August 2026 Third-Party Vulnerabilities and Patches 

After two record months in a row, August cooled off noticeably. During the month we identified 853 unique vulnerabilities across 85 applications, and vendors released 115 patched versions to fix them. That is a big step down from July, which set the all-time high at 1,539. So, month over month the count fell by roughly 45%. It’s worth keeping some perspective though. Even after that drop, August is still the third busiest month we have ever recorded, behind only June and July, and it sits far above the 80 to 140 range that was completely normal all the way through 2024 and 2025.  

So, this is not the trend reversing, it’s more like the line taking a breath after two months that were well outside anything we had seen before. The pullback also showed up in the spread. The number of affected applications came down from 108 in July to 85 in August, meaning this month the activity was both smaller in raw count and a little more concentrated. 

Just like in recent months, most of this activity comes from the large, coordinated security releases that Chromium-based browsers ship. Chromium products, including Google Chrome, Microsoft Edge, Brave, Opera, and Vivaldi, accounted for about 405 of the 853 vulnerabilities on their own. Once you add Firefox and Thunderbird, the browser category makes up close to 60% of everything we saw.  

The biggest single updates were Chrome 152 and Edge 152, each shipping one version that fixed 300 to 330 vulnerabilities, with Vivaldi 8.1 carrying a similar batch and Brave 1.93 along with the various Chrome and Edge 151 point releases filling in the rest. Because Chromium fixes flow down into every browser built on top of it, one upstream release spreads the same hundreds of fixes across several products and release channels. So, these numbers say more about how Chromium coordinates its patching than about hundreds of separate findings. What that also means is that the month-over-month drop is mostly browsers shipping smaller, more coordinated batches than they did in July rather than any real change in direction. 

Notable vulnerabilities in August third-party patches 

The vulnerabilities below stand out either because a working exploit already exists or because they carry an elevated EPSS score above 0.1. Both raise the odds of real-world abuse and shorten the time you have to patch safely, so they are the ones worth prioritizing this month. It was a quieter month on this front than usual, with only three that met the bar, but the one at the top of the list is a serious one. 

CVE-2025-8088 is the standout this month. It’s a high-severity, path-traversal vulnerability in WinRAR that lets an attacker execute arbitrary code by crafting a malicious archive file. It carries a CVSS score of 8.4, a working exploit exists, and it was confirmed to have been exploited in the wild, which is why it sits in CISA’s Known Exploited Vulnerabilities catalog. It also holds the highest EPSS score we saw all month at about 0.95, so this is not a theoretical risk. What makes it interesting is how it reaches our catalog. The flaw lives in the archive handling code, and it surfaces through ClamAV 1.5.4, which shares the same vulnerable component for parsing RAR files. So even if you don’t run WinRAR directly, the underlying weakness can still show up in tools you would not immediately connect to it. Anyone affected should move to WinRAR 7.13 or later, or the patched ClamAV build. More information is available in CISA’s KEV entry, WinRAR release notes, and NVD. 

CVE-2026-21710 is a high-severity denial of service vulnerability in Node.js HTTP request handling. A specially crafted request that includes a header named “proto” can trigger an uncaught error and crash the Node.js process. Because the exception is thrown inside a property getter, it cannot be caught by the usual error handling. It affects Node.js 20, 22, 24, and 25. There is no public exploit yet, but its EPSS score of roughly 0.25 is high enough to take seriously. In our catalog it reaches you through Microsoft Visual Studio 2019 and 2022, which bundle Node.js, so this is another good reminder that a flaw in a widely reused component can quietly affect a much larger product. Anyone running an affected Visual Studio build should update to one that ships the patched Node.js version. Further details are in the Node.js security release and the matching NVD entry, NVD – CVE-2026-21710. 

CVE-2008-5161 makes an unexpected appearance. This is the old plaintext recovery weakness in the SSH protocol when block ciphers are used in CBC mode. Despite dating back to 2008, it still carries an elevated EPSS score of about 0.19. Its CVSS score is low at 3.7, and it isn’t listed in CISA’s KEV catalog. Although it doesn’t carry the same urgency as the two above, it earns a mention because the elevated EPSS pushes it over the line. It reaches our catalog through Erlang OTP versions 28.5.0.5 and 29.0.5.0, which include the affected SSH implementation. Anyone running Erlang OTP should update to the patched release. More information is available in Erlang OTP SSH release notes and the NVD entry, NVD – CVE-2008-5161. 

Browser security updates in August 2026 

Browser updates were once again the biggest driver of vulnerability activity in August, following the same pattern we have seen all year. The table below breaks down the counts by browser. Google Chrome led the way with 395 vulnerabilities addressed across five updates, with Microsoft Edge close behind at 365 across five, and Vivaldi handled another 339 over three releases. Brave fixed 68 across four updates and Opera One added 20 across two.  

Because all of these browsers are built on Chromium, most of these fixes trace back to the same upstream security releases, so the counts are better read as one coordinated patching effort than as separate findings. Mozilla-based browsers were much quieter by comparison. Mozilla Firefox fixed 55 vulnerabilities in a single update, and its 115, 140, and 153 branches each handled around 31 more. Waterfox, which is also built on Firefox, remediated another 32.  

Put together, these browser numbers make up the large majority of everything disclosed this month, which is why a single busy month for Chromium can move our totals so sharply. The one difference this month is direction. After July set a record, the browser releases in August were smaller, and because browsers carry so much of the total, that lighter batch is most of the reason the overall count came back down. 

Microsoft product updates included in August 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Edge for Business 
• Microsoft Project 
• Microsoft Visio 
• Microsoft Visual Studio 2019 Enterprise 
• Microsoft Visual Studio 2019 Professional 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio Code 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of August third-party patches