Live Windows Security Brief for August 5, 2026: Microsoft Updates and Identity Risk

CVE-2026-70482: Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

GitHub Advisory Database | August 5, 2026 | HIGH | CVSS 8.1 | GitHub Advisory Database open-webui

## Summary The OAuth token exchange endpoint accepts a raw provider access token and validates it by calling the provider's userinfo endpoint. A userinfo endpoint reports only that a token is valid, never which OAuth client it was issued to, and the endpoint performed no audience or client check of its own. Anyone holding an access token minted…

Why it matters: GitHub Advisory Database open-webui is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original GitHub Advisory Database record

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

Why it matters: Microsoft Windows VMSwitch is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original NIST NVD and Microsoft record

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Microsoft Security Blog | August 4, 2026

Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread. The post 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Separate confirmed applicability from broad advisory language, assign the remediation decision, and keep any exception visible with an expiry date.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original Microsoft Security Blog record

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog | August 5, 2026