile operations.

Because it is Publicly disclosed, defenders should assume adversaries and red teams will quickly attempt to reproduce it, especially in environments where user profile operations are frequent (VDI, RDS, shared workstations). The payoff is usually SYSTEM-level file write primitives that can be converted into code execution (e.g., overwriting service binaries/configs) or credential access.

CVE-2026-72971 — Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability

This publicly disclosed Tampering vulnerability impacts Windows container isolation via unionfs.sys, scored CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N and mapped to CWE-59 (Link Following). The scenario is a local attacker with low privileges on a host that runs Windows containers who can manipulate filesystem link behavior to tamper with data or container/host boundary expectations.

While not an RCE by itself, the integrity impact (I:H) matters in containerized build and deployment pipelines: attackers can potentially alter artifacts, poison build outputs, or subvert container filesystem views to set up later execution. In mixed-trust CI/CD environments, this is a meaningful stepping stone toward supply-chain compromise inside the enterprise.

Threat Category Analysis

Elevation of Privilege (160 — ~40% of total)

EoP remains the dominant category, consistent with attacker reality: initial access is often cheap, but privilege is what enables credential theft, persistence, and lateral movement at scale. The month’s most important EoP is the actively exploited CVE-2026-68820 in AFD/WinSock—exactly the kind of post-compromise kernel-adjacent primitive used to convert a single endpoint foothold into enterprise control. The presence of publicly disclosed link-following issues (CVE-2026-62832, CVE-2026-72971) reinforces that filesystem redirection remains a reliable escalation/tampering technique on Windows.

Remote Code Execution (111 — ~27% of total)

RCE volume is high, and the most operationally significant RCEs are unauthenticated and network-reachable in Windows server roles: QUIC (CVE-2026-62815), DNS (CVE-2026-62878), WDS/TFTP (CVE-2026-62893), and iSCSI (CVE-2026-65791). These align with real attacker behavior: compromise infrastructure services to gain durable, high-privilege execution and pivot rapidly. SharePoint remains a perennial enterprise target, and the KEV-listed CVE-2026-65660 underscores that authenticated footholds are often sufficient to reach server-side execution.

Information Disclosure (86 — ~21% of total)

Information disclosure continues to be a large slice of the release, typically enabling credential material leakage, token exposure, or environment reconnaissance that accelerates follow-on exploitation. Even when not immediately weaponized as standalone incidents, disclosure bugs are frequently used to reduce attacker uncertainty—mapping users, services, and secrets that make later EoP/RCE attempts more reliable.

Spoofing (17 — ~4% of total)

Spoofing is smaller in volume but high in impact when it hits collaboration platforms. The Critical SharePoint spoofing/XSS issue (CVE-2026-70306) is emblematic: attackers don’t need code execution if they can steal sessions, tokens, or coerce privileged actions. This category often pairs with credential access and business email compromise-style objectives.

Security Feature Bypass / DoS / Tampering (combined 26 — ~6% of total)

These categories are lower volume but can be strategically important in targeted intrusions. Tampering (CVE-2026-72971) is notable because integrity violations in container and build contexts can have outsized downstream impact, even without immediate RCE.

Product Impact

Windows / ESU (Windows: 229; ESU: 189)

Windows and ESU dominate the release footprint and contain the most urgent enterprise risks: the actively exploited AFD/WinSock EoP (CVE-2026-68820) and multiple Critical 9.8 server-side RCEs (CVE-2026-62815, CVE-2026-62878, CVE-2026-62893, CVE-2026-65791). Patching implications differ by environment: endpoint fleets should prioritize the exploited EoP to reduce post-compromise blast radius, while server teams should urgently assess exposure of DNS/WDS/iSCSI/QUIC services and segment or firewall them until patched.

Microsoft Office / SharePoint (122)

Office/SharePoint remains a high-value target because it sits at the intersection of identity, collaboration, and data. The Critical SharePoint spoofing/XSS (CVE-2026-70306) increases risk of token theft and internal phishing propagation, while the KEV-listed SharePoint Server RCE (CVE-2026-65660) provides a direct path to server compromise once an attacker has any authenticated foothold. Organizations with on-prem SharePoint should treat this month as a “patch fast or isolate” event.

Azure (8)

Azure’s footprint is smaller by count, but the Critical HPC Pack RCE (CVE-2026-59124) is high impact in the environments where it exists. HPC clusters often have privileged connectivity and sensitive datasets; compromise can become both an IP theft event and a pivot into broader enterprise identity and storage.

Microsoft Dynamics (4)

Dynamics has low volume but includes a Critical authorization/EoP issue (CVE-2026-59118) that can translate into business process compromise and sensitive data exposure. Because the vector includes user interaction, this is likely to be exploited via targeted social engineering against business users rather than broad scanning.

Detection & Response

Immediate Detection Actions

• CVE-2026-68820: 4 GitHub PoCs available. Prioritize detections for suspicious privilege escalation sequences following initial user-level execution, especially where exploitation attempts are followed by credential access tooling or rapid service/task creation.
• CVE-2026-65660: 2 GitHub PoCs available. Monitor SharePoint servers for post-auth exploitation patterns that lead to code execution (unexpected process spawns from IIS worker processes, anomalous file writes in web directories, and suspicious outbound connections).
• CVE-2026-62878: 1 GitHub PoC available. Increase scrutiny on DNS server telemetry for malformed query patterns, spikes in query volume from single hosts, and any correlated service instability followed by suspicious child processes.

Hunting Guidance

• Post-compromise privilege escalation on endpoints (targets CVE-2026-68820): hunt for sequences where a low-priv process rapidly transitions to SYSTEM context followed by credential access behaviors. Focus on unusual parent/child relationships around administrative tools, sudden enabling of remote management, and persistence creation shortly after the initial foothold.
• SharePoint server exploitation and webshell-like follow-on (targets CVE-2026-65660 and CVE-2026-70306): hunt for anomalous process execution originating from IIS/SharePoint worker processes, unexpected modifications in SharePoint web directories, and suspicious authentication patterns (new service accounts, unusual logon times, or access from atypical source subnets) preceding server-side execution.
• Infrastructure service targeting from internal footholds (targets CVE-2026-62878, CVE-2026-62893, CVE-2026-65791, CVE-2026-62815): hunt for lateral movement where a newly compromised workstation begins probing server-role ports and protocols (DNS, TFTP/PXE networks, iSCSI, QUIC-enabled services), especially when followed by authentication attempts or service disruptions.

Priority Log Sources

• Windows Security Event Logs (logon events, privilege use, service/task creation) on endpoints and servers.
• Sysmon / EDR telemetry for process ancestry, token elevation, driver/module loads, and suspicious network connections.
• IIS/SharePoint ULS logs plus web server access logs for exploitation attempts, abnormal request patterns, and post-auth abuse.
• DNS server logs and network telemetry (NetFlow/PCAP where available) to identify malformed query patterns and scanning behavior.
• WDS/PXE/TFTP and storage network telemetry in datacenter segments where those roles exist.

Patching Priority

Tier 1 — Immediate (Actively Exploited / KEV)

• CVE-2026-68820 — KEV deadline: 2026-08-25
• CVE-2026-65660 — KEV deadline: 2026-09-28

Tier 2 — High Priority

• CVE-2026-62878 — Critical unauthenticated DNS Server RCE; high-value infrastructure target with broad internal reach.
• CVE-2026-62815 — Critical unauthenticated QUIC RCE; risk depends on service exposure but impact is full remote code execution.
• CVE-2026-62893 — Critical unauthenticated WDS/TFTP RCE; high impact where imaging networks are not isolated.
• CVE-2026-65791 — Critical unauthenticated iSCSI Target RCE; datacenter/storage-adjacent compromise risk.
• CVE-2026-59124 — Critical unauthenticated HPC Pack deserialization RCE; high impact in research/engineering clusters.
• CVE-2026-70306 — Critical SharePoint spoofing/XSS; enables token theft and user/session compromise that can unlock broader access.

Tier 3 — Standard

• Windows / ESU: prioritize remaining High EoP and RCE fixes across endpoint and server fleets, with emphasis on systems hosting exposed services and shared admin tooling.
• Microsoft Office / SharePoint: patch remaining collaboration and server components to reduce phishing-to-internal-compromise pathways.
• Dynamics / Azure: patch line-of-business and specialized compute environments on normal change windows, accelerating where those systems integrate with identity, finance, or sensitive datasets.