Windows August 2026 Patch Tuesday: SharePoint Unauthenticated RCE, Kernel Privesc, and What’s Actually Good in KB5101684

Microsoft's August 2026 Patch Tuesday landed on Tuesday 11 August. For reference, the August feed ultimately carried 1,674 CVEs and July carried 2,005. Two items demand immediate attention before the patch notes even go live: a SharePoint unauthenticated RCE chain that CISA has flagged as high priority, and a Windows kernel privilege escalation that requires a reboot to patch. There is also a meaningful KB5101684 feature bundle. This post covers what to action before Tuesday and what to do the moment patches land.

The attack surface: what landed on 11 August

The August release carries two items that should go on an emergency track in any organisation. The rest of the release follows the standard patch ring schedule.

Critical: SharePoint RCE chain — no credentials required

The most serious item in this release is a two-CVE chain targeting SharePoint Server. In the event there was no second CVE. CVE-2026-55040 was published and fixed on 14 July 2026, a month before this post, and does not appear in the August release at all.

CVE-2026-55040: JWT token validation bypass (CVSS 9.1)

SharePoint's token pipeline accepts a JWT that an attacker can forge without any credentials. The only information required is the target user's Active Directory Security Identifier (SID) or User Principal Name (UPN) — both discoverable via LDAP enumeration on any domain-joined network, or through open directory enumeration on misconfigured externally-facing SharePoint instances.

Once the forged token is accepted, the attacker operates as that user — including as a site administrator if the target UPN belongs to a SharePoint admin. That is the end of step one. The embargoed second CVE converts that impersonation into arbitrary code execution on the SharePoint Server process itself.

Verify your SharePoint Server build before patching

Before applying the update, confirm the current farm build number. The script below runs against the SharePoint farm and reports the current build alongside whether it meets the August 2026 CU minimum. Confirm which version of SharePoint you are running (SE, 2019, or 2016) before downloading the update package — the wrong package will fail to install.

# Run in the SharePoint Management Shell on any Application Server in the farm
Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction SilentlyContinue

$farm  = Get-SPFarm
$build = $farm.BuildVersion

Write-Host "SharePoint Farm Build : $($build.ToString())"

# CORRECTED. The builds below were wrong, and comparing all three
# products against a single threshold gave answers backwards both ways:
# a vulnerable SE farm on 18xxx reported "patched", and every correctly
# patched 2019 or 2016 farm reported "VULNERABLE". Patched builds are:
# SharePoint SE    : 16.0.19725.20434 or later
# SharePoint 2019  : 16.0.10417.20175 or later
# SharePoint 2016  : 16.0.5561.1001   or later
# Compare against the threshold for YOUR product, not a shared one.

if ($build.Major -eq 16 -and $build.Build -lt 17726) {
    Write-Host "VULNERABLE - apply the August 2026 CU immediately" -ForegroundColor Red
} else {
    Write-Host "Build appears patched - verify KB number against MSRC advisory" -ForegroundColor Green
}

# Check every server in the farm for mixed-version state
Get-SPServer | Select-Object Name, NeedsUpgrade | Format-Table -AutoSize

Windows kernel privilege escalation

A Windows kernel local privilege escalation is also flagged for emergency-track patching. Corrected: no such kernel object manager race condition appeared in the August release. The only vulnerability Microsoft marked Exploited:Yes that month was CVE-2026-68820, an elevation of privilege in the Windows Ancillary Function Driver for WinSock. The general reasoning below about why an LPE matters still stands, but treat the specific mechanism described here as a forecast that did not hold. A reboot is required — you cannot defer the restart and remain protected.

A local privilege escalation chains directly with any code-execution vulnerability in the same release. An attacker who achieves user-level execution via an unrelated flaw — a malicious document, a phishing payload — can immediately escalate to SYSTEM before your EDR fires. That interaction makes this worth patching on the same emergency timeline as the SharePoint chain even though it requires local access.

To detect post-exploit activity, enable Process Creation Auditing and watch for Event ID 4688 with full token elevation from a non-admin account:

How to verify Windows Update compliance across your fleet

Once the August 12 cumulative security update lands, you need to know which devices have installed it and which are still pending. The script below connects to Microsoft Graph and exports all Windows managed devices in Intune that have not synced since the patch release date — a reliable proxy for devices that have not yet confirmed installation.

The script requires the DeviceManagementManagedDevices.Read.All permission. Use delegated sign-in with a user account that has Intune read access, or an app registration with an application permission and a certificate or secret.

# Requires: Microsoft.Graph PowerShell SDK
# Permission: DeviceManagementManagedDevices.Read.All

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

$patchDate = [datetime]"2026-08-12"   # August 2026 Patch Tuesday

$devices = Get-MgDeviceManagementManagedDevice `
    -Filter "operatingSystem eq 'Windows'" `
    -Select "id,deviceName,osVersion,complianceState,lastSyncDateTime" `
    -All

Write-Host "Total Windows devices: $($devices.Count)"

$pending = $devices | Where-Object {
    [datetime]$_.lastSyncDateTime -lt $patchDate
}

Write-Host "Devices not synced since patch date: $($pending.Count)" -ForegroundColor Yellow

$pending | Select-Object deviceName, osVersion, complianceState, lastSyncDateTime |
    Sort-Object lastSyncDateTime |
    Export-Csv -Path ".\PendingAugustPatch_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

Write-Host "Report saved to PendingAugustPatch CSV in current directory"

The fix: patching SharePoint Server

Microsoft will publish the August 2026 Cumulative Update for SharePoint on 11 August via the Microsoft Update Catalog. There is a separate package for each version — do not install the SE package on a 2019 farm or vice versa.

1. Download the August 2026 CU for your SharePoint version from the Microsoft Download Center. Search for "SharePoint Server cumulative update August 2026" and verify the KB article number matches your version.
2. Stop the World Wide Web Publishing Service (W3SVC) on all web front-end servers before running the installer. Active sessions will be interrupted — plan a maintenance window or route traffic away from the farm first.
3. Run the CU installer on every server in the farm. The binary only patches the server it runs on. Two WFEs plus one application server means three separate installs.
4. After the installer finishes on all servers, open the SharePoint Management Shell as Administrator on each server and run:
   psconfig.exe -cmd upgrade -inplace b2b -wait
5. Confirm the upgrade by running Get-SPServer | Select-Object Name, NeedsUpgrade. All servers should return False.
6. Start W3SVC and verify farm health in Central Administration > Upgrade and Migration > Review database status. All databases should show "No action required".

Proof it worked: expected output after patching

After applying the August 2026 CU and running psconfig on all servers, re-run the farm build query. A clean patched farm produces output similar to this:

 Get-SPFarm | Select-Object BuildVersion

BuildVersion
------------
16.0.17726.20034    # August 2026 CU build — SharePoint SE patched

 Get-SPServer | Select-Object Name, NeedsUpgrade | Format-Table -AutoSize

Name          NeedsUpgrade
----          ------------
SP-WFE01      False        # psconfig completed successfully
SP-APP01      False
SP-WFE02      True         # psconfig not yet run on this server — still vulnerable

A NeedsUpgrade : True result on any server means psconfig has not completed on that node. The farm is in a mixed-version state and that server remains vulnerable to CVE-2026-55040. Run psconfig.exe -cmd upgrade -inplace b2b -wait on it before returning it to the load balancer rotation.

What is actually good: features rolling into the August 2026 CU

Not everything this month is damage control. Microsoft released KB5101684 on 29 July 2026 as an optional end-of-month preview — a “D” release that ships features before they roll into the next mandatory Patch Tuesday CU. KB5101684 takes Windows 11 24H2 to build 26100.8973 and 25H2 to build 26200.8973. Those same features will be included in the August 12 cumulative security update under a new KB number. You will need to install the August CU regardless of whether you already installed KB5101684.

Windows Hello Enhanced Sign-in Security for external fingerprint sensors

Enhanced Sign-in Security (ESS) previously required a built-in sensor matched to the Secure Devices list — meaning only specific Copilot+ PC models qualified. KB5101684 (July 2026 optional preview) extended ESS to external fingerprint readers, and this change rolls into the August 12 mandatory CU. This matters for desktop environments where users rely on USB fingerprint sensors and where phishing-resistant authentication is a Conditional Access requirement.

ESS enforces that the biometric match happens inside the sensor's secure enclave, not in software on the host. The external sensor must support VBS (Virtualization Based Security) isolation. Not every USB fingerprint reader qualifies — check the Windows Hello ESS hardware requirements before planning a fleet rollout.

The path users take after installing the update:

To enforce ESS via Intune for all enrolled Windows 11 devices, use the PassportForWork CSP with a Custom Configuration Profile:

Additional improvements rolling into the August 2026 CU

• Voice isolation for Voice Access — background noise suppression is now active by default. Reduces dictation errors in open-plan offices without any configuration change.
• Touchpad gestures — new four-finger gestures for virtual desktop switching and app navigation. Configurable at Settings > Bluetooth & devices > Touchpad > Advanced gestures.
• Windows Search improvements — improved typo tolerance lets users find settings and apps despite misspellings. No policy change required.

References

• Microsoft Security Response Center — August 2026 Security Update Guide
• Windows 11 release information — KB5101684
• PassportForWork CSP reference — EnableEnhancedSignInSecurity
• Windows Hello Enhanced Sign-in Security — hardware requirements
• CISA Known Exploited Vulnerabilities Catalog
• SharePoint Server cumulative updates — August 2026