Live Windows Security Brief for August 3, 2026: Microsoft Updates and Identity Risk

Live Windows and Microsoft security coverage for Patch Tuesday, identity systems, SharePoint, Exchange, endpoints, servers, and privilege exposure.

Microsoft estate view

Microsoft remediation should connect the Security Update Guide and active-exploitation signals to the specific products and builds deployed across endpoints, servers, identity platforms, and collaboration infrastructure.

For August 3, 2026, the lead development is CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation. Start by confirming where Microsoft Windows VMSwitch is deployed, who owns it, and whether the affected path is reachable. The remaining items below add the product-specific context needed to turn the headline into an owned security decision.

Windows and identity developments

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

NIST NVD and Microsoft | July 15, 2026 | CRITICAL | CVSS 9.9 | Microsoft Windows VMSwitch

Microsoft describes a network-reachable VMSwitch use-after-free that lets an authorized attacker elevate privileges. The Microsoft CNA rates it 9.9 Critical.

Why it matters: Microsoft Windows VMSwitch is likely connected to identity, collaboration, or privileged Windows workloads, where one exposed role can widen impact beyond a single endpoint.

What to verify: Map supported builds and server roles, prioritize public and identity systems, confirm the installed update plus restart state, and review authentication and EDR telemetry for abnormal activity.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original NIST NVD and Microsoft record

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

Microsoft Security Blog | August 1, 2026

Storm-2945, a sub-cluster of the Russian threat actor Midnight Blizzard, has been observed compromising the sign-in portals of hospitality-related organizations such as hotels since May 2026 in order to deliver malware to travelers and steal credentials in an operation we call CaptiveCrunch. The post CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft appeared first…

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original Microsoft Security Blog record

What’s new in Microsoft Security: July 2026

Microsoft Security Blog | July 30, 2026

This month’s updates help security and IT teams secure their AI environments, use AI to defend, and strengthen the foundations that AI-powered operations depend on. The post What’s new in Microsoft Security: July 2026 appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

Continue reading the full briefing.

What to verify: Separate confirmed applicability from broad advisory language, assign the remediation decision, and keep any exception visible with an expiry date.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original Microsoft Security Blog record

Tame Dependabot: Group your updates, slow the cadence, keep security fast

GitHub Security Blog | July 29, 2026

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog.

Why it matters: GitHub Security Blog participates in the path from source code to production. A weakness can inherit runner permissions, build secrets, trusted artifacts, or deployment access.

What to verify: Trace untrusted input through pull requests and jobs, review token scope, isolate runners, pin trusted dependencies, and rebuild affected artifacts after remediation.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original GitHub Security Blog record

Better security starts with better questions

Microsoft Security Blog | July 29, 2026

Learn how better questions, trusted AI, and human judgment help security leaders make confident decisions and build resilient systems. The post Better security starts with better questions appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Start with asset ownership and exposure, compare the fixed release with the deployed build, and validate both security behavior and service health afterward.

Operational focus: Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.

Open the original Microsoft Security Blog record

Rethinking security for the age of AI

Microsoft Security Blog | July 27, 2026

The physics of cybersecurity are changing. Introducing security's new cyber stack: Project Perception. The post Rethinking security for the age of AI appeared first on Microsoft Security Blog.

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Separate confirmed applicability from broad advisory language, assign the remediation decision, and keep any exception visible with an expiry date.

Operational focus: Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Open the original Microsoft Security Blog record

Enhancing AI security through global AI red teaming

Microsoft Security Blog | July 27, 2026

Microsoft's External Red Team Alliance (EXTRA) is a global AI security initiative designed to advance AI safety research and red teaming. By partnering with universities, researchers, and regional experts, EXTRA helps identify emerging AI risks, improve security testing, and strengthen the resilience of frontier AI systems. The post Enhancing AI security through global AI red teaming appeared first…

Why it matters: Microsoft Security Blog should be mapped to supported builds, deployed roles, restart requirements, and endpoint monitoring coverage.

What to verify: Confirm the affected version and reachable component, preserve useful telemetry, apply the publisher guidance, and record the evidence used to close the item.

Operational focus: Check supported builds, update installation, restart state, and the current running version.

Open the original Microsoft Security Blog record

Deployment plan

Connect each advisory to supported builds and deployed server roles. Identity and internet-facing systems should move before routine endpoint waves, with restart and EDR health verified afterward.

Match Microsoft and CISA records to Windows builds and server products in inventory.
Prioritize identity, SharePoint, Exchange, remote access, and domain-privileged systems.
Test monthly updates, install promptly, and validate reboot or service restart completion.
Review EDR health, tamper protection, authentication logs, and privileged group changes.
Give every patch exception a business owner, mitigation, and expiry date.

Endpoint and server checks

Check build numbers, installed updates, restart state, privileged authentication, EDR coverage, and server-role health.

Check supported builds, update installation, restart state, and the current running version.
Prioritize domain, federation, collaboration, and internet-facing servers before normal endpoint queues.
Review privileged access and endpoint telemetry for signs of abuse before and after patching.

Windows team takeaway

A successful Windows update cycle protects identity and public server roles first, proves the new build is active, and keeps every exception visible.

References used in this briefing

Microsoft estate view

Windows and identity developments

CVE-2026-57092: Windows VMSwitch use-after-free privilege escalation

CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft

​​​​What’s new in Microsoft Security: July 2026

Tame Dependabot: Group your updates, slow the cadence, keep security fast

​​Better security starts with better questions

Rethinking security for the age of AI

Enhancing AI security through global AI red teaming

Deployment plan

Endpoint and server checks

Windows team takeaway

Related briefings

Live Cybersecurity Brief for August 8, 2026: Active Threats, CVEs, and Vendor Advisories

Live Cybersecurity Brief for August 7, 2026: Active Threats, CVEs, and Vendor Advisories

Live Cybersecurity Brief for August 6, 2026: Active Threats, CVEs, and Vendor Advisories

Need to add context to this briefing?

What’s new in Microsoft Security: July 2026

Better security starts with better questions