August 2026 Patch Tuesday: Office Bugs That Fire From the Preview Pane

, , , , , , , , ,

Microsoft’s August 2026 Patch Tuesday landed on Tuesday August 11 and it was another monster: 421 security bugs fixed across Microsoft products, including some serious bugs that work just by previewing an Office document.

Overall, Microsoft’s own tally lists 98 vulnerabilities in Office alone, across Word, Excel, PowerPoint, Outlook, Access and the shared Office components.

Why you should update now

The details are below, but the short version is this …

All Office and Microsoft 365 users should update quickly.

That’s because there are at least ten Critical Office bugs this month that can be triggered through the Preview Pane, meaning a user does not have to open anything at all. Previewing a file in Outlook’s reading pane or in File Explorer is enough to run the attacker’s code on an unpatched machine. No macro warning, no “Enable Content” click, no obvious trap.

If you use Office on Windows, update this week rather than waiting for your normal monthly cycle. The Preview Pane bugs bypass one common step that usually saves people from infection. The fix takes about two minutes. Open any Office app, go to File | Account | Update Options | Update Now. Then run Windows Update as well.

If you cannot patch immediately, turn off the Preview Pane in Outlook and File Explorer as a stopgap.

The Preview Pane security bug in detail

Microsoft flags “Preview Pane is an attack vector” in individual advisories, and this month that flag appears on a lot of them. Ten Critical remote code execution bugs in Office carry it:

Microsoft Office (six bugs, all CVSS 7.8):

Microsoft Office Graphics Component (four bugs, all CVSS 7.8):

The Graphics Component is the shared code that renders images inside Office documents. That is exactly the kind of component a preview handler calls, which is why these four are previewable. A malicious image embedded in a Word document or a PowerPoint file can do the damage before the file is ever opened properly.

The highest scoring Office bug of the month is CVE-2026-70130 at CVSS 8.4, a heap based buffer overflow in Office. Microsoft’s advisory does not say whether the Preview Pane is an attack vector for it, which is not reassuring.

The good news, such as it is

The Critical bugs specific to Word (CVE-2026-63518, CVE-2026-63525, CVE-2026-64907) and Excel (CVE-2026-68794, CVE-2026-68804, CVE-2026-68816) do not list the Preview Pane as an attack vector. Those still need a user to actually open the file. Small comfort, since opening attachments is what people do all day.

The Office fixes by app

Excel (27 CVE’s) and the shared Office suite code |35) took the brunt, which is the usual pattern.

Word, as always, had plenty of security holes, 17 this month.

Outlook only picks up three CVEs directly, including CVE-2026-70329, a remote code execution flaw. But Outlook is the delivery mechanism for most of the rest, so a light Outlook count does not mean Outlook users are safe.

Version numbers to check

Here is what a patched installation should show. Check with File | Account | About.

  • Microsoft 365, Current Channel: Version 2607, Build 20228.20190
  • Microsoft 365, Monthly Enterprise Channel: Version 2607, Build 20228.20188
  • Microsoft 365 Semi Annual Enterprise Channel: Version 2607, Build 20228.20186
  • Office 2024 and Office 2021 Retail: Version 2607, Build 20228.20190
  • Office LTSC 2024 Volume Licensed: Version 2408, Build 17932.20910
  • Office LTSC 2021 Volume Licensed: Version 2108, Build 14334.20848
  • Office 2019 Volume Licensed: Version 1808, Build 10417.20197
  • Office for Mac: Version 16.111.3, Build 26080215

Office for Mac gets a long list of the same CVE fixes, including CVE-2026-66807, so Mac users should not assume they are out of the firing line.

Windows zero-day security bugs

The exploited zero day is CVE-2026-68820, a use-after-free flaw in Windows’ afd.sys driver that lets an attacker with local access escalate to SYSTEM privileges, potentially turning an initial phishing-related foothold into full machine and network compromise. Microsoft has confirmed real-world exploitation, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on August 11, making rapid patching the sensible deadline for everyone, not just US federal agencies.

The two other zero days were publicly disclosed rather than exploited:

  • CVE-2026-62832, Windows User Profile Service elevation of privilege, CVSS 7.8. Microsoft says exploitation is likely. This could be a fix for the LegacyHive exploit released publicly in July. Chained with CVE-2026-68820,, it gives an attacker a straightforward route from a small foothold to full control.
  • CVE-2026-72971, a tampering flaw in the Windows Container Isolation FS Filter Driver (unionfs.sys), CVSS 5.5. Low impact and only relevant if you run Windows containers.

On the Windows side, the cumulative update is KB5121003, taking Windows 11 to builds 26200.9168 (version 25H2) and 26100.9168 (version 24H2). Eligible devices can take it as a hotpatch with no reboot.

Worth a diary note: Windows 11 version 24H2 Home and Pro reach end of support in October 2026. If you are still on 24H2, start planning the move now rather than in September.

Everything else worth knowing

Beyond Office and the zero days, a few items stand out for anyone running a small business network or a home server:

  • Windows DNS Server has four Critical remote code execution bugs, topped by CVE-2026-62878 at CVSS 9.8. If you run a domain controller, patch it first.
  • Microsoft QUIC (CVE-2026-62815), Windows Deployment Services (CVE-2026-62893) and Windows iSCSI Target Service (CVE-2026-65791) all sit at CVSS 9.8 and all allow unauthenticated code execution over the network.
  • Exchange Server gets CVE-2026-62911, CVSS 8.0. Microsoft says a successful attack could take over the mailboxes of every Exchange user, reading mail and downloading attachments. Only seven Exchange CVEs this month, but that one matters.
  • SharePoint Server picks up 30 fixes, including three Critical bugs.
  • Microsoft Teams has CVE-2026-65667 at CVSS 10.0, but Microsoft has already fixed it service side. No action needed.

About CVSS ratings

A quick word on the CVSS numbers: CVSS (Common Vulnerability Scoring System) rates a flaw’s severity from 0 to 10, based on how easy it is to exploit and how much damage it does.

Anything from 9.0 up is Critical, 7.0 to 8.9 is High, 4.0 to 6.9 is Medium and below that is Low. The score measures the bug itself, not your risk from it, so a 7.8 that fires from the Preview Pane deserves more of your attention than a 9.8 in a service you don’t run.