August 2026 Patch Tuesday: One Exploited Zero-Day and 62 Critical Vulnerabilities Among 415 CVEs

August 11, 2026

Updated August 12 to add information about a newly disclosed vulnerability in Windows Defender Malware Protection Engine

Microsoft has addressed 415 vulnerabilities in its August 2026 security update release. This month's patches include fixes for one exploited zero-day vulnerability, three disclosed zero-day vulnerabilities, and 62Criticalvulnerabilities, along with 349 additional vulnerabilities of varying severity levels.

This month's leading risk types by exploitation technique areelevation of privilegewith 174 patches (42%),remote code execution(RCE) with 109 patches (26%), and information disclosure with 85 (20%).

CVE-2026-68820is anImportantelevation of privilege vulnerability affecting the Windows Ancillary Function Driver for WinSock and has aCVSSscore of7.0. A use-after-free flaw (CWE-416) allows a low-privileged local attacker to elevate privileges with no user interaction. Exploitation requires winning a race condition when a locally authenticated attacker runs a specially crafted application to trigger the flaw. Successful exploitation could allow the attacker to gain SYSTEM privileges.

Microsoft reports that this vulnerability has been exploited in the wild.

CVE-2026-62832is anImportantelevation of privilege vulnerability affecting the Windows User Profile Service and has aCVSSscore of7.8. A link following flaw (CWE-59) allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. An authenticated attacker with credentials for another local account could run a specially crafted application to load another user's registry hive, potentially gaining access to or modifying that user's data and elevating to administrator privileges.

While not confirmed at this time, CrowdStrike assesses this is likely the patch for the LegacyHive exploit released by the Nightmare-Eclipse persona in July 2026.

CVE-2026-62737is anImportantelevation of privilege vulnerability affecting the Windows kernel and has aCVSSscore of7.8. An untrusted pointer dereference flaw (CWE-822) allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. Successful exploitation could allow an attacker to gain SYSTEM privileges.

While not officially recognized by Microsoft as publicly disclosed, a Chinese-language blog was published on August 9, 2026, describing a proof-of-concept exploit that can cause a system crash.

CVE-2026-72971is anImportanttampering vulnerability affecting the Windows Container Isolation FS Filter Driver (unionfs.sys) and has aCVSSscore of5.5. Windows Container Isolation FS Filter Driver is a component of the Windows container infrastructure that provides filesystem isolation for containerized workloads. It acts as a file system filter driver that intercepts and manages file system operations, ensuring containerized processes are restricted to their designated scope and isolated from the host operating system's file system and other containers.

A link following flaw (CWE-59) allows a low-privileged local attacker to tamper with system integrity with no user interaction and low attack complexity. Successful exploitation impacts only integrity, with no effect on confidentiality or availability.

This vulnerability was publicly disclosed, though there is no evidence of exploitation in the wild. Microsoft assesses exploitation as unlikely.

CVE-2026-62815is aCriticalRCE vulnerability affecting Microsoft QUIC and has aCVSSscore of9.8. Microsoft QUIC (MsQuic) is Microsoft's open-source implementation of the QUIC transport protocol, which underpins HTTP/3 and is used across multiple Microsoft products and services for high-performance, encrypted network communication.

A use-after-free flaw (CWE-416) allows an unauthenticated remote attacker to execute code with no user interaction and low attack complexity. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.

CVE-2026-62893is aCriticalRCE vulnerability affecting Windows Deployment Services and has aCVSSscore of9.8. A use-after-free flaw (CWE-416) allows an unauthenticated attacker to execute code over a network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to the TFTP Server component of an affected service, with no authentication or user interaction required. Successful exploitation could allow the attacker to execute code on the target system.

CVE-2026-62878,CVE-2026-62817,CVE-2026-62820, andCVE-2026-65789areCriticalRCE vulnerabilities affecting Windows DNS Server and haveCVSSscores of9.8,8.8,8.1, and8.1, respectively. All four can be exploited by sending specially crafted packets to an affected DNS server with no user interaction required.

CVE-2026-62878 stems from a stack-based buffer overflow flaw (CWE-121) and allows an unauthenticated remote attacker to execute code with low attack complexity. CVE-2026-62817 stems from an out-of-bounds write flaw (CWE-787) and is limited to adjacent network attackers, exploitable by calling arbitrary endpoints from within the network. CVE-2026-62820 stems from a race condition flaw (CWE-362) and requires an attacker to win a race condition. CVE-2026-65789 stems from a use-after-free flaw (CWE-416) and requires specific network configurations and timing conditions to exploit, meaning an attacker cannot reliably exploit the issue across all environments. It has only been observed in limited scenarios.

CVE-2026-65791is aCriticalRCE vulnerability affecting Windows iSCSI Target Service and has aCVSSscore of9.8. A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code over a network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to an affected service, with no authentication or user interaction required, to execute code on the target system.

CVE-2026-62816is aCriticalRCE vulnerability affecting the Windows Reliable Multicast Transport Driver (RMCAST) and has aCVSSscore of8.8. RMCAST is the Windows kernel driver that implements PGM (Pragmatic General Multicast), a reliable multicast protocol used for one-to-many data delivery across a network.

A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code with no user interaction and low attack complexity, though exploitation is limited to adjacent network attackers. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service.

CVE-2026-62818is aCriticalRCE vulnerability affecting Windows Active Directory Certificate Services (AD CS) and has aCVSSscore of8.8. A use-after-free flaw (CWE-416) allows a low-privileged remote attacker to execute code with no user interaction and low attack complexity. An attacker could exploit this vulnerability by sending a specially crafted request to an affected AD CS service over the network.

CVE-2026-62823is aCriticalRCE vulnerability affecting Windows DHCP Server and has aCVSSscore of8.8. A heap-based buffer overflow flaw (CWE-122) allows an unauthenticated attacker to execute code over an adjacent network with low attack complexity. An attacker could exploit this by sending a specially crafted packet to an affected DHCP service, with no authentication or user interaction required, to execute code on the target system.

CVE-2026-62822andCVE-2026-62890areCriticalvulnerabilities affecting Windows GDI+ and haveCVSSscores of8.8and7.8, respectively. CVE-2026-62822 stems from an integer overflow or wraparound flaw (CWE-190) and allows an unauthorized attacker to execute code over a network. It requires user interaction: An attacker would need to convince a user to open a specially crafted file to trigger remote code execution. CVE-2026-62890 stems from a heap-based buffer overflow flaw (CWE-122) and allows an authenticated attacker to elevate privileges locally with no user interaction required. Successful exploitation of CVE-2026-62890 could grant an attacker SYSTEM privileges.

Although both vulnerabilities affect the same component, they differ in threat type, attack vector, and privilege requirements, with one enabling network-based code execution through a malicious file and the other enabling local privilege escalation.

CVE-2026-62827,CVE-2026-64921, andCVE-2026-65665areCriticalvulnerabilities affecting Microsoft SharePoint Server, all carrying aCVSSscore of8.8. CVE-2026-62827 stems from an improper authentication flaw (CWE-287), while CVE-2026-64921 stems from a missing authentication for critical function flaw (CWE-306). Both allow an authenticated attacker to elevate privileges over a network with low attack complexity. In each case, an authenticated attacker with access to the domain could perform RCE on the SharePoint server to elevate themselves to SharePoint admin.

CVE-2026-65665 stems from a deserialization of untrusted data flaw (CWE-502) and allows an authenticated attacker to execute code over a network with low attack complexity. In this case, an attacker authenticated as at least a site owner could write and inject arbitrary code to execute remotely on the SharePoint server. All three vulnerabilities require authenticated access to exploit, underscoring the importance of restricting and monitoring SharePoint permissions in addition to patching.

CVE-2026-62824is aCriticalRCE vulnerability affecting Remote Desktop Client and has aCVSSscore of8.8. A stack-based buffer overflow flaw (CWE-121) allows an unauthenticated attacker to execute code over a network. It requires user interaction. An attacker could host a malicious server and convince a user to connect to it from an affected client; when the client processes the server's response, the attacker could execute code on the client system.

CVE-2026-63515,CVE-2026-63532,CVE-2026-64898,CVE-2026-64903,CVE-2026-64909,CVE-2026-64910,CVE-2026-64911,CVE-2026-65657, andCVE-2026-70130areCriticalRCE vulnerabilities in Microsoft Office, withCVSSscores of8.4(CVE-2026-70130) and7.8(all others). These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is an attack vector for CVE-2026-63515, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, and CVE-2026-65657. Preview Pane is not an attack vector for CVE-2026-64910 and CVE-2026-64911. CVE-2026-70130 does not specify if Preview Pane is an attack vector.

CVE-2026-66802andCVE-2026-71331areCriticalRCE vulnerabilities affecting the Microsoft Azure Attestation service and Device Health Attestation (DHA) service. Both carry aCVSSscore of8.1.

CVE-2026-66802 stems from a race condition flaw (CWE-362) and requires the attacker to win a race condition to succeed. CVE-2026-71331 stems from an integer overflow or wraparound flaw (CWE-190) and instead requires the attacker to have deep knowledge of the target environment and configuration. Both vulnerabilities allow an unauthenticated attacker to execute code over a network with high attack complexity and no user interaction; in each case, an attacker could exploit the flaw by sending a specially crafted packet to an affected service to execute code on the target system.

CVE-2026-62819is aCriticalRCE vulnerability affecting Windows Routing and Remote Access Service (RRAS) and has aCVSSscore of8.1. RRAS is a Windows Server service that provides routing and remote access functionality, enabling organizations to deploy VPN, dial-up, and site-to-site connectivity solutions.

A use-after-free flaw (CWE-416) could allow an unauthenticated remote attacker to execute arbitrary code over a network. Successful exploitation requires an attacker to win a race condition. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network, with no authentication or user interaction required.

CVE-2026-62889is aCriticalRCE vulnerability affecting Windows Secure Socket Tunneling Protocol (SSTP) and has aCVSSscore of8.1. SSTP is a Microsoft VPN protocol that tunnels Point-to-Point Protocol (PPP) traffic through an SSL/TLS channel; it’s commonly used to provide secure remote access to corporate networks over HTTPS. A double free flaw (CWE-415) could allow an unauthenticated remote attacker to execute arbitrary code over a network. Successful exploitation requires an attacker to win a race condition. An attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network, with no authentication or user interaction required.

CVE-2026-66799is aCriticalelevation of privilege vulnerability affecting Windows Key Guard and has aCVSSscore of7.8. A heap-based buffer overflow flaw (CWE-122) allows an authenticated attacker to elevate privileges locally with low attack complexity. Successful exploitation could allow an attacker to gain Virtual Trust Level 1 (VTL1) privileges, escalating beyond the access normally permitted to a standard local user.

CVE-2026-63513,CVE-2026-63519,CVE-2026-63526,CVE-2026-65664, andCVE-2026-66807areCriticalRCE vulnerabilities in the Microsoft Office Graphics Component, all withCVSSscores of7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is an attack vector for CVE-2026-63513, CVE-2026-63519, CVE-2026-63526, and CVE-2026-66807, but is not an attack vector for CVE-2026-65664.

CVE-2026-63518,CVE-2026-63525, andCVE-2026-64907areCriticalRCE vulnerabilities in Microsoft Office Word, all with aCVSSscore of7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is not an attack vector for any of these vulnerabilities.

CVE-2026-68794,CVE-2026-68804, andCVE-2026-68816areCriticalRCE vulnerabilities in Microsoft Excel, all with aCVSSscore of7.8. These vulnerabilities allow unauthenticated attackers to execute arbitrary code locally through the following flaws:

Exploitation requires an attacker to convince a user to open a specially crafted malicious Office file. Preview Pane is not an attack vector for any of these vulnerabilities.

CVE-2026-62911is aCriticalelevation of privilege vulnerability affecting Microsoft Exchange Server and has aCVSSscore of8.0. An authentication bypass by capture-replay flaw (CWE-294) could allow an authorized remote attacker to elevate their privileges over a network. An attacker who successfully exploited this vulnerability could take over the mailboxes of all Exchange users, send and read emails, and download attachments.

CVE-2026-62896,CVE-2026-62918, andCVE-2026-65667areCriticalvulnerabilities affecting Microsoft Teams, withCVSSscores of10.0(CVE-2026-65667),9.6(CVE-2026-62896), and7.5(CVE-2026-62918). CVE-2026-65667 and CVE-2026-62896 are elevation of privilege vulnerabilities, while CVE-2026-62918 is a spoofing vulnerability. These vulnerabilities exploit the following flaws:

CVE-2026-63508is aCriticalelevation of privilege vulnerability affecting Microsoft Planetary Computer Pro and has aCVSSscore of10.0. Microsoft Planetary Computer Pro is a cloud-based geospatial analysis platform that provides access to large-scale environmental and earth observation datasets, primarily used by researchers and data scientists working with satellite imagery and climate data.

A missing authentication for a critical function flaw (CWE-306) allows an unauthenticated remote attacker to elevate privileges with no user interaction and low attack complexity. The vulnerability has a changed scope impact, affecting confidentiality and integrity but not availability.

CVE-2026-56162andCVE-2026-63522areCriticalelevation of privilege vulnerabilities affecting Azure SQL Database and haveCVSSscores of10.0and7.8, respectively. CVE-2026-56162 stems from an improper authentication flaw (CWE-287) and allows an unauthenticated remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability. CVE-2026-63522 stems from an incorrect permission assignment for a critical resource flaw (CWE-732) and allows a low-privileged local attacker to elevate privileges with no user interaction and low attack complexity. Successful exploitation of CVE-2026-63522 could allow an attacker to gain SQL sysadmin privileges.

CVE-2026-50515is aCriticalRCE vulnerability affecting Azure Service Bus and has aCVSSscore of9.9. Azure Service Bus is a fully managed enterprise message broker service used to decouple applications and services from one another, commonly used to pass data between applications via message queues and publish-subscribe topics in cloud and hybrid architectures.

A deserialization of untrusted data flaw (CWE-502) allows a low-privileged remote attacker to execute code over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

CVE-2026-59115is aCriticalelevation of privilege vulnerability affecting the Microsoft Entra Provisioning Service (SyncFabric) and has aCVSSscore of9.9. The Microsoft Entra Provisioning Service is responsible for automating the synchronization of user identities and group memberships between Microsoft Entra ID (formerly Azure Active Directory) and connected applications and directories.

A path traversal flaw (CWE-35) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

CVE-2026-50481is aCriticalelevation of privilege vulnerability affecting Azure Active Directory and has aCVSSscore of9.9. A modification of assumed-immutable data flaw (CWE-471) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact. Exploitation could allow an attacker to tamper with data that the system treats as trusted and unmodifiable, potentially enabling unauthorized privilege escalation within the identity platform.

CVE-2026-62830is aCriticalelevation of privilege vulnerability affecting Azure SRE Agent and has aCVSSscore of9.9. Azure SRE Agent is an AI-powered site reliability engineering service that autonomously monitors, diagnoses, and remediates issues in Azure-hosted applications and infrastructure.

A missing authorization flaw (CWE-862) allows a low-privileged remote attacker to elevate privileges over a network with no user interaction, low attack complexity, and a changed scope impact across confidentiality, integrity, and availability.

CVE-2026-62873is aCriticalelevation of privilege vulnerability affecting the Microsoft 365 Admin Center and has aCVSSscore of9.8. The Microsoft 365 Admin Center is the centralized web-based management portal used by organizational administrators to manage users, licenses, services, and security settings across the Microsoft 365 suite, making it a high-value target given the breadth of administrative access it provides.

An improper verification of cryptographic signature flaw (CWE-347) allows an unauthenticated remote attacker to elevate privileges over a network with no user interaction and low attack complexity, with full impact to confidentiality, integrity, and availability.

CVE-2026-70332is aCriticalspoofing vulnerability affecting Microsoft SharePoint Online and has aCVSSscore of9.6. A cross-site scripting flaw (CWE-79) allows an unauthenticated attacker to perform spoofing over a network.

CVE-2026-56161is aCriticalinformation disclosure vulnerability affecting Azure Logic Apps and has aCVSSscore of9.6. An improper access control flaw (CWE-284) allows an authenticated attacker to disclose information over a network.

Azure Logic Apps is a cloud-based integration platform that lets organizations automate workflows and connect systems like SaaS applications, on-premises services, and databases with minimal custom code. Since these workflows often carry sensitive business data and credentials, an information disclosure flaw here could expose data flowing through an organization's connected systems.

CVE-2026-50516is aCriticalelevation of privilege vulnerability affecting Microsoft Azure Kubernetes Service and has aCVSSscore of9.4. A missing authentication for critical function flaw (CWE-306) allows an unauthenticated attacker to elevate privileges over a network.

CVE-2026-59118is aCriticalelevation of privilege vulnerability affecting Microsoft Copilot Cowork and has aCVSSscore of9.3. An improper authorization flaw (CWE-285) allows an unauthenticated attacker to elevate privileges over a network with low attack complexity, requiring user interaction. The vulnerability has a changed scope impact, affecting confidentiality and integrity but not availability.

Microsoft Copilot Cowork is an AI-powered collaboration agent within the Microsoft 365 Copilot ecosystem, designed to work alongside users on shared tasks and content across Microsoft 365 apps. Because Cowork operates with access to organizational content and collaborates directly within user workflows, an authorization flaw could allow an attacker to escalate privileges and improperly access or manipulate data across connected Microsoft 365 services.

CVE-2026-68823is aCriticalRCE vulnerability affecting Azure Confidential Ledger and has aCVSSscore of9.1. An exposed dangerous method or function flaw (CWE-749) allows an authenticated attacker to execute code over a network.

Azure Confidential Ledger is a tamper-proof, blockchain-based data store designed to maintain sensitive records with cryptographic integrity guarantees. Because organizations rely on it to preserve trust in critical audit and compliance data, a code execution flaw could undermine the integrity assurances the service is meant to provide.

CVE-2026-65668is aCriticalelevation of privilege vulnerability affecting Microsoft Purview eDiscovery and has aCVSSscore of8.8. An improper access control flaw (CWE-284) allows an authenticated attacker to elevate privileges over a network. This vulnerability has already been fully mitigated by Microsoft; no customer action is required.

Microsoft Purview eDiscovery is a compliance tool used to search, hold, and export content such as emails and documents across Microsoft 365 for legal investigations and regulatory requirements. Because eDiscovery grants access to potentially privileged and sensitive organizational data during legal proceedings, an access control flaw could let an attacker escalate privileges and gain unauthorized visibility into confidential case-related content.

CVE-2026-49163is aCriticalelevation of privilege vulnerability affecting Application Insights Profiler and has aCVSSscore of8.8. Application Insights Profiler is a performance monitoring tool within Microsoft's Azure Application Insights platform that automatically collects detailed profiling data from live applications, helping developers identify and diagnose performance bottlenecks and slow code paths in production environments.

A path traversal flaw (CWE-22) allows an authenticated attacker to elevate privileges over a network. This vulnerability has already been fully mitigated by Microsoft; no customer action is required.

CVE-2026-62869is aCriticalspoofing vulnerability affecting Microsoft Entra ID and has aCVSSscore of8.8. An insufficient verification of data authenticity flaw (CWE-345) allows an authenticated attacker to perform spoofing over a network.

Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud-based identity and access management service, providing authentication, authorization, and single sign-on capabilities for users accessing Microsoft and third-party applications and resources.

CVE-2026-62836is aCriticalelevation of privilege vulnerability affecting Azure SQL Managed Instance and has aCVSSscore of8.7. Azure SQL Managed Instance is a fully managed cloud database service that provides broad SQL Server engine compatibility while running on Azure infrastructure. An improper restriction of communication channel to intended endpoints flaw (CWE-923) could allow an unauthenticated remote attacker to elevate their privileges over a network.

Approximately two and a half hours after Microsoft's Patch Tuesday disclosures, the purported researcher MSNightmare released ShieldBreak, a proof-of-concept exploit for a local privilege escalation vulnerability purportedly bypassing the patch forCVE-2026-50656(RoguePlanet) in the Microsoft Defender Malware Protection Engine on fully patched Windows 11 25H2 and Windows Server 2025.

MSNightmare claims ShieldBreak demonstrates that Microsoft's fix for the RoguePlanet TOCTOU race condition in mpengine.dll is incomplete, allowing a standard user to escalate to SYSTEM privileges. Unlike RoguePlanet, which was limited to desktop editions and exhibited race condition unreliability, MSNightmare reports that ShieldBreak achieves a 100% success rate in their testing and extends support to Windows Server editions. Based on preliminary analysis, the exploit abuses Defender's Cloud Files API through object manager symlinks and byte-range locks. MSNightmare reports the bypass mechanism differs sufficiently from RoguePlanet to evade existing signature-based mitigations.

CrowdStrike's analysis assesses ShieldBreak as a low threat at the time of this writing. While testing showed the exploit was functional on Patch Tuesday, Microsoft appears to have rapidly deployed Defender signature updates that now most likely block this specific exploit. As Defender itself is a required component for exploitation, these rules appear to effectively neutralize the current exploit’s effectiveness. However, it is presently unknown if the deployed signature will also block modified or obfuscated variants of the exploit. Organizations that were running Defender without updated signatures on Patch Tuesday may have had a brief window of exposure, but the updated Defender signatures appear sufficient to block this exploit in its current public state.

At the time of this writing, no CVE has been assigned and no patch is available. ShieldBreak is the tenth release in the Nightmare-Eclipse series, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, GreatXML, RoguePlanet, and LegacyHive. MSNightmare is associated with the Nightmare-Eclipse persona, some of whose previously released vulnerabilities have been confirmed to be exploited in the wild.

For a visual overview of the systems impacted by this month’s vulnerabilities, you can use our Patch Tuesday dashboard. This can be found in the CrowdStrike Falcon® platform within the Exposure Management > Vulnerability Management > Dashboards page. The preset dashboards show the most recent three months of Patch Tuesday vulnerabilities.

As we have learned with other notable vulnerabilities, such asLog4j, not every highly exploitable vulnerability can be easily patched. As is the case for theProxyNotShellvulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists.

Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization's methods for cybersecurity and improve your overall security posture.

The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries.Watch this demo to see the Falcon platform in action.

Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposureshere.

TheCommon Vulnerability Scoring System(CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoringin this article.

Try CrowdStrike free today

Sign up now to receive the latest notifications and updates from CrowdStrike