September 2026 Attack Surface Overview
Microsoft Office received 22 Critical patches this month, of which 12 are exploitable via Preview Pane or Reading Pane. When Preview Pane or Reading Pane is enabled, merely previewing a crafted file triggers code execution without any click, attachment open, or macro prompt. This attack pattern has historically been favored by both commodity phishing campaigns and targeted intrusion operators because it eliminates much of the social-engineering friction of convincing users to take an action.
Unauthenticated network-reachable RCE vulnerabilities span at least 17 CVEs across core infrastructure services including Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Microsoft Message Queuing (MSMQ), Network File System (NFS), and Secure Socket Tunneling Protocol (SSTP) VPN. These flaws allow remote attackers to execute code without credentials or user interaction, making any exposed instance an immediate target for opportunistic scanning and exploitation.
Identity-platform components face elevated risk this month with critical RCE vulnerabilities in both Netlogon and Kerberos. These protocols underpin domain authentication: Netlogon handles secure channel establishment between domain members and controllers, while Kerberos issues authentication tickets for every domain resource. Successful exploitation of either provides a foothold inside the authentication layer that every other domain service trusts.
Windows Hyper-V vulnerabilities this month include flaws that enable guest-to-host escape, expanding the exposure profile from a single compromised virtual machine to the entire virtualization host and all co-resident guests. Hypervisor escapes have historically been high-value targets for advanced adversaries because they bypass the isolation boundary that multi-tenant and segmented environments depend on.
Exploited Zero-Day Vulnerability in Windows Update Stack
CVE-2026-81963 is an Important elevation of privilege vulnerability in Windows Update Stack and has a CVSS score of 7.8. Microsoft has confirmed the flaw is being exploited in the wild. A local attacker with low privileges can exploit improper link resolution (a link-following flaw) to reach SYSTEM privileges. No user interaction is required.
The attack surface here is effectively the entire Windows fleet. The Update Stack runs on every supported Windows client and server, and its components execute with elevated privileges during patch operations. Link-following bugs in high-privilege services are a well-understood primitive for post-compromise escalation: An attacker who has achieved initial code execution on a workstation, whether through phishing, a browser exploit, or stolen credentials, can chain this flaw to complete the local-admin-to-SYSTEM step without needing a second vulnerability. This class of flaw has historically been incorporated into commodity post-exploitation toolkits because it reliably converts “foothold” into “full control” across a broad range of enterprise configurations.
Table 1. Exploited zero-day in Windows Update Stack| Severity | CVSS Score | CVE | Description | Action Required? |
| Important | 7.8 | CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | Yes |
Exploited Zero-Day Vulnerability in Windows Advanced Local Procedure Call
CVE-2026-85880 is an Important elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC) and has a CVSS score of 7.8. Microsoft has confirmed the flaw is being exploited in the wild. A local attacker who already has code execution, even within a low-privilege AppContainer sandbox, can trigger a heap-based buffer overflow to escape the container and reach SYSTEM privileges. No user interaction is required.
ALPC is the foundational inter-process communication mechanism in Windows. It underpins RPC, COM, and a broad set of system services, and is present and active on every supported Windows version from workstation to server core. Because ALPC operates at such a low level in the kernel's IPC path, vulnerabilities here tend to be reliable privilege-escalation primitives once an attacker has any local code execution. This class of flaw has historically appeared in post-compromise tooling used by both commodity malware and targeted intrusion operators as a reliable final step from user-mode to kernel-mode control.
Table 2. Exploited zero-day vulnerability in Windows ALPC| Severity | CVSS Score | CVE | Description | Action Required? |
| Important | 7.8 | CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | Yes |
Critical RCE Vulnerability in Windows Netlogon
CVE-2026-72982 is a Critical RCE vulnerability in the Windows Netlogon service and has a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to Netlogon and execute arbitrary code on the target system. No user interaction is required.
Netlogon is the service that handles domain logon requests, secure channel establishment between domain members and domain controllers (DC), and machine-account password updates. It runs on every domain controller and listens on the network by design. Successful exploitation gives an attacker code execution on a DC, which in practice means immediate access to the NTDS.dit database, Kerberos keys, and the ability to issue or forge authentication artifacts for any account in the domain.
The attack surface is significant: Netlogon must be reachable from domain-joined machines, and in many environments, it is also reachable from broader network segments or even across site-to-site links with minimal filtering. Similar flaws in Netlogon have historically been high-priority targets for ransomware operators and sophisticated intrusion groups because a single vulnerable DC can unlock the entire forest.
Table 3. Critical RCE vulnerability in Windows Netlogon| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-72982 | Windows Netlogon Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerability in Windows DNS Server
CVE-2026-69730 is a Critical RCE vulnerability in Windows DNS Server and has a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to the DNS service and execute code on the target system. No user interaction is required.
In most Active Directory (AD) environments, DNS runs on domain controllers themselves rather than on dedicated infrastructure. A successful exploit against an AD-integrated DNS server can deliver code execution on a domain controller. Similar DNS service flaws have historically drawn rapid attention from both ransomware operators and nation-state actors because of this co-location pattern.
Table 4. Critical RCE vulnerability in Windows DNS Server| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-69730 | Windows DNS Server Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerabilities in Windows DHCP Server
CVE-2026-69845 and CVE-2026-72979 are Critical RCE vulnerabilities in Windows DHCP Server, both carrying CVSS scores of 9.8. An unauthenticated attacker with network access to a DHCP server can send specially crafted packets to trigger either a heap-based buffer overflow or a use-after-free condition and execute arbitrary code. No user interaction is required for either flaw.
DHCP servers occupy a position in enterprise networks that amplifies the impact of any compromise. Most environments deploy at least one per subnet or site, and the service typically runs with elevated privileges on infrastructure that is trusted to configure every endpoint's network stack at boot time. Compromising a DHCP server gives an attacker a pivot point with broad Layer 2 visibility, the ability to inject malicious options into client configurations, and a foothold on a system that security monitoring often treats as stable infrastructure rather than a high-churn endpoint. Legacy network services of this class have historically attracted attention from adversaries seeking lateral movement paths that bypass endpoint detection.
Table 5. Critical RCE vulnerabilities in Windows DHCP Server| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-69845 | Windows DHCP Server Remote Code Execution Vulnerability | Yes |
| Critical | 9.8 | CVE-2026-72979 | Windows DHCP Server Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerability in Windows Message Queuing
CVE-2026-69579 is a Critical RCE vulnerability in Windows Message Queuing (MSMQ) and has a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to a system running the MSMQ service and execute code without any user interaction. The flaw stems from a use-after-free condition in the network-facing packet handling path.
MSMQ is not installed by default on modern Windows versions, but many enterprises still deploy it to support legacy line-of-business applications, middleware, and monitoring agents. When enabled, the service listens on TCP port 1801 and often runs with SYSTEM privileges. Legacy network services of this class have historically been targeted in wormable exploitation scenarios because they combine unauthenticated remote reach with high-privilege code execution, a pattern that allows rapid lateral movement without credential harvesting.
Table 6. Critical RCE vulnerability in Windows Message Queuing| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-69579 | Windows Message Queuing Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerabilities in Windows Services for NFS
CVE-2026-69595 and CVE-2026-78445 are Critical RCE vulnerabilities in the Windows Services for NFS Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) driver, both carrying CVSS scores of 9.8. An unauthenticated attacker can send a specially crafted packet to an NFS service and execute code on the target system.
Windows Services for NFS exists to enable Unix and Linux interoperability in mixed-OS environments, bridging file-sharing workflows between Windows servers and POSIX clients. The feature is not installed by default, but organizations with legacy engineering workloads, scientific computing clusters, or hybrid storage tiers frequently enable it on servers that sit deeper in the network than typical file shares. The ONCRPC XDR driver handles serialization at the protocol layer, so any host running the NFS Server role and reachable on TCP/UDP 2049 is exposed.
The exposure profile depends on where NFS services have been deployed. In environments where NFS shares back critical application data or serve as landing zones for Linux-based pipelines, a compromised host can provide an attacker with access to sensitive datasets and a pivot point into segments that may otherwise be unreachable from standard Windows infrastructure.
Table 7. Critical RCE vulnerabilities in Windows Services for NFS| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-69595 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Yes |
| Critical | 9.8 | CVE-2026-78445 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerabilities and Information Disclosure Vulnerability Across Office Products
This month's release includes 21 Critical RCE vulnerabilities and one Critical information disclosure flaw spanning Outlook, Word, Excel, PowerPoint, Office Graphics Component, and Windows Graphics Component. Twelve of the 22 are triggerable through Outlook Reading Pane or Explorer Preview Pane, meaning that receipt of a crafted email or arrival of a crafted file at a shared location is sufficient for code execution without any user click. The other 10 require the recipient to open the malicious file for exploitation to succeed.
CVSS scores range from 6.5 to 9.8. The three 9.8-scored items in the Preview Pane or Reading Pane subset are CVE-2026-77493 (Windows Graphics Component, Preview Pane), CVE-2026-78510 (Word, Preview Pane), and CVE-2026-78509 (Outlook, Reading Pane).
Attack-surface size is the dominant concern for the Preview Pane subset. Microsoft Office is installed on virtually every enterprise endpoint, and the Preview Pane trigger removes the user-decision checkpoint that would otherwise stand in the way of document-borne payload execution. Malicious RTF files, PowerPoint presentations, and Outlook messages all appear as delivery vectors within this group. This class of flaw has historically been attractive to phishing operators and initial-access brokers because delivery is trivial and interaction requirements are minimal.
Table 8. Critical RCE vulnerabilities and information disclosure vulnerability across Office products| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-77493 | Windows Graphics Component Remote Code Execution Vulnerability | Yes |
| Critical | 9.8 | CVE-2026-78509 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 9.8 | CVE-2026-78510 | Microsoft Word Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-69285 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-69632 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-69678 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-69767 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-69797 | Microsoft Office PowerPoint Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-78439 | Microsoft Office Graphics Component Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-78505 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-78519 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-78525 | Microsoft Office Outlook Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-81952 | Microsoft Word Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-81955 | Windows Graphics Component Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81948 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81949 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81950 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81951 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81953 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.8 | CVE-2026-81959 | Microsoft Excel Remote Code Execution Vulnerability | Yes |
| Critical | 7.5 | CVE-2026-77898 | Microsoft Office Remote Code Execution Vulnerability | Yes |
| Critical | 6.5 | CVE-2026-78520 | Microsoft Office Outlook Information Disclosure Vulnerability | Yes |
Critical RCE Vulnerability in Windows Secure Socket Tunneling Protocol
CVE-2026-73009 is a Critical RCE vulnerability in the Windows Secure Socket Tunneling Protocol (SSTP) service and has a CVSS score of 9.8. An unauthenticated attacker can send a specially crafted packet to the SSTP listener and execute code on the target system.
SSTP is the Microsoft-native VPN protocol supported out-of-the-box by Windows Server's Routing and Remote Access Service (RRAS). Organizations that offer SSTP-based remote-access VPN typically expose the vulnerable service directly to the internet on TCP/443, which means exploitation does not require prior network access or credential theft. A compromise of SSTP is a perimeter breach with immediate lateral-movement opportunity.
Edge-facing VPN infrastructure has historically been a favored target for both nation-state threat actors and ransomware operators because a single exploited gateway can bypass significant internal segmentation work.
Table 9. Critical RCE vulnerability in Windows Secure Socket Tunneling Protocol| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 9.8 | CVE-2026-73009 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerability in Windows Kerberos
CVE-2026-69676 is a Critical RCE vulnerability in Windows Kerberos and has a CVSS score of 8.8. The flaw stems from an authentication bypass via capture-replay: An attacker who has already obtained low-privileged credentials in the target environment can intercept a legitimate Kerberos authentication exchange and replay a modified variant back to the server, which processes it as authentic and executes attacker-controlled code. No further user interaction is required.
Kerberos issues authentication tickets for every domain-joined resource in an Active Directory environment. A code execution flaw in this component can provide an attacker with a foothold inside the authentication layer that every domain service implicitly trusts. Successful exploitation could allow an adversary to forge or manipulate ticket-granting operations, potentially enabling lateral movement across the entire forest. Kerberos-layer attacks have historically been a preferred technique in both ransomware intrusions and targeted campaigns because they offer persistent, stealthy access that survives individual host remediation.
Table 10. Critical RCE vulnerability in Windows Kerberos| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-69676 | Windows Kerberos Remote Code Execution Vulnerability | Yes |
Critical RCE Vulnerabilities and Elevation of Privilege Vulnerability in Windows Hyper-V
CVE-2026-69603, CVE-2026-80083, and CVE-2026-72961 are Critical vulnerabilities in Windows Hyper-V and have CVSS scores of 8.8, 8.8, and 8.2, respectively. CVE-2026-69603 allows arbitrary code execution through a heap-based buffer overflow via a malformed hypercall payload size. CVE-2026-80083 allows arbitrary code execution on the host through an untrusted pointer dereference reachable from a guest application. CVE-2026-69603 and CVE-2026-80083 enable an attacker operating inside a guest VM to breach the hypervisor isolation boundary. CVE-2026-72961 exploits a buffer overflow in virtual TPM state handling to escalate from host admin to Virtual Trust Level 1 (VTL1) privileges.
A guest-to-host escape compromises the hypervisor, which means the attacker can inspect or manipulate memory for all co-resident VMs, extract secrets from isolated tenants, and persist below the operating-system layer where most endpoint detection stops. In multi-tenant or shared-infrastructure environments, this class of flaw converts a single compromised workload into a platform-wide incident. Hypervisor-escape vulnerabilities have historically been a priority target for sophisticated adversaries because the payoff scales with consolidation density.
Table 11. Critical vulnerabilities in Windows Hyper-V| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-69603 | Windows Hyper-V Remote Code Execution Vulnerability | Yes |
| Critical | 8.8 | CVE-2026-80083 | Windows Hyper-V Remote Code Execution Vulnerability | Yes |
| Critical | 8.2 | CVE-2026-72961 | Windows Hyper-V Elevation of Privilege Vulnerability | Yes |
Critical RCE Vulnerability in Windows Remote Desktop
CVE-2026-69518 is a Critical RCE vulnerability in Windows Remote Desktop and has a CVSS score of 8.8. An attacker who joins a Remote Desktop sharing session can send specially crafted clipboard data to the sharing host and execute code on the host system. User interaction is required only to the extent that a sharing session must be active; the attacker does not need additional prompts or clicks once connected.
The attack-surface concern here is the clipboard channel, a feature enabled by default in most RDP configurations because it supports legitimate productivity workflows. Environments that permit clipboard redirection between client and host (the default) are exposed whenever a sharing session is active. This includes help-desk scenarios, remote-support tools built on RDP, and any third-party application that leverages the Remote Desktop API for screen sharing. RDP services have historically been a primary initial-access vector for ransomware operators and opportunistic attackers scanning for exposed endpoints, though this particular flaw requires session participation rather than unauthenticated network access.
Table 12. Critical RCE vulnerability in Windows Remote Desktop| Severity | CVSS Score | CVE | Description | Action Required? |
| Critical | 8.8 | CVE-2026-69518 | Windows Remote Desktop Remote Code Execution Vulnerability | Yes |
Additional Critical Vulnerabilities Addressed This Month
- CVE-2026-66302, Skype for Business RCE vulnerability (CVSS 9.8)
- CVE-2026-69590, Windows Routing and Remote Access Service (RRAS) RCE vulnerability (CVSS 9.8)
- CVE-2026-69769, Windows HTTP Print Provider RCE vulnerability (CVSS 9.8)
- CVE-2026-69829, Windows Shell RCE vulnerability (CVSS 9.8)
- CVE-2026-70296, Windows Imaging Component RCE vulnerability (CVSS 9.8)
- CVE-2026-72983, Internet Connection Sharing (ICS) RCE vulnerability (CVSS 9.8)
- CVE-2026-73010, Microsoft Failover Cluster RCE vulnerability (CVSS 9.8)
- CVE-2026-65669, Microsoft SQL Server elevation of privilege vulnerability (CVSS 9.6)
- CVE-2026-69854, Spring Cloud Azure elevation of privilege vulnerability (CVSS 9.0)
- CVE-2026-65772, Microsoft Dynamics 365 On-Premises RCE vulnerability (CVSS 8.8)
- CVE-2026-67631, Microsoft SQL Server RCE vulnerability (CVSS 8.8)
- CVE-2026-67643, Microsoft SQL Server RCE vulnerability (CVSS 8.8)
- CVE-2026-69499, Windows Imaging Component RCE vulnerability (CVSS 8.8)
- CVE-2026-69601, Microsoft Windows Media Foundation RCE vulnerability (CVSS 8.8)
- CVE-2026-69649, Raw Image Extension RCE vulnerability (CVSS 8.8)
- CVE-2026-69712, Windows Key Distribution Center RCE vulnerability (CVSS 8.8)
- CVE-2026-69740, Windows Hello elevation of privilege vulnerability (CVSS 8.8)
- CVE-2026-69784, Windows Hello elevation of privilege vulnerability (CVSS 8.8)
- CVE-2026-69860, Windows Imaging Component RCE vulnerability (CVSS 8.8)
- CVE-2026-70203, Windows Media Player RCE vulnerability (CVSS 8.8)
- CVE-2026-70351, Microsoft WebP Image Extension RCE vulnerability (CVSS 8.8)
- CVE-2026-70586, Windows Paint RCE vulnerability (CVSS 8.8)
- CVE-2026-72950, Windows Routing and Remote Access Service (RRAS) RCE vulnerability (CVSS 8.8)
- CVE-2026-72959, Windows Routing and Remote Access Service (RRAS) RCE vulnerability (CVSS 8.8)
- CVE-2026-72960, Windows Media Player RCE vulnerability (CVSS 8.8)
- CVE-2026-72986, Graphic Fonts RCE vulnerability (CVSS 8.8)
- CVE-2026-73006, DirectWrite RCE vulnerability (CVSS 8.8)
- CVE-2026-73013, Windows Imaging Component RCE vulnerability (CVSS 8.8)
- CVE-2026-73018, Graphic Fonts RCE vulnerability (CVSS 8.8)
- CVE-2026-73023, Windows Imaging Component RCE vulnerability (CVSS 8.8)
- CVE-2026-77495, Windows Imaging Component RCE vulnerability (CVSS 8.8)
- CVE-2026-77504, Microsoft Office Word RCE vulnerability (CVSS 8.8)
- CVE-2026-81352, Web Media Extensions RCE vulnerability (CVSS 8.8)
- CVE-2026-67378, Microsoft SQL Server RCE vulnerability (CVSS 8.5)
- CVE-2026-67636, Microsoft SQL Server RCE vulnerability (CVSS 8.5)
- CVE-2026-69820, Windows Hello elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-69846, Windows Secure Kernel Mode elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-69874, Windows ALPC elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-69906, Windows Secure Kernel Mode elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-72958, Windows Credential Guard elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-72962, Windows USB Video Driver elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-81354, Windows Hello elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-83939, Windows Secure Kernel Mode elevation of privilege vulnerability (CVSS 8.2)
- CVE-2026-69530, Windows Reliable Multicast Transport Driver (RMCAST) RCE vulnerability (CVSS 8.1)
- CVE-2026-69813, Windows DNS Server RCE vulnerability (CVSS 8.1)
- CVE-2026-69827, Windows DNS Server RCE vulnerability (CVSS 8.1)
- CVE-2026-69858, Windows DNS Server RCE vulnerability (CVSS 8.1)
- CVE-2026-72981, IP Helper RCE vulnerability (CVSS 8.1)
- CVE-2026-72987, Windows DNS RCE vulnerability (CVSS 8.1)
- CVE-2026-77505, Windows DNS Server RCE vulnerability (CVSS 8.1)
- CVE-2026-78444, Microsoft Failover Cluster RCE vulnerability (CVSS 8.1)
- CVE-2026-78449, Windows Reliable Multicast Transport Driver (RMCAST) RCE vulnerability (CVSS 8.1)
- CVE-2026-78450, Windows Reliable Multicast Transport Driver (RMCAST) RCE vulnerability (CVSS 8.1)
- CVE-2026-58599, HEVC Video Extensions RCE vulnerability (CVSS 7.8)
- CVE-2026-69725, Windows Hello elevation of privilege vulnerability (CVSS 7.8)
- CVE-2026-69799, Windows Hello elevation of privilege vulnerability (CVSS 7.8)
- CVE-2026-69864, Windows Hello elevation of privilege vulnerability (CVSS 7.8)
- CVE-2026-72957, Windows Deployment Services RCE vulnerability (CVSS 7.8)
- CVE-2026-83498, Windows Virtualization-Based Security (VBS) Enclave elevation of privilege vulnerability (CVSS 7.8)
- CVE-2026-69710, Windows Hello elevation of privilege vulnerability (CVSS 7.5)
- CVE-2026-69852, Windows Routing and Remote Access Service (RRAS) RCE vulnerability (CVSS 7.5)
- CVE-2026-69890, Windows Virtual Trusted Platform Module elevation of privilege vulnerability (CVSS 7.5)
- CVE-2026-72954, Windows Deployment Services RCE vulnerability (CVSS 7.5)
- CVE-2026-73017, Graphics Kernel RCE vulnerability (CVSS 7.5)
- CVE-2026-81355, Virtual Hard Disk (VHD) Miniport Driver RCE vulnerability (CVSS 7.5)
- CVE-2026-69501, Windows Secure Kernel Mode elevation of privilege vulnerability (CVSS 7.0)
- CVE-2026-70585, Windows Services for NFS ONCRPC XDR Driver RCE vulnerability (CVSS 7.0)
- CVE-2026-83501, Windows Virtualization-Based Security (VBS) information disclosure vulnerability (CVSS 5.5)
- CVE-2026-72980, Windows Hello Security feature bypass vulnerability (CVSS 4.4)
Publicly Disclosed Microsoft Defender Zero-Day (ShieldCrash)
Approximately two hours after Microsoft released its Patch Tuesday patches, purported researcher MSNightmare (of the Nightmare-Eclipse persona) released a new proof-of-concept (PoC) zero-day exploit targeting Microsoft Defender. MSNightmare purports that Microsoft's patch for the ShieldBreak vulnerability (CVE-2026-69414) was incomplete, and that this PoC follows an unpatched attack path to allow for SYSTEM-level file reads, with the potential to be converted into a full SYSTEM privilege escalation exploit. MSNightmare’s claims are currently being reviewed, and analysis is ongoing; however, historically this purported researcher’s claims have been found to be accurate. There is no patch or mitigation available at the time of this writing.
Patch Tuesday Dashboard in the Falcon Platform
For a visual overview of the systems impacted by this month’s vulnerabilities, you can use our Patch Tuesday dashboard. This can be found in the CrowdStrike Falcon® platform within the Exposure Management > Vulnerability Management > Dashboards page. The preset dashboards show the most recent three months of Patch Tuesday vulnerabilities.
Not All Relevant Vulnerabilities Have Patches: Consider Mitigation Strategies
As we have learned with other notable vulnerabilities, such as Log4j, not every highly exploitable vulnerability can be easily patched. As is the case for the ProxyNotShell vulnerabilities, it’s critically important to develop a response plan for how to defend your environments when no patching protocol exists.
Regular review of your patching strategy should still be a part of your program, but you should also look more holistically at your organization's methods for cybersecurity and improve your overall security posture.
The CrowdStrike Falcon platform regularly collects and analyzes trillions of endpoint events every day from millions of sensors deployed across 176 countries. Watch this demo to see the Falcon platform in action.
Learn More
Learn more about how CrowdStrike Falcon® Exposure Management can help you quickly and easily discover and prioritize vulnerabilities and other types of exposures here.
About CVSS Scores
The Common Vulnerability Scoring System (CVSS) is a free and open industry standard that CrowdStrike and many other cybersecurity organizations use to assess and communicate software vulnerabilities’ severity and characteristics. The CVSS Base Score ranges from 0.0 to 10.0, and the National Vulnerability Database (NVD) adds a severity rating for CVSS scores. Learn more about vulnerability scoring in this article.
Additional Resources