CVE-2026-68820 is an Important elevation of privilege vulnerability affecting the Windows Ancillary Function Driver for WinSock and has a CVSS score of 7.0. A use-after-free flaw (CWE-416) allows a low-privileged local attacker to elevate privileges with no user interaction. Exploitation requires winning a race condition when a locally authenticated attacker runs a specially crafted application to trigger the flaw. Successful exploitation could allow the attacker to gain SYSTEM privileges.

Microsoft reports that this vulnerability has been exploited in the wild.

Publicly Disclosed Vulnerability in Windows User Profile Service

CVE-2026-62832 is an Important elevation of privilege vulnerability affecting the Windows User Profile Service and has a CVSS score of 7.8. A link following flaw (CWE-59) allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. An authenticated attacker with credentials for another local account could run a specially crafted application to load another user’s registry hive, potentially gaining access to or modifying that user’s data and elevating to administrator privileges.

While not confirmed at this time, CrowdStrike assesses this is likely the patch for the LegacyHive exploit released by the Nightmare-Eclipse persona in July 2026.

Publicly Disclosed Vulnerability in Windows Kernel

CVE-2026-62737 is an Important elevation of privilege vulnerability affecting the Windows kernel and has a CVSS score of 7.8. An untrusted pointer dereference flaw (CWE-822) allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. Successful exploitation could allow an attacker to gain SYSTEM privileges.

While not officially recognized by Microsoft as publicly disclosed, a Chinese-language blog was published on August 9, 2026, describing a proof-of-concept exploit that can cause a system crash.

Publicly Disclosed Vulnerability in Windows Container Isolation FS Filter Driver

CVE-2026-72971 is an Important tampering vulnerability affecting the Windows Container Isolation FS Filter Driver (unionfs.sys) and has a CVSS score of 5.5. Windows Container Isolation FS Filter Driver is a component of the Windows container infrastructure that provides filesystem isolation for containerized workloads. It acts as a file system filter driver that intercepts and manages file system operations, ensuring containerized processes are restricted to their designated scope and isolated from the host operating system’s file system and other containers.

A link following flaw (CWE-59) allows a low-privileged local attacker to tamper with system integrity with no user interaction and low attack complexity. Successful exploitation impacts only integrity, with no effect on confidentiality or availability.

This vulnerability was publicly disclosed, though there is no evidence of exploitation in the wild. Microsoft assesses exploitation as unlikely.

Critical Vulnerability in Microsoft QUIC

CVE-2026-62815 is a Critical RCE vulnerability affecting Microsoft QUIC and has a CVSS score of 9.8. Microsoft QUIC (MsQuic) is Microsoft’s open-source implementation of the QUIC transport protocol, which underpins HTTP/3 and is used across multiple Microsoft products and services for high-performance, encrypted network communication.

A use-after-free flaw (CWE-416) allows an unauthenticated remote attacker to execute code with no user interaction and low attack complexity. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.

Critical Vulnerability in Windows Deployment Services

CVE-2026-62893 is a Critical RCE vulnerability affecting Windows Deployment Services and has a CVSS score of 9.8. A use-after-free flaw (CWE-416) allows an unauthenticated attacker to execute code over a network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to the TFTP Server component of an affected service, with no authentication or user interaction required. Successful exploitation could allow the attacker to execute code on the target system.

Critical Vulnerabilities in Windows DNS Server

CVE-2026-62878, CVE-2026-62817, CVE-2026-62820, and CVE-2026-65789 are Critical RCE vulnerabilities affecting Windows DNS Server and have CVSS scores of 9.8, 8.8, 8.1, and 8.1, respectively. All four can be exploited by sending specially crafted packets to an affected DNS server with no user interaction required. 

CVE-2026-62878 stems from a stack-based buffer overflow flaw (CWE-121) and allows an unauthenticated remote attacker to execute code with low attack complexity. CVE-2026-62817 stems from an out-of-bounds write flaw (CWE-787) and is limited to adjacent network attackers, exploitable by calling arbitrary endpoints from within the network. CVE-2026-62820 stems from a race condition flaw (CWE-362) and requires an attacker to win a race condition. CVE-2026-65789 stems from a use-after-free flaw (CWE-416) and requires specific network configurations and timing conditions to exploit, meaning an attacker cannot reliably exploit the issue across all environments. It has only been observed in limited scenarios.

Critical Vulnerability in Windows iSCSI Target Service

CVE-2026-65791 is a Critical RCE vulnerability affecting Windows iSCSI Target Service and has a CVSS score of 9.8. A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code over a network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to an affected service, with no authentication or user interaction required, to execute code on the target system.

Critical Vulnerability in Windows Reliable Multicast Transport Driver 

CVE-2026-62816 is a Critical RCE vulnerability affecting the Windows Reliable Multicast Transport Driver (RMCAST) and has a CVSS score of 8.8. RMCAST is the Windows kernel driver that implements PGM (Pragmatic General Multicast), a reliable multicast protocol used for one-to-many data delivery across a network.

A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code with no user interaction and low attack complexity, though exploitation is limited to adjacent network attackers. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service.

Critical Vulnerability in Windows Active Directory Certificate Services

CVE-2026-62818 is a Critical RCE vulnerability affecting Windows Active Directory Certificate Services (AD CS) and has a CVSS score of 8.8. A use-after-free flaw (CWE-416) allows a low-privileged remote attacker to execute code with no user interaction and low attack complexity. An attacker could exploit this vulnerability by sending a specially crafted request to an affected AD CS service over the network.

Critical Vulnerability in Windows DHCP Server

CVE-2026-62823 is a Critical RCE vulnerability affecting Windows DHCP Server and has a CVSS score of 8.8. A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code over an adjacent network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to an affected DHCP service, with no authentication or user interaction required, to execute code on the target system.

Critical Vulnerabilities in Windows GDI+

CVE-2026-62822 and CVE-2026-62890 are Critical vulnerabilities affecting Windows GDI+ and have CVSS scores of 8.8 and 7.8, respectively. CVE-2026-62822 stems from an integer overflow or wraparound flaw (CWE-190) and allows an unauthorized attacker to execute code over a network. It requires user interaction: An attacker would need to convince a user to open a specially crafted file to trigger remote code execution. CVE-2026-62890 stems from a heap-based buffer overflow flaw (CWE-122) and allows an authenticated attacker to elevate privileges locally with no user interaction required. Successful exploitation of CVE-2026-62890 could grant an attacker SYSTEM privileges. 

Although both vulnerabilities affect the same component, they differ in threat type, attack vector, and privilege requirements, with one enabling network-based code execution through a malicious file and the other enabling local privilege escalation.

Critical Vulnerabilities in Microsoft SharePoint Server

CVE-2026-62827, CVE-2026-64921, and CVE-2026-65665 are Critical vulnerabilities affecting Microsoft SharePoint Server, all carrying a CVSS score of 8.8. CVE-2026-62827 stems from an improper authentication flaw (CWE-287), while CVE-2026-64921 stems from a missing authentication for critical function flaw (CWE-306). Both allow an authenticated attacker to elevate privileges over a network with low attack complexity. In each case, an authenticated attacker with access to the domain could perform RCE on the SharePoint server to elevate themselves to SharePoint admin. 

CVE-2026-65665 stems from a deserialization of untrusted data flaw (CWE-502) and allows an authenticated attacker to execute code over a network with low attack complexity. In this case, an attacker authenticated as at least a site owner could write and inject arbitrary code to execute remotely on the SharePoint server. All three vulnerabilities require authenticated access to exploit, underscoring the importance of restricting and monitoring SharePoint permissions in addition to patching.

Critical Vulnerability in Remote Desktop Client

CVE-2026-62824 is a Critical RCE vulnerability affecting Remote Desktop Client and has a CVSS score of 8.8. A stack-based buffer overflow flaw (CWE-121) allows an unauthenticated attacker to execute code over a network. It requires user interaction. An attacker could host a malicious server and convince a user to connect to it from an affected client; when the client processes the server’s response, the attacker could execute code on the client system.

Critical Vulnerabilities in Microsoft Office

CVE-2026-63515, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, CVE-2026-64910, CVE-2026-64911, CVE-2026-65657, and CVE-2026-70130 are Critical RCE vulnerabilities in Microsoft Office, with CVSS scores of 8.4 (CVE-2026-70130) and 7.8 (all others). These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

• Heap-based Buffer Overflow (CWE-122): CVE-2026-64898, CVE-2026-70130
• Out-of-bounds Read (CWE-125): CVE-2026-63515
• Integer Overflow or Wraparound (CWE-190): CVE-2026-63532, CVE-2026-64903, CVE-2026-64911
• Integer Underflow (CWE-191): CVE-2026-64909
• Use After Free (CWE-416): CVE-2026-65657
• Untrusted Pointer Dereference (CWE-822): CVE-2026-64910

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is an attack vector for CVE-2026-63515, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, and CVE-2026-65657. Preview Pane is not an attack vector for CVE-2026-64910 and CVE-2026-64911. CVE-2026-70130 does not specify if Preview Pane is an attack vector.

Critical Vulnerabilities in Windows Device Health Attestation 

CVE-2026-66802 and CVE-2026-71331 are Critical RCE vulnerabilities affecting the Microsoft Azure Attestation service and Device Health Attestation (DHA) service. Both carry a CVSS score of 8.1.

CVE-2026-66802 stems from a race condition flaw (CWE-362) and requires the attacker to win a race condition to succeed. CVE-2026-71331 stems from an integer overflow or wraparound flaw (CWE-190) and instead requires the attacker to have deep knowledge of the target environment and configuration. Both vulnerabilities allow an unauthenticated attacker to execute code over a network with high attack complexity and no user interaction; in each case, an attacker could exploit the flaw by sending a specially crafted packet to an affected service to execute code on the target system.

Critical Vulnerability in Windows Routing and Remote Access Service

CVE-2026-62819 is a Critical RCE vulnerability affecting Windows Routing and Remote Access Service (RRAS) and has a CVSS score of 8.1. RRAS is a Windows Server service that provides routing and remote access functionality, enabling organizations to deploy VPN, dial-up, and site-to-site connectivity solutions. 

A use-after-free flaw (CWE-416) could allow an unauthenticated remote attacker to execute arbitrary code over a network. Successful exploitation requires an attacker to win a race condition. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network, with no authentication or user interaction required.

Critical Vulnerability in Windows Secure Socket Tunneling Protocol

CVE-2026-62889 is a Critical RCE vulnerability affecting Windows Secure Socket Tunneling Protocol (SSTP) and has a CVSS score of 8.1. SSTP is a Microsoft VPN protocol that tunnels Point-to-Point Protocol (PPP) traffic through an SSL/TLS channel; it’s commonly used to provide secure remote access to corporate networks over HTTPS. A double free flaw (CWE-415) could allow an unauthenticated remote attacker to execute arbitrary code over a network. Successful exploitation requires an attacker to win a race condition. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network, with no authentication or user interaction required.

Critical Vulnerability in Windows Key Guard

CVE-2026-66799 is a Critical elevation of privilege vulnerability affecting Windows Key Guard and has a CVSS score of 7.8. A heap-based buffer overflow flaw (CWE-122) allows an authenticated attacker to elevate privileges locally with low attack complexity. Successful exploitation could allow an attacker to gain Virtual Trust Level 1 (VTL1) privileges, escalating beyond the access normally permitted to a standard local user.

Critical Vulnerabilities in Microsoft Office Graphics Component

CVE-2026-63513, CVE-2026-63519, CVE-2026-63526, CVE-2026-65664, and CVE-2026-66807 are Critical RCE vulnerabilities in the Microsoft Office Graphics Component, all with CVSS scores of 7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

• Stack-based Buffer Overflow (CWE-121): CVE-2026-63526, CVE-2026-66807
• Heap-based Buffer Overflow (CWE-122): CVE-2026-63513, CVE-2026-63519, CVE-2026-65664

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is an attack vector for CVE-2026-63513, CVE-2026-63519, CVE-2026-63526, and CVE-2026-66807, but is not an attack vector for CVE-2026-65664.

Critical Vulnerabilities in Microsoft Office Word

CVE-2026-63518, CVE-2026-63525, and CVE-2026-64907 are Critical RCE vulnerabilities in Microsoft Office Word, all with a CVSS score of 7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

• Stack-based Buffer Overflow (CWE-121): CVE-2026-64907
• Heap-based Buffer Overflow (CWE-122): CVE-2026-63518
• Numeric Truncation Error (CWE-197): CVE-2026-63525

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is not an attack vector for any of these vulnerabilities.

Critical Vulnerabilities in Microsoft Excel

CVE-2026-68794, CVE-2026-68804, and CVE-2026-68816 are Critical RCE vulnerabilities in Microsoft Excel, all with a CVSS score of 7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

• Stack-based Buffer Overflow (CWE-121): CVE-2026-68816
• Heap-based Buffer Overflow (CWE-122): CVE-2026-68794
• Numeric Truncation Error (CWE-197): CVE-2026-68804

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is not an attack vector for any of these vulnerabilities.

Critical Vulnerability in Microsoft Exchange Server

CVE-2026-62911 is a Critical elevation of privilege vulnerability affecting Microsoft Exchange Server and has a CVSS score of 8.0. An authentication bypass by capture-replay flaw (CWE-294) could allow an authorized remote attacker to elevate their privileges over a network. An attacker who successfully exploited this vulnerability could take over the mailboxes of all Exchange users, send and read emails, and download attachments.

Critical Vulnerabilities in Microsoft Teams

CVE-2026-62896, CVE-2026-62918, and CVE-2026-65667 are Critical vulnerabilities affecting Microsoft Teams, with CVSS scores of 10.0 (CVE-2026-65667), 9.6 (CVE-2026-62896), and 7.5 (CVE-2026-62918). CVE-2026-65667 and CVE-2026-62896 are elevation of privilege vulnerabilities, while CVE-2026-62918 is a spoofing vulnerability. These vulnerabilities exploit the following flaws:

• Improper Authentication (CWE-287): CVE-2026-62896
• Improper Verification of Cryptographic Signature (CWE-347): CVE-2026-62918
• Missing Authorization (CWE-862): CVE-2026-65667

Critical Vulnerability in Microsoft Planetary Computer Pro

CVE-2026-63508 is a Critical elevation of privilege vulnerability affecting Microsoft Planetary Computer Pro and has a CVSS score of 10.0. Microsoft Planetary Computer Pro is a cloud-based geospatial analysis platform that provides access to large-scale environmental and earth observation datasets, primarily used by researchers and data scientists working with satellite imagery and climate data.

A missing authentication for a critical function flaw (CWE-306) allows an unauthenticated remote attacker to elevate privileges with no user interaction and low attack complexity. The vulnerability has a changed scope impact, affecting confidentiality and integrity but not availability.

Critical Vulnerabilities in Azure SQL Database

CVE-2026-56162 and CVE-2026-63522 are Critical elevation of privilege vulnerabilities affecting Azure SQL Database and have CVSS scores of 10.0 and 7.8, respectively. CVE-2026-56162 stems from an improper authentication flaw (CWE-287) and allows an unauthenticated remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability. CVE-2026-63522 stems from an incorrect permission assignment for a critical resource flaw (CWE-732) and allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. Successful exploitation of CVE-2026-63522 could allow an attacker to gain SQL sysadmin privileges.

Critical Vulnerability in Azure Service Bus

CVE-2026-50515 is a Critical RCE vulnerability affecting Azure Service Bus and has a CVSS score of 9.9. Azure Service Bus is a fully managed enterprise message broker service used to decouple applications and services from one another, commonly used to pass data between applications via message queues and publish-subscribe topics in cloud and hybrid architectures.

A deserialization of untrusted data flaw (CWE-502) allows a low-privileged remote attacker to execute code over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

Critical Vulnerability in Microsoft Entra Provisioning Service

CVE-2026-59115 is a Critical elevation of privilege vulnerability affecting the Microsoft Entra Provisioning Service (SyncFabric) and has a CVSS score of 9.9. The Microsoft Entra Provisioning Service is responsible for automating the synchronization of user identities and group memberships between Microsoft Entra ID (formerly Azure Active Directory) and connected applications and directories.

A path traversal flaw (CWE-35) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

Critical Vulnerability in Azure Active Directory

CVE-2026-50481 is a Critical elevation of privilege vulnerability affecting Azure Active Directory and has a CVSS score of 9.9. A modification of assumed-immutable data flaw (CWE-471) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact. Exploitation could allow an attacker to tamper with data that the system treats as trusted and unmodifiable, potentially enabling unauthorized privilege escalation within the identity platform.

Critical Vulnerability in Azure SRE Agent

CVE-2026-62830 is a Critical elevation of privilege vulnerability affecting Azure SRE Agent and has a CVSS score of 9.9. Azure SRE Agent is an AI-powered site reliability engineering service that autonomously monitors, diagnoses, and remediates issues in Azure-hosted applications and infrastructure.

A missing authorization flaw (CWE-862) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

Critical Vulnerability in Microsoft 365 Admin Center

CVE-2026-62873 is a Critical elevation of privilege vulnerability affecting the Microsoft 365 Admin Center and has a CVSS score of 9.8. The Microsoft 365 Admin Center is the centralized web-based management portal used by organizational administrators to manage users, licenses, services, and security settings across the Microsoft 365 suite, making it a high-value target given the breadth of administrative access it provides.

An improper verification of cryptographic signature flaw (CWE-347) allows an unauthenticated remote attacker to elevate privileges over a network with no user interaction and low attack complexity, with full impact to confidentiality, integrity, and availability.

Critical Vulnerability in Microsoft SharePoint Online

CVE-2026-70332 is a Critical spoofing vulnerability affecting Microsoft SharePoint Online and has a CVSS score of 9.6. A cross-site scripting flaw (CWE-79) allows an unauthenticated attacker to perform spoofing over a network.

Critical Vulnerability in Azure Logic Apps

CVE-2026-56161 is a Critical information disclosure vulnerability affecting Azure Logic Apps and has a CVSS score of 9.6. An improper access control flaw (CWE-284) allows an authenticated attacker to disclose information over a network.

Azure Logic Apps is a cloud-based integration platform that lets organizations automate workflows and connect systems like SaaS applications, on-premises services, and databases with minimal custom code. Since these workflows often carry sensitive business data and credentials, an information disclosure flaw here could expose data flowing through an organization’s connected systems.

Critical Vulnerability in Microsoft Azure Kubernetes Service

CVE-2026-50516 is a Critical elevation of privilege vulnerability affecting Microsoft Azure Kubernetes Service and has a CVSS score of 9.4. A missing authentication for critical function flaw (CWE-306) allows an unauthenticated attacker to elevate privileges over a network.

Critical Vulnerability in Copilot Cowork

CVE-2026-59118 is a Critical elevation of privilege vulnerability affecting Microsoft Copilot Cowork and has a CVSS score of 9.3. An improper authorization flaw (CWE-285) allows an unauthenticated attacker to elevate privileges over a network with low attack complexity, requiring user interaction. The vulnerability has a changed scope impact, affecting confidentiality and integrity but not availability.

Microsoft Copilot Cowork is an AI-powered collaboration agent within the Microsoft 365 Copilot ecosystem, designed to work alongside users on shared tasks and content across Microsoft 365 apps. Because Cowork operates with access to organizational content and collaborates directly within user workflows, an authorization flaw could allow an attacker to escalate privileges and improperly access or manipulate data across connected Microsoft 365 services.

Critical Vulnerability in Azure Confidential Ledger

CVE-2026-68823 is a Critical RCE vulnerability affecting Azure Confidential Ledger and has a CVSS score of 9.1. An exposed dangerous method or function flaw (CWE-749) allows an authenticated attacker to execute code over a network. 

Azure Confidential Ledger is a tamper-proof, blockchain-based data store designed to maintain sensitive records with cryptographic integrity guarantees. Because organizations rely on it to preserve trust in critical audit and compliance data, a code execution flaw could undermine the integrity assurances the service is meant to provide.

Critical Vulnerability in Microsoft Purview eDiscovery

CVE-2026-65668 is a Critical elevation of privilege vulnerability affecting Microsoft Purview eDiscovery and has a CVSS score of 8.8. An improper access control flaw (CWE-284) allows an authenticated attacker to elevate privileges over a network. This vulnerability has already been fully mitigated by Microsoft; no customer action is required.

Microsoft Purview eDiscovery is a compliance tool used to search, hold, and export content such as emails and documents across Microsoft 365 for legal investigations and regulatory requirements. Because eDiscovery grants access to potentially privileged and sensitive organizational data during legal proceedings, an access control flaw could let an attacker escalate privileges and gain unauthorized visibility into confidential case-related content.

Critical Vulnerability in Application Insights Profiler

CVE-2026-49163 is a Critical elevation of privilege vulnerability affecting Application Insights Profiler and has a CVSS score of 8.8. Application Insights Profiler is a performance monitoring tool within Microsoft’s Azure Application Insights platform that automatically collects detailed profiling data from live applications, helping developers identify and diagnose performance bottlenecks and slow code paths in production environments.

A path traversal flaw (CWE-22) allows an authenticated attacker to elevate privileges over a network. This vulnerability has already been fully mitigated by Microsoft; no customer action is required.

Critical Vulnerability in Microsoft Entra ID

CVE-2026-62869 is a Critical spoofing vulnerability affecting Microsoft Entra ID and has a CVSS score of 8.8. An insufficient verification of data authenticity flaw (CWE-345) allows an authenticated attacker to perform spoofing over a network.

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft’s cloud-based identity and access management service, providing authentication, authorization, and single sign-on capabilities for users accessing Microsoft and third-party applications and resources.

Critical Vulnerability in Azure SQL Managed Instance

CVE-2026-62836 is a Critical elevation of privilege vulnerability affecting Azure SQL Managed Instance and has a CVSS score of 8.7. Azure SQL Managed Instance is a fully managed cloud database service that provides broad SQL Server engine compatibility while running on Azure infrastructure. An improper restriction of communication channel to intended endpoints flaw (CWE-923) could allow an unauthenticated remote attacker to elevate their privileges over a network.

Patch Tuesday Dashboard in the Falcon Platform

For a visual overview of the systems impacted by this month’s vulnerabilities, you can use our Patch Tuesday dashboard. This can be found in the CrowdStrike Falcon® platform within the Exposure Management > Vulnerability Management > Dashboards page. The preset dashboards show the most recent three months of Patch Tuesday vulnerabilities.

Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies

As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists. 

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization’s methods for cybersecurity and improve your overall security posture.

The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.

Learn More

Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposures here.

About CVSS Scores

The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article. 

Additional Resources

• For more information on which products are in Microsoft’s Extended Security Updates program, refer to the vendor guidance here.
• Learn how Falcon Exposure Management can help you discover and manage vulnerabilities and other exposures in your environments. 
• Make prioritization painless and efficient. Watch how Falcon Exposure Management enables IT staff to improve visibility with custom filters and team dashboards.
• Test CrowdStrike next-gen antivirus for yourself with a free trial of CrowdStrike® Falcon Prevent™.
• Experience Fal.Con 2026 from anywhere with Fal.Con Digital, featuring keynote livestreams and on-demand access to 100+ sessions.

The post August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs appeared first on MASSIVE News.

Layer 1: Infrastructure Isolation (Network)

Harness environments sit on an isolated VLAN or segmented network with restrictive firewall policy. Egress is default-deny; only explicitly required destinations, such as the model API endpoint, are reachable, and outbound traffic is routed through controlled proxies that provide inspection and logging. Higher-risk workloads additionally run in separate cloud projects/accounts with their own restricted identities, environment-specific logging, and independent access controls. Even if every inner layer fails, an agent has no general route to the internet or to adjacent internal systems.

Layer 2: Sandbox Isolation (Virtual Machine)

Each harness runs inside a dedicated virtual machine, never on operator workstations or shared hosts. Agents never perform host operations directly. The VM boundary ensures even a full compromise of the harness environment is confined to a disposable guest that can be snapshotted, inspected, and reverted. Where a workload interacts with anything production-like, a simulated environment is substituted for the real system.

Layer 3: OS-Level Containment (Containers and Syscall Filtering)

Within the VM, agent workloads and any software being tested run inside containers such as Docker and Kubernetes, which separates untrusted or experimental code from the harness tooling itself, with workload-specific runtime, filesystem, and resource constraints. Kernel-level controls, including seccomp syscall filtering, AppArmor profiles, and unprivileged container execution, constrain what containerized processes can ask of the operating system, limiting the blast radius of any misbehaving workload. Where a specific workload requires relaxed settings, the exception is explicit, scoped to that container, escalated for human approval (see Layer 6c), and compensated for by Layers 1-2.

Layer 4: ward: Process Capability Confinement

ward is our capability-based sandbox and tracing telemetry capture for AI agents. Its core principle is to confine the agent process to exactly the filesystem paths and network endpoints it needs, enforced by the OS kernel rather than by anything the agent or its harness can influence.

Where Layers 2-3 answer “If the agent escapes its execution environment, what can it reach?” ward answers a complementary question: “What can this agent process touch on this machine at all across filesystem, network, credentials?” It is not a substitute for the container/VM tier and is never deployed alone; the two operate together.

Layer 5: ward-mcp: Tool-Call Mediation

Shell commands are not an agent’s only route to consequential action. Agents also act through tools, including MCP servers, API gateways, and workflow endpoints. ward-mcp intercepts MCP JSON-RPC tool calls and enforces allow/deny policy at the protocol layer, providing an independent check above the kernel layer and alongside the command layer. It closes the channel that command filtering cannot see. 

Enforcement covers:

• Allowlisted operations: Only named tools/methods are invocable; everything else is denied by default.
• Parameter validation: Arguments are inspected against policy, so an allowed tool cannot be steered to a disallowed destination or scope.
• Destination and volume constraints: Permitted API endpoints, request rate, and payload/result volume are bounded.

Tool-call denials and sensitive-but-permitted calls are written to the same tamper-evident audit trail as kernel-layer decisions. Denial reasons are returned to the agent so it can find a compliant path rather than repeating attempts to retry the same action.

Layer 6: Baywatch: Command Line Action Control

Baywatch is our harness-agnostic, per-command policy engine, deployed identically across all pipelines. It is enabled by default; disabling it requires an explicit opt-out flag and is not recommended. Every command receives one of four decisions: allow, allow-and-log, escalate to a human, or deny. These are enforced through four sub-layers.

6a. Hard Block: Pre-Execution Hook

A harness-level hook intercepts every shell command before it executes. The hook operates outside the agent’s control: It fires even when the agent runs in permission-skipping mode, and the agent cannot modify, disable, or route around it. Prohibited commands are rejected before execution, and the denial reason is returned to the agent.

6b. Soft Guidance: Policy in the System Prompt

Every agent receives the full action-control policy in its system prompt, including rules of engagement that define the evaluation scope. This is an efficiency measure, not a security boundary: Agents that know the rules don’t waste turns attempting blocked actions,  but compliance is never assumed. Layer 6a enforces regardless.

6c. Human-in-the-Loop (HITL) Escalation

Approval for sensitive operations is a key safeguard to stopping some of the recent documented agent escapes.

Between “always allowed” and “always denied” is a class of operations that are legitimate for some runs but consequential enough that no automated policy should decide them alone. Examples include installing new system packages, modifying harness or policy configuration, relaxing a container security option for a specific workload, requesting a raise to a resource or spend ceiling, or deleting substantial portions of the working tree.

When an agent attempts one of these operations, execution pauses, and the command is presented to a designated human operator with its full context, including the agent, command, category, and rationale. The operator may approve once, approve for the remainder of the run, or deny with feedback. The denial reason is returned to the agent, steering it toward a compliant alternative rather than repeated attempts. Escalations time out to deny if no operator responds (fail-closed), and every decision is recorded with the approver’s identity.

6d. Audit Log: Complete Decision Trail

Every blocked command, every HITL escalation and resulting human decision including the approver’s identity and timestamp, and every sensitive-but-allowed operation, such as local container or Git action, is written to an audit log with a timestamp, category, and reason. The audit log is incorporated into each run’s final report and summary, giving reviewers a complete record of what agents attempted, what was denied, what a human approved, and why.

Layer 7: Resource and Economic Containment

The six layers above bound what an agent may do. Layer 7 bounds how much it may do. It is cross-cutting rather than nested, with ceilings enforced at every boundary above.

Ceilings are fail-closed: When a limit is reached, the agent’s action is denied, the event is audited, and any request to raise a ceiling becomes a HITL escalation under Layer 6c, never an automatic grant. This also serves as a behavioral signal: An agent repeatedly hitting a ceiling is flagged for review rather than quietly throttled.

Policy Baseline: What Is Blocked, Escalated, and Allowed

The seven layers define the boundaries within which an agent operates. The policy baseline below translates those boundaries into consistent decisions about which actions are blocked, escalated for human approval, or allowed.

The policy distinguishes between the agent’s legitimate local workspace and any action that reaches outside it. The baseline below applies to every harness; individual harnesses may tighten it further, but may not silently relax it.

Residual Risk and Known Limitations

No single layer is claimed to be perfect, which is precisely why the layers are independent:

• Command filtering is pattern-based. Layer 6a matches known-dangerous command patterns. A sufficiently novel invocation could evade a pattern, which is why exfiltration is also impossible at the network layer (Layer 1), egress is independently constrained at ward-proxy (Layer 4), and consequences are confined by Layers 2-3.
• ward is not kernel-exploit-proof. ward controls what an agent process can touch: filesystem, network, credentials. It is not a machine-boundary control. A kernel exploit inside the sandbox is a different threat, addressed by the container and VM tiers (Layers 2-3), which is why ward is never deployed alone.
• Channel gates are per-channel by design. ward-mcp polices tool calls; Baywatch polices shell commands. Neither backstops the other, and an action channel we have not anticipated would bypass both. This is why enforcement does not rest on the gates: Every action, regardless of channel, is still bounded by ward’s kernel-enforced path and endpoint policy, container and VM isolation, and default-deny egress. Adding a new agent action channel requires a corresponding gate before that harness is approved.
• Prompt guidance is advisory. Layer 6b improves efficiency but is never relied upon for enforcement.
• Human approval is a judgment point, not a formality. HITL escalation concentrates risk decisions on a person; its value depends on operators reviewing context rather than approving reflexively. Approver-identity logging and per-run (not permanent) approvals are designed to keep that judgment engaged.
• Ceilings bound volume, not intent. Layer 7 prevents runaway consumption and abusive volume; it does not distinguish a legitimate high-volume run from a malicious one. Its security value is as a bound and a signal, not a classifier.
• The sandbox may intentionally contain sensitive material. Depending on the workload, the environment may hold proprietary code, test data, or security research artifacts. Live production secrets and long-lived credentials are excluded by policy (auth material is injected at the proxy and never enters the agent process) but the design goal is not to prevent all sensitive material from existing inside the environment. It is to guarantee that such material cannot leave, and that agents cannot act beyond it.

The compound effect is the core security argument: Every agent action must clear the policy gate for its channel and then survive kernel-enforced process confinement, OS-level containment, VM isolation, and network egress control. Each is an independent mechanism with an independent failure mode, and each produces an independent audit record. Because the four containment layers are channel-agnostic, defeating a single channel gate yields no path out.

Summary for Decision-Makers

As agents advance in capabilities, safety mechanisms, robustness, and testing must evolve alongside them. For decision-makers, this boils down to what risk is acceptable vs. trust of agents. At CrowdStrike, we are constantly evolving and reinforcing our agent sandboxes while developing the cutting edge of offensive and defensive agentic capabilities. Below we provide a checklist for Frontier Labs and other entities utilizing offense agents to reduce risk of escape.

Secure agent execution cannot depend on model behavior, prompt instructions, or any single control. It requires independent layers that constrain what an agent can access, which actions it can take, where data can move, and how much activity it can generate, while preserving human judgment for consequential decisions. 

By treating agents as untrusted code and containing them by construction, this architecture provides the foundation for CrowdStrike to safely push the boundaries of autonomous AI in cybersecurity. As agent capabilities advance, CrowdStrike is not only applying these systems to high-risk security workflows but defining the engineering discipline required to deploy them securely at scale.

Additional Resources

• Learn more about AIDR and CrowdStrike’s vision for securing the agentic enterprise in this video on demand: AIDR: Defining the Next Era of Cybersecurity
• Visit the Falcon AI Detection and Response product page to learn how AIDR can discover, govern, and secure enterprise-developed and third-party agents.
• Join us at Fal.Con 2026 as we bring together cyber leaders from across the industry to help secure the AI revolution.

The post Secure Agent Harness Execution: Preventing Escape appeared first on MASSIVE News.

Every change in a cloud environment creates new security decisions.

A new infrastructure as code (IaC) template needs to be validated. Cloud permissions need to be reviewed. An application release introduces new cloud interactions. A Kubernetes cluster needs protection before it goes into production. Individually, these are routine tasks. Together, they create growing operational friction that makes cloud security harder to scale.

This month’s CrowdStrike Falcon® Cloud Security innovations reduce that friction. New capabilities strengthen IaC security, streamline cloud identity investigations and remediation, provide deeper application context, expand agentless workload visibility, and simplify Kubernetes deployment. These updates, all of which are generally available, help security teams spend less time managing security operations and more time reducing cloud risk.

Reduce Friction in Infrastructure Security

Cloud infrastructure is increasingly managed as code. Terraform templates, Kubernetes manifests, IAM policies, and cloud configurations define how cloud environments are built, making IaC one of the earliest opportunities to identify misconfigurations and vulnerabilities before infrastructure is deployed.

Falcon Cloud Security now brings IaC security directly into Visual Studio Code and IntelliJ. Teams receive immediate feedback as cloud infrastructure is authored so they can identify misconfigurations and policy violations before changes progress through deployment workflows. This feedback includes remediation guidance so issues can be resolved while infrastructure is built.

Organizations can also extend Falcon Cloud Security with Custom Rego Rules for IaC scanning. Security and platform teams can create organization-specific security and compliance policies alongside CrowdStrike’s built-in detections. Custom rules integrate seamlessly with the Falcon Cloud Security CLI and surface in the Falcon console alongside native findings. This enables teams to consistently enforce infrastructure security standards and manage findings across cloud environments.

The post Falcon Cloud Security July 2026 Release: Helping Security Teams Move Faster in the Cloud appeared first on MASSIVE News.