Unsubscribe
Welcome to the August 2026 edition of Patch Monday.
This month’s patch cycle includes security updates from Adobe, Google Chrome, Mozilla, and Zoom. While most vendors delivered a relatively routine set of updates, Adobe Campaign Classic and Google Chrome deserve particular attention this month.
Here’s what you need to know.
Adobe Campaign Classic: Patch This One Now
Let’s start with the update that should be at the top of your patching queue. Adobe released security updates for several products this month, but Adobe Campaign Classic stands out. The vulnerability affects both Windows and Linux platforms and applies specifically to full on-premises deployments. Adobe-hosted instances have already been remediated. There are several reasons this deserves immediate attention.
Priority 1 | CVSS 10.0 | Arbitrary Code Execution
The update addresses three CVEs associated with arbitrary code execution vulnerabilities and Adobe has assigned the bulletin its highest Priority 1 rating. Adobe recommends deploying the update within 72 hours. A CVSS score of 10.0 is as serious as it gets. Combine that with arbitrary code execution and a Priority 1 vendor rating, and this is not a vulnerability you want lingering in your backlog. If you have an affected on-premises Adobe Campaign Classic deployment, patch it as soon as possible.
Chrome: 766 Vulnerabilities and Counting
Google Chrome had another exceptionally busy month. In the past 30 days alone, Chrome has addressed 766 vulnerabilities, making this the largest Chrome patch volume we've seen so far this year. Chrome also received six separate version updates during that period, addressing 26 Critical-rated vulnerabilities. There is one important piece of good news: none of the vulnerabilities were known zero-days at the time the respective updates were released. That doesn't mean you should wait. The combination of 766 vulnerabilities, 26 Critical-rated issues, and six separate browser update releases makes Chrome a significant patch-management priority this month. Browsers are particularly attractive targets because they sit directly on the endpoint attack surface and routinely process untrusted content. Make sure Chrome is fully patched across your environment. The latest version is listed in the chart below.
Mozilla & Zoom: Business as Usual For Mozilla and Zoom
August was a relatively normal patch cycle. Both vendors released their expected security updates, but there were no major developments that require additional attention beyond your normal patch-management process.
3rd Party Patch Priorities for August
If you're trying to prioritize your August patch workload, I'd put these two at the top:
1. Adobe Campaign Classic — CRITICAL Priority 1, CVSS 10.0, and multiple arbitrary code execution vulnerabilities. Patch immediately if affected.
2. Google Chrome — HIGH PRIORITY with 766 vulnerabilities addressed in 30 days, including 26 Critical-rated vulnerabilities. Get endpoints updated.
3. The remaining Mozilla and Zoom updates should be incorporated into your normal monthly patch cycle.
As always, review the complete table below for affected products, versions, CVEs, severity ratings, and recommended updates.
Stay secure, stay patched, and happy patching!
|
|
So, without further ado, here’s the chart of non-Microsoft 3rd party patches that affect Windows platforms in the past month.
|
Patch data provided by: |
|||||
|
Identifier |
Vendor/ |
Affected Versions |
Date Released |
Vulnerability Info |
Vender Severity / Our Recommendation |
|
Adobe Campaign Classic |
v7: 7.4.4. build 9400 and earlier |
8/25/2026 |
Arbitrary Code Execution |
Critical Priority 1: Update within 72 hours |
|
|
Adobe Content Credentials SDK |
Rust SDK c2pa-v0.89.0 and earlier |
8/25/2026 |
Arbitrary File System Read, Application DoS |
Critical Priority 3: Update at admins discretion |
|
|
Adobe Illustrator |
2025 29.8.9 and earlier |
8/25/2026 |
Memory Exposure |
Important Priority 3: Update at admins discretion |
|
|
Adobe Substance 3D Designer |
16.0.4 and earlier |
8/25/2026 |
Arbitrary Code Execution, Application DoS |
Critical Priority 3: Update at admins discretion |
|
|
Adobe Substance 3D Painter |
12.1.2 10 and earlier |
8/25/2026 | Arbitrary Code Execution, Memory Exposure |
Critical Priority 3: Update at admins discretion | |
|
Adobe Substance 3D Sampler |
6.0.1 and earlier |
8/25/2026 | Arbitrary Code Execution |
Critical Priority 3: Update at admins discretion |
|
|
Adobe XD |
60 and earlier |
8/25/2026 | Arbitrary Code Execution |
Critical Priority 3: Update at admins discretion |
|
|
Google |
Before 152.0.7977.64/.65 (Windows/Mac) |
8/25/2026 |
Buffer Overflow, Cryptographic Flaw, Improper Input, Improper Privilege Management, Inappropriate Implementation, Incorrect Authorization, Incorrect Security UI, Information Leak, Code Injection, Insufficient Policy, Insufficient Validation, Integer Overflow, Memory Corruption, Out of Bounds Read/Write, Privilege Elevation, Race Condition, Side Channel Leak, Type Confusion, Uninitialized Use, Use After Free |
Update after testing | |
|
Mozilla Thunderbird |
Before 154 |
8/18/2026 |
Clickjacking Denial of Service, Information Disclosure, Integer Overflow, JIT Miscompilation, Mitigation Bypass, Policy Bypass, Privilege Escalation, Race Condition, Sandbox Escape, Side Channel, Site Isolation Issue, Use After Free |
Update after testing |
|
|
Mozilla Firefox |
Before 154 |
8/18/2026 |
Clickjacking, Denial of Service, Information Disclosure, Integer Overflow, JIT Miscompilation, Memory Corruption, Mitigation Bypass, Policy Bypass, Privilege Escalation, Race Condition, Sandbox Escape, Side Channel, Site Isolation Issue, Spoofing, Use After Free |
Update after testing |
|
|
Mozilla Firefox ESR |
Before 153.1 |
8/18/2026 |
Clickjacking, Denial of Service, Information Disclosure, Integer Overflow, JIT Miscompilation, Mitigation Bypass, Policy Bypass, Privilege Escalation, Race Condition, Side Channel, Site Isolation Issue, Use After Free |
Update after testing |
|
|
Mozilla Firefox for iOS |
Before 155.0 |
8/31/2026 |
Spoofing |
Update after testing |
|
|
Mozilla Firefox for Android |
Before 153.0.3 |
8/4/2026 |
Information Disclosure |
Update after testing |
|
|
Zoom Workplace VDI |
Client for Windows before 7.0.11 and 6.6.15 |
8/11/2026 |
Path Traversal |
Sev High - Update after testing |
|
|
Zoom Clients |
Workplace all platforms before 7.1.0 and 7.0.6 |
8/11/2026 |
Buffer Overwrite |
Sev High - Update after testing |
|
|
Zoom Clients |
Workplace all platforms before 7.1.0 and 7.0.6 Workplace VDI Client for Windows before 7.0.11 and 6.6.16 Rooms and Meeting SDK all platforms before 7.1.0 Video SDK all platforms before 2.6.0 |
8/11/2026 |
Buffer Over-read |
Sev Medium - Update after testing |
|
|
Zoom Clients |
Workplace all platforms before 7.1.5 and 7.0.6 |
8/11/2026 |
Use After Free |
Sev High - Update after testing |
|
Thanks as always for reading and best wishes on security,
Randy Franklin Smith
Ultimate Windows Security is a division of Monterey Technology Group, Inc. ©2006-2026 Monterey Technology Group, All rights reserved. You may forward this email in its entirety but all other rights reserved.
1162 Manus Chapel Road, Mill Springs, NC 28756
Note: We do our best to provide quality information and expert commentary but use all information at your own risk.