August 2026 Patch Tuesday Testing Guidance

Microsoft’s August 2026 Patch Tuesday is a security-only release: 109 Windows test-guidance entries, four of them High Risk (July had fourteen). Printing and fonts are the centre of gravity — win32kfull.sys, the kernel-mode window manager, is the most-patched binary (seven entries) and carries three of the four High Risk flags, covering printing from 32-bit applications on 64-bit Windows and font rendering. The fourth is the Remote Desktop client (mstscax.dll) and its redirection paths. Telephony (TAPI, eleven entries) and DNS Server (six) are the busiest of the rest, but lower risk.

Printing, Fonts, and Graphics (High Risk)

Three of the four High Risk flags sit in win32k and touch print or font code paths — printing from 32-bit applications on 64-bit Windows (two flags) and font rendering (one). GDI+, the Windows Imaging Component, and the kernel graphics driver (dxgkrnl.sys, five entries) change alongside. Any estate with 32-bit line-of-business apps printing on 64-bit Windows, or with font-heavy documents, takes this first.

Print from your 32-bit applications to physical and virtual (PDF or XPS) printers, using text-heavy, graphics-heavy, and multi-page documents, and repeat after each relaunch, orientation, scaling, and resolution change
Render varied fonts, sizes, and styles across browsers, Office, PDF viewers, and Notepad, and confirm Print Preview matches the printed page — watch for clipping, distortion, or missing glyphs
Copy and paste images between Paint, Word, and Excel at different bit depths, and open EMF and TIFF files
Exercise the graphics kernel: full-screen DirectX, multi-monitor hot-plug, resolution, HDR, and DPI changes, and sleep/resume

Remote Desktop and Remote Access (High Risk)

The RDP client (mstscax.dll) carries the fourth High Risk flag, and the fixes touch every redirection path and how sessions behave when several run at once. RemoteApp, the display pipeline, and the RRAS and SSTP VPN stack change alongside.

Open several concurrent RDP sessions, enable printer, clipboard, audio, drive, and smart card redirection together, and exercise each across the sessions, confirming none interferes with another
Disconnect and reconnect a session, confirm redirected devices and drives reattach, and test a RemoteApp end to end
Configure a standard client VPN and an SSTP VPN over HTTPS, and confirm sustained connections across reconnects and a restart

The SMB client and server, NTFS and UDFS, the virtualised file layers (Cloud Files, Projected File System, Work Folders), and the platform stack — Hyper-V, virtual TPM, USB, and Windows Installer — all change. Broad, but Standard Risk.

Connect to SMB shares (including RDMA, leases, and Continuous Availability), copy large sets both ways, and interrupt and reconnect a session; exercise NTFS extended attributes, UDF mounts, and cloud-file hydrate and dehydrate
Create, checkpoint, and export a Generation 2 Hyper-V VM, enable a virtual TPM and BitLocker, and connect USB storage and MIDI devices
Install, repair, and uninstall an MSI package, and confirm UAC elevation still prompts

Telephony, Networking, and Core Services

TAPI is the busiest component (eleven entries) but carries only parity fixes; the rest spans TCP/IP, HTTP.sys, Windows Firewall, Bluetooth, wired 802.1X, and message queuing. Keep this broad and shallow.

Exercise TAPI line status and dialling locations against a shared line, and verify HTTP.sys under IIS over HTTP/1.1, HTTP/2, and HTTP/3
Confirm TCP/IP IPsec tunnels on IPv4 and IPv6, toggle Windows Firewall rules across a restart, pair a Bluetooth headset, authenticate wired 802.1X, and validate MSMQ send and receive

Office & SharePoint

August’s Office wave is security-only and MSI-only, so Click-to-Run estates can sit this one out; the work is on Office 2016 and SharePoint Server. Everything lands on 11 August, and nothing critical or non-security shipped.

On MSI Office 2016, apply the client updates — Access (KB5002813), the ACE database engine (KB5002832), the Office proofing and UI components (KB5002791, KB5002795), Outlook (KB5002755), VBA (KB5002900), and Word (KB5002901) — then exercise macros, external data, embedded objects, and line-of-business add-ins
On SharePoint Server, patch 2016, 2019, and Subscription Edition, then check browser-based editing; mind the rollback rules — server updates cannot be uninstalled and always require a reboot

Microsoft Exchange Server

On-premises Exchange takes a security update this month — seven CVEs across Exchange Server 2016, 2019, and Subscription Edition: three elevation of privilege (CVE-2026-62910, CVE-2026-62911, CVE-2026-65813), a remote code execution (CVE-2026-62913), a denial of service (CVE-2026-62912), a spoofing (CVE-2026-62914), and a security feature bypass (CVE-2026-62915).

Apply the update from an elevated command prompt — an un-elevated run leaves Exchange services partially patched and broken — then confirm every Exchange service returns and the server reports healthy
Exercise mail flow end to end: send and receive internal and external mail, drain the transport queues, and check connectors and transport rules; confirm Outlook (MAPI over HTTP), Outlook on the web, and the Exchange admin centre for sign-in and core actions
Confirm Autodiscover and free/busy resolve, test any hybrid connection to Exchange Online, and plan for the reboot the update requires — validate in a maintenance window before production

Developer Tools: .NET

The developer estate gets a broad, low-drama sweep, and there is no SQL Server this month. Both the .NET Framework — from Windows Server 2012 up to Windows 11 24H2 — and the modern .NET runtime and SDK patch, including the WPF and WinForms desktop stacks.

Install the .NET Framework and modern .NET runtime and SDK updates, run a representative set of WPF, WinForms, web, and command-line applications, confirm normal behaviour, and build and run a .NET project to check for regressions

August 2026 Patch Tuesday Testing Priorities

If you can’t test everything at once, this is the order that retires the most risk first.

Start with printing and fonts: three of the four High Risk flags sit in win32k, so regress 32-bit printing, PDF and XPS export, font rendering, and Print Preview before anything else
Take Remote Desktop next — the fourth High Risk flag — across the redirection paths, concurrent sessions, reconnects, RemoteApp, and SSTP VPN
Give the busy but lower-risk areas a smoke pass: Telephony, the graphics kernel, DNS and DHCP, Active Directory, and the SMB stack
Close out the rest: Office is MSI-only with Click-to-Run untouched, and .NET is a representative-application check