Live Windows Security Brief for August 6, 2026: Microsoft Updates and Identity Risk

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

Why it matters: Microsoft Windows VMSwitch is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original NIST NVD and Microsoft record

CVE-2026-13379: The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers…

NIST National Vulnerability Database | July 30, 2026 | CRITICAL | CVSS 9.1

The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process

Why it matters: CVE-2026-13379 is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original NIST National Vulnerability Database record

CVE-2026-70601: Electron: Context isolation bypass via Function.prototype.bind hijack

GitHub Advisory Database | August 5, 2026 | HIGH | CVSS 7.5 | GitHub Advisory Database electron

### Impact Apps that expose Promise-returning functions to web content via `contextBridge` may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, or with `nodeIntegration` enabled, this may escalate to Node.js access. Apps are affected…

Why it matters: GitHub Advisory Database electron is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original GitHub Advisory Database record

128 Seconds to disruption: Microsoft Defender stops ransomware at QNET

Microsoft Security Blog | August 4, 2026

Microsoft Defender automatically isolated a compromised QNET endpoint in 128 seconds, stopping a multi-stage attack before the payload could persist or spread. The post 128 Seconds to disruption: Microsoft Defender stops ransomware at QNET appeared first on Microsoft Security Blog.