MDM Monthly: August 2026 macOS, Windows, Intune Updates

This is my monthly roundup of mobile device management (MDM) and unified endpoint management (UEM) news for August 2026, covering Apple macOS and iOS, Microsoft Intune and Windows 11, Jamf, Omnissa Workspace ONE, Android Enterprise and Ivanti.

August was a patching month. A macOS Screen Sharing flaw went from a quiet Apple fix to a federal deadline in under two weeks, Microsoft’s Patch Tuesday carried about 400 CVEs including an exploited Windows zero-day, and the vendors spent the rest of the month shipping the plumbing for Apple’s move to declarative updates. Windows 11 26H2 also reached the Release Preview channel, with two lifecycle dates close behind. Details follow, with the items to act on first at the top.

Executive Summary

A macOS Screen Sharing flaw (CVE-2026-65400) went from Apple’s August 6 fix to CISA’s exploited-vulnerabilities list on August 18, with a federal due date of August 21.
Microsoft’s August Patch Tuesday carried roughly 400 CVEs, including an exploited afd.sys zero-day and a Windows DNS Server flaw described as wormable.
Intune 2608 and Omnissa UEM 2607 move Apple updates and apps to declarative management, and Windows 11 26H2 reached Release Preview.

Executive view: cost and risk

Opex: Finding which Macs were reachable on TCP 5900 is labor, and investigating exposed Macs for SSH keys, new LaunchDaemons and miner processes is the expensive case. Setting patch-level grace periods in Android compliance rules avoids false noncompliance tickets, and the move to declarative management is planned engineering work.
Capex: Windows 11 26H2 arrives as an enablement package for 24H2 and 25H2 devices, so it shouldn’t drive refresh on its own. Devices on 26H1 run a different branch and can’t move to 26H2 directly, and 24H2 Home and Pro devices that can’t move on reach end of updates on October 13.
Enterprise impact: An advisory with no exploitation note was on CISA’s exploited-vulnerabilities list 12 days later. Per Tanium’s account of the Dutch NCSC report, exposed Macs were compromised with a Monero miner, and a wormable DNS Server flaw puts Windows infrastructure at risk.
Decision needed: Add exposure checks for remote-access services to your compliance reporting. Agree a rule for when an advisory with no exploitation note still gets a fast ring, such as unauthenticated flaws reachable over the network.

Download the one-page executive brief (PDF)

Apple: a macOS Screen Sharing flaw becomes an exploited zero-day

On August 6 Apple shipped macOS Tahoe 26.6.1, Sequoia 15.7.9 and Sonoma 14.8.9, each with a single fix: CVE-2026-65400, an authentication issue in Screen Sharing. Apple’s advisory says an attacker on the network may be able to authenticate to Screen Sharing without valid credentials. It credits Alfredo Pesoli of Bynario Atlas and describes the fix as improved state management. The advisory doesn’t mention exploitation.

Exploitation followed within days. Tanium’s analysis describes a pre-authentication flaw in the screensharingd daemon on TCP port 5900 that gives root-level code execution with no user interaction. Per that analysis, the Netherlands’ NCSC reported on August 12 that internet-exposed Macs with port 5900 reachable were being compromised, with a Monero miner installed on them, and public proof-of-concept code was available. CISA added the flaw to its Known Exploited Vulnerabilities catalog on August 18 with a federal due date of August 21, per Resecurity’s timeline.

The fixes are straightforward. Patch to the three builds above, turn Screen Sharing off where nobody needs it, and keep TCP 5900 off untrusted networks. Any Mac that sat on an exposed network while vulnerable should be treated as suspect until you’ve checked it for unexpected SSH keys, new LaunchDaemons and miner processes. Passwords and account restrictions don’t mitigate this one.

The rest of Apple’s August releases

On August 17 Apple released iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2 and iOS 18.7.10 and iPadOS 18.7.10, along with visionOS 26.6.1. Safari 26.6.1 followed on August 18. The Safari update is mostly WebKit fixes. None of these advisories says Apple is aware of exploitation, so this is a normal-priority update cycle, not an emergency one. Anyone still on iOS 18 should note that 18.7.10 is the current build.

On the management side, the more interesting August news was the vendors catching up to Apple’s declarative model. Omnissa’s UEM 2607 post (August 26) and Intune’s 2608 release (August 25) both moved Apple update and app handling onto declarative device management, covered in the vendor sections below.

Microsoft: a heavy Patch Tuesday, 26H2 in Release Preview and Intune 2608

Patch Tuesday, August 11. Microsoft’s cumulative updates (KB5121003 for 25H2 and 24H2, KB5121000 for 26H1) carried roughly 400 CVEs, 62 of them rated Critical. The one Microsoft says is under active exploitation is CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) that gives a local attacker SYSTEM privileges. The one that worries me more for infrastructure teams is CVE-2026-62878, a critical stack-based buffer overflow in Windows DNS Server. It needs no authentication and no user interaction, and it has been described as wormable. If you run DNS on Windows Server, schedule that patch ahead of your normal ring. The optional preview builds followed on August 27, per Microsoft’s release health page.

Windows 11 26H2 reaches Release Preview. On August 27 Microsoft released 26H2, build 26300.9278, to the Release Preview channel as an enablement package. It sits on the same servicing branch as 24H2 and 25H2, so all three receive the same monthly updates, and devices on those two versions get it as a small update and a restart. For commercial devices it turns on Windows settings backup, app-specific taskbar actions and File Explorer improvements, which were already in the OS but off by default on managed devices. Microsoft hasn’t given a general availability date, though the 24H2 and 25H2 releases both landed in the fall. IT admins in the Windows Insider Program for Business can deploy it through Windows Update client policies or WSUS.

Two lifecycle dates matter now. Per Microsoft’s release information, Windows 11 24H2 Home and Pro reach end of updates on October 13, 2026, and 23H2 Enterprise and Education follow on November 10. Devices on 26H1 run a different branch and can’t move to 26H2 directly, so keep them out of your 26H2 pilot.

Intune service release 2608 (week of August 25). This was the only Intune what’s-new entry for the month, and the highlights are worth a read:

Apple: Required VPP apps can be managed through declarative device management on iOS/iPadOS 17.2+ and macOS 26+, giving per-app settings such as automatic updates and real-time app status. Choose DDM as the management type when you upload a new VPP token. The Apple settings catalog also adds options for the OS 27 betas, including App Settings, Web Content Filter and Siri Settings, and supervised devices get Apple’s Enhanced Logging action with an AppleCare-provided token.
Android Enterprise: New eSIM controls let you choose whether a wipe keeps or removes eSIMs (Android 15+), remove an individual eSIM by ICCID, activate an eSIM with a carrier code, and see expanded SIM inventory with EIDs and ICCIDs. Settings catalog additions cover screen timeout, a separate lock for the work profile on COPE, a work profile off-time limit, and keep-screen-on while charging. Personally owned work profile devices now appear in inventory and multi-device query.
Windows: Unattended Remote Help sessions let authorized helpdesk agents sign in to physical devices without the user present. New settings cover Internet Explorer security zone Protected Mode, Edge 150 templates, a Remote Desktop smart card disconnect option and new Office templates.
Security: Defender Antivirus for Linux gets an Audit enforcement level and a memory scan setting, and there is a new security baseline for Windows 365 for Agents Cloud PCs.
Device page: The new single device page is on by default, with a toggle to go back.

Seven new apps now support app protection, among them Notion, Superhuman Mail and Notability on iOS. The release lists no deprecations.

Jamf Pro 11.31, Omnissa Workspace ONE UEM 2607 and Ivanti fixes

Jamf Pro 11.31 and 11.31.1. Jamf Pro 11.31 was announced August 13. Its headline change is an App Management Status criteria for mobile device smart groups and advanced searches, which finds devices with unmanaged apps by name or on its own. Jamf Cloud upgrades ran by region from August 21 in Asia Pacific and Europe to August 22 in the US. The thread also carries a caution: a known Intune device compliance issue (PI-1516) was removed from the resolved list, and Jamf retracted a related technical article, so anyone who acted on it should contact Jamf Support. A fix is still in progress. Jamf Pro 11.31.1 followed on August 20 as a maintenance release with two cross-site scripting fixes and an update of the Spring Framework bundled in the installers, which had multiple known vulnerabilities. Self-hosted environments should move to it.

Omnissa Workspace ONE UEM 2607. Omnissa’s August 26 post describes the third major UEM release of 2026 and gives no feature availability dates. Apple OS updates move to declarative device management, with macOS and iOS update lists merged into one view and an auto-update control that follows Apple’s GDMF feed. Other items include modern printer management over MQTT, a Registered mode for contractor and BYO Macs, relay servers for Windows apps and updates, step-up enrollment for Windows that promotes a device to full management without a wipe, Freeze Mode to pause UEM-generated install and removal actions on a device, and an MCP server for connecting UEM to AI agents.

Ivanti, August 11. Ivanti’s August update covers Endpoint Manager and Neurons for MDM, and Ivanti says it has no evidence of exploitation and that no other products are affected. One summary of the advisories lists the fixes as Endpoint Manager 2024 SU7 and Neurons for MDM release R124. The Neurons for MDM cloud service was updated by Ivanti, so cloud tenants only need to confirm that, and on-premises installs need the upgrade.

Android Enterprise: August 2026 security bulletin

Google published the August Android Security Bulletin on August 3 with two patch levels, 2026-08-01 and 2026-08-05. Devices at 2026-08-05 or later carry every fix in the bulletin. Samsung’s patch, which SamMobile detailed on August 4, covers 38 of Google’s CVEs (8 critical, 30 high) plus 18 Samsung-specific fixes, and applies to devices on Android 14, 15 and 16.

For fleet owners the practical question is which devices actually reach 2026-08-05 and when. Samsung rolls out in waves, so a compliance rule keyed to the patch level will flag a lot of healthy devices in the first weeks. Set the rule’s grace period before the bulletin lands, not after. On the Intune side, the new eSIM controls in service release 2608 are the Android Enterprise change to know about, especially the option to keep or remove eSIMs on wipe.

What to watch

October 13 and November 10: Windows 11 24H2 Home and Pro reach end of updates on October 13, and 23H2 Enterprise and Education follow on November 10.
Windows 11 26H2: It is in Release Preview with no general availability date. Microsoft’s last two annual releases arrived in the fall, so plan a ring pilot now.
Jamf and Intune: Jamf has a fix for the Intune device compliance issue (PI-1516) in progress and hasn’t said when it ships.
Apple OS 27: Vendors are already adding OS 27 beta options to their consoles, and Omnissa and Intune are moving Apple updates and apps to declarative management. Expect more vendor changes when OS 27 ships.
macOS exposure: Hosts that were reachable on TCP 5900 before August 6 deserve a look. New entries on CISA’s exploited-vulnerabilities list for Apple or Windows are the signal to re-check your patch rings.
Omnissa UEM 2607: None of its features carry availability dates yet, so watch the release documentation before promising any of them internally.
Apple’s OS 27 checklist: Apple’s WWDC26 device management notes say legacy software update commands, queries, recommended cadence settings and update restrictions stop working in 27.0, so updates must move to declarative management before you upgrade. They also say management services need TLS 1.2 or later with cipher suites and certificates that meet the new App Transport Security requirements, the AssetCache profile is deprecated in macOS 27, and backups no longer restore enrollment, management or supervision state on iOS, iPadOS and visionOS 27. Apple marks these features as pre-release and subject to change.
Intune and legacy Apple updates: Microsoft has said Intune will remove its legacy Apple software update workloads after Apple retires the underlying commands. Inventory any policies still built on them.
Apple Business: Apple’s June 30 services update describes Apple Business as a single platform combining Business Manager, Business Essentials and Business Connect. It also says IT will be able to assign auto-renewing app subscriptions to users and buy free apps without license quantities later this year. Check how this affects your ABM roles and app licensing.

My take

My position: Patch compliance tells you the fix exists. It doesn’t tell you who was exposed while you waited, so exposure checks for remote-access services belong in compliance reports.

August showed how fast a quiet fix becomes an incident. Apple’s Screen Sharing advisory on August 6 said nothing about exploitation, and by August 18 CISA had the flaw in its Known Exploited Vulnerabilities catalog. The lesson isn’t really about Apple. Remote-access services on managed endpoints are an exposure most inventories don’t track. Few Mac fleets I see have a baseline for Screen Sharing or Remote Management, and almost nobody can say which Macs sit on networks where port 5900 is reachable. Patch compliance tells you the fix exists. It doesn’t tell you who was exposed while you waited.

The vendor news points the same way. Omnissa and Intune both moved Apple app and update handling onto declarative management in August, and the payoff is more than convenience. Declarative management reports state back to the server on the device’s own schedule, so drift shows up without polling. Apple has deprecated the legacy update commands, so any process still built on them is debt you’ll pay down this fall.

My prediction: by the end of the first quarter of 2027, the major UEM vendors will treat declarative updates as the default and legacy update policies as read-only, and compliance reports will include exposure checks for services like Screen Sharing next to patch level. The teams that build those checks now will answer the next KEV question in an hour instead of a week.

What to do next

Confirm every Mac is on Tahoe 26.6.1, Sequoia 15.7.9 or Sonoma 14.8.9 or later. Disable Screen Sharing where nobody needs it, block TCP 5900 from untrusted networks, and check Macs that were exposed for SSH keys, new LaunchDaemons and miner processes.
Patch Windows with the August cumulative updates. Put the DNS Server fix (CVE-2026-62878) and the afd.sys fix (CVE-2026-68820) first.
Report Windows devices by edition and version. Move Pro devices off 24H2 before October 13 and 23H2 Enterprise and Education before November 10, and pilot 26H2 from Release Preview, keeping 26H1 devices out of it.
Move self-hosted Jamf Pro to 11.31.1, and ask Jamf Support whether your tenant is affected by the open Intune compliance issue (PI-1516).
Apply the Ivanti fixes: Endpoint Manager 2024 SU7 and, on premises, Neurons for MDM R124.
Pilot declarative management for required VPP apps in Intune, and review the new eSIM wipe options before your next Android wipe policy change.
Set a grace period on Android patch-level compliance rules before the next bulletin lands.

Sources

I’m TJ Singh, a managing principal in mobility and endpoint management with more than 20 years of global experience in the device management field.

About me · Start here · Predictions

AI tools may have been used to conduct research for this article.