{"id":26226,"date":"2026-09-21T15:44:16","date_gmt":"2026-09-21T23:44:16","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/september-2026-patch-tuesday-two-exploited-zero-days-and-113-critical-vulnerabilities-among-972-cves\/"},"modified":"2026-09-21T15:57:13","modified_gmt":"2026-09-21T23:57:13","slug":"september-2026-patch-tuesday-two-exploited-zero-days-and-113-critical-vulnerabilities-among-972-cves","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2026\/09\/21\/september-2026-patch-tuesday-two-exploited-zero-days-and-113-critical-vulnerabilities-among-972-cves\/","title":{"rendered":"September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs"},"content":{"rendered":"
\n
\n
\n
\n
\n

September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs<\/h1>\n
\n

September 08, 2026<\/p>\n

\u2022<\/span>
\n
\n Falcon Exposure Management Team<\/a>
\n\u2022<\/span>
\nExposure Management<\/a>\n<\/p>\n<\/div>\n

\n\"\"\n<\/div>\n<\/div>\n
\n<\/div>\n<\/div>\n
\n
\n
\n
\n<\/p>\n

Microsoft has addressed 972 vulnerabilities in its September 2026 security update release, over double the number of CVEs released in August, and a new Patch Tuesday record. This month\u2019s patches include fixes for two exploited zero-day vulnerabilities and 113 Critical vulnerabilities, along with 857 additional vulnerabilities of varying severity levels. Additionally, there was a new proof-of-concept zero-day exploit disclosed against Microsoft Defender, dubbed ShieldCrash. This is discussed at the end of this blog, separately from Microsoft\u2019s patches.<\/p>\n

New AI-Powered Capabilities in Falcon Exposure Management\u00a0<\/h2>\n

With CrowdStrike Falcon\u00ae Exposure Management, you can automatically classify and prioritize assets, show attack paths targeting client-side exploitation of devices, and integrate with CrowdStrike Falcon\u00ae Next-Gen SIEM. Learn more in this blog post:\u00a0<\/p>\n

Falcon Exposure Management\u2019s AI-Powered Risk Prioritization Shows Organizations What to Fix First<\/a><\/p>\n

September 2026 Risk Analysis<\/h2>\n

This month\u2019s leading risk types by exploitation technique are elevation of privilege<\/a> with 437 patches (45%), remote code execution<\/a> (RCE) with 258 patches (26%), and information disclosure with 171 (18%).<\/p>\n<\/p>\n

<\/span>\n<\/div>\n<\/div>\n

\n
\n\"Figure
\n\n<\/use>\n<\/svg>
\nFigure 1. Breakdown of September 2026 Patch Tuesday exploitation techniques<\/span>\n<\/div>\n
\n<\/div>\n<\/div>\n
\n
\nMicrosoft Windows received the most patches this month with 726, followed by Extended Security Updates (ESU) with 650, and Microsoft Office with 135.<\/span>\n<\/div>\n<\/div>\n
\n
\n\"Figure
\n\n<\/use>\n<\/svg>
\nFigure 2. Breakdown of product families affected by September 2026 Patch Tuesday<\/span>\n<\/div>\n
\n<\/div>\n<\/div>\n
\n
\n<\/p>\n

September 2026 Attack Surface Overview<\/h2>\n

Microsoft Office received 22 Critical<\/b> patches this month, of which 12 are exploitable via Preview Pane or Reading Pane. When Preview Pane or Reading Pane is enabled, merely previewing a crafted file triggers code execution without any click, attachment open, or macro prompt. This attack pattern has historically been favored by both commodity phishing campaigns and targeted intrusion operators because it eliminates much of the social-engineering friction of convincing users to take an action.<\/p>\n

Unauthenticated network-reachable RCE vulnerabilities span at least 17 CVEs across core infrastructure services including Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP), Microsoft Message Queuing (MSMQ), Network File System (NFS), and Secure Socket Tunneling Protocol (SSTP) VPN. These flaws allow remote attackers to execute code without credentials or user interaction, making any exposed instance an immediate target for opportunistic scanning and exploitation.<\/p>\n

Identity-platform components face elevated risk this month with critical RCE vulnerabilities in both Netlogon and Kerberos. These protocols underpin domain authentication: Netlogon handles secure channel establishment between domain members and controllers, while Kerberos issues authentication tickets for every domain resource. Successful exploitation of either provides a foothold inside the authentication layer that every other domain service trusts.<\/p>\n

Windows Hyper-V vulnerabilities this month include flaws that enable guest-to-host escape, expanding the exposure profile from a single compromised virtual machine to the entire virtualization host and all co-resident guests. Hypervisor escapes have historically been high-value targets for advanced adversaries because they bypass the isolation boundary that multi-tenant and segmented environments depend on.<\/p>\n

Exploited Zero-Day Vulnerability in Windows Update Stack<\/h2>\n

CVE-2026-81963<\/a> is an Important<\/b> elevation of privilege vulnerability in Windows Update Stack and has a CVSS<\/b> score of 7.8<\/b>. Microsoft has confirmed the flaw is being exploited in the wild. A local attacker with low privileges can exploit improper link resolution (a link-following flaw) to reach SYSTEM privileges. No user interaction is required.<\/p>\n

The attack surface here is effectively the entire Windows fleet. The Update Stack runs on every supported Windows client and server, and its components execute with elevated privileges during patch operations. Link-following bugs in high-privilege services are a well-understood primitive for post-compromise escalation: An attacker who has achieved initial code execution on a workstation, whether through phishing, a browser exploit, or stolen credentials, can chain this flaw to complete the local-admin-to-SYSTEM step without needing a second vulnerability. This class of flaw has historically been incorporated into commodity post-exploitation toolkits because it reliably converts \u201cfoothold\u201d into \u201cfull control\u201d across a broad range of enterprise configurations.<\/p>\n\n\n\n\n
Table 1. Exploited zero-day in Windows Update Stack<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Important<\/b><\/td>\n7.8<\/td>\nCVE-2026-81963<\/td>\nWindows Update Stack Elevation of Privilege Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Exploited Zero-Day Vulnerability in Windows Advanced Local Procedure Call<\/h2>\n

CVE-2026-85880<\/a> is an Important<\/b> elevation of privilege vulnerability in Windows Advanced Local Procedure Call (ALPC) and has a CVSS<\/b> score of 7.8<\/b>. Microsoft has confirmed the flaw is being exploited in the wild. A local attacker who already has code execution, even within a low-privilege AppContainer sandbox, can trigger a heap-based buffer overflow to escape the container and reach SYSTEM privileges. No user interaction is required.<\/p>\n

ALPC is the foundational inter-process communication mechanism in Windows. It underpins RPC, COM, and a broad set of system services, and is present and active on every supported Windows version from workstation to server core. Because ALPC operates at such a low level in the kernel\u2019s IPC path, vulnerabilities here tend to be reliable privilege-escalation primitives once an attacker has any local code execution. This class of flaw has historically appeared in post-compromise tooling used by both commodity malware and targeted intrusion operators as a reliable final step from user-mode to kernel-mode control.<\/p>\n\n\n\n\n
Table 2. Exploited zero-day vulnerability in Windows ALPC<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Important<\/b><\/td>\n7.8<\/td>\nCVE-2026-85880<\/td>\nWindows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows Netlogon<\/h2>\n

CVE-2026-72982<\/a> is a Critical<\/b> RCE vulnerability in the Windows Netlogon service and has a CVSS<\/b> score of 9.8<\/b>. An unauthenticated attacker can send a specially crafted packet to Netlogon and execute arbitrary code on the target system. No user interaction is required.<\/p>\n

Netlogon is the service that handles domain logon requests, secure channel establishment between domain members and domain controllers (DC), and machine-account password updates. It runs on every domain controller and listens on the network by design. Successful exploitation gives an attacker code execution on a DC, which in practice means immediate access to the NTDS.dit database, Kerberos keys, and the ability to issue or forge authentication artifacts for any account in the domain.<\/p>\n

The attack surface is significant: Netlogon must be reachable from domain-joined machines, and in many environments, it is also reachable from broader network segments or even across site-to-site links with minimal filtering. Similar flaws in Netlogon have historically been high-priority targets for ransomware operators and sophisticated intrusion groups because a single vulnerable DC can unlock the entire forest.<\/p>\n\n\n\n\n
Table 3. Critical RCE vulnerability in Windows Netlogon<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-72982<\/td>\nWindows Netlogon Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows DNS Server<\/h2>\n

CVE-2026-69730<\/a> is a Critical<\/b> RCE vulnerability in Windows DNS Server and has a CVSS<\/b> score of 9.8<\/b>. An unauthenticated attacker can send a specially crafted packet to the DNS service and execute code on the target system. No user interaction is required.<\/p>\n

In most Active Directory (AD) environments, DNS runs on domain controllers themselves rather than on dedicated infrastructure. A successful exploit against an AD-integrated DNS server can deliver code execution on a domain controller. Similar DNS service flaws have historically drawn rapid attention from both ransomware operators and nation-state actors because of this co-location pattern.<\/p>\n\n\n\n\n
Table 4. Critical RCE vulnerability in Windows DNS Server<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-69730<\/td>\nWindows DNS Server Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerabilities in Windows DHCP Server<\/h2>\n

CVE-2026-69845<\/a> and CVE-2026-72979<\/a> are Critical<\/b> RCE vulnerabilities in Windows DHCP Server, both carrying CVSS<\/b> scores of 9.8<\/b>. An unauthenticated attacker with network access to a DHCP server can send specially crafted packets to trigger either a heap-based buffer overflow or a use-after-free condition and execute arbitrary code. No user interaction is required for either flaw.<\/p>\n

DHCP servers occupy a position in enterprise networks that amplifies the impact of any compromise. Most environments deploy at least one per subnet or site, and the service typically runs with elevated privileges on infrastructure that is trusted to configure every endpoint\u2019s network stack at boot time. Compromising a DHCP server gives an attacker a pivot point with broad Layer 2 visibility, the ability to inject malicious options into client configurations, and a foothold on a system that security monitoring often treats as stable infrastructure rather than a high-churn endpoint. Legacy network services of this class have historically attracted attention from adversaries seeking lateral movement paths that bypass endpoint detection.<\/p>\n\n\n\n\n\n
Table 5. Critical RCE vulnerabilities in Windows DHCP Server<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-69845<\/td>\nWindows DHCP Server Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-72979<\/td>\nWindows DHCP Server Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows Message Queuing<\/h2>\n

CVE-2026-69579<\/a> is a Critical<\/b> RCE vulnerability in Windows Message Queuing (MSMQ) and has a CVSS<\/b> score of 9.8<\/b>. An unauthenticated attacker can send a specially crafted packet to a system running the MSMQ service and execute code without any user interaction. The flaw stems from a use-after-free condition in the network-facing packet handling path.<\/p>\n

MSMQ is not installed by default on modern Windows versions, but many enterprises still deploy it to support legacy line-of-business applications, middleware, and monitoring agents. When enabled, the service listens on TCP port 1801 and often runs with SYSTEM privileges. Legacy network services of this class have historically been targeted in wormable exploitation scenarios because they combine unauthenticated remote reach with high-privilege code execution, a pattern that allows rapid lateral movement without credential harvesting.<\/p>\n\n\n\n\n
Table 6. Critical RCE vulnerability in Windows Message Queuing<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-69579<\/td>\nWindows Message Queuing Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerabilities in Windows Services for NFS<\/h2>\n

CVE-2026-69595<\/a> and CVE-2026-78445<\/a> are Critical<\/b> RCE vulnerabilities in the Windows Services for NFS Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) driver, both carrying CVSS<\/b> scores of 9.8<\/b>. An unauthenticated attacker can send a specially crafted packet to an NFS service and execute code on the target system.<\/p>\n

Windows Services for NFS exists to enable Unix and Linux interoperability in mixed-OS environments, bridging file-sharing workflows between Windows servers and POSIX clients. The feature is not installed by default, but organizations with legacy engineering workloads, scientific computing clusters, or hybrid storage tiers frequently enable it on servers that sit deeper in the network than typical file shares. The ONCRPC XDR driver handles serialization at the protocol layer, so any host running the NFS Server role and reachable on TCP\/UDP 2049 is exposed.<\/p>\n

The exposure profile depends on where NFS services have been deployed. In environments where NFS shares back critical application data or serve as landing zones for Linux-based pipelines, a compromised host can provide an attacker with access to sensitive datasets and a pivot point into segments that may otherwise be unreachable from standard Windows infrastructure.<\/p>\n\n\n\n\n\n
Table 7. Critical RCE vulnerabilities in Windows Services for NFS<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-69595<\/td>\nWindows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-78445<\/td>\nWindows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerabilities and Information Disclosure Vulnerability Across Office Products<\/h2>\n

This month\u2019s release includes 21 Critical<\/b> RCE vulnerabilities and one Critical<\/b> information disclosure flaw spanning Outlook, Word, Excel, PowerPoint, Office Graphics Component, and Windows Graphics Component. Twelve of the 22 are triggerable through Outlook Reading Pane or Explorer Preview Pane, meaning that receipt of a crafted email or arrival of a crafted file at a shared location is sufficient for code execution without any user click. The other 10 require the recipient to open the malicious file for exploitation to succeed.<\/p>\n

CVSS<\/b> scores range from 6.5<\/b> to 9.8<\/b>. The three 9.8-scored items in the Preview Pane or Reading Pane subset are CVE-2026-77493<\/a> (Windows Graphics Component, Preview Pane), CVE-2026-78510<\/a> (Word, Preview Pane), and CVE-2026-78509<\/a> (Outlook, Reading Pane).<\/p>\n

Attack-surface size is the dominant concern for the Preview Pane subset. Microsoft Office is installed on virtually every enterprise endpoint, and the Preview Pane trigger removes the user-decision checkpoint that would otherwise stand in the way of document-borne payload execution. Malicious RTF files, PowerPoint presentations, and Outlook messages all appear as delivery vectors within this group. This class of flaw has historically been attractive to phishing operators and initial-access brokers because delivery is trivial and interaction requirements are minimal.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Table 8. Critical RCE vulnerabilities and information disclosure vulnerability across Office products<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-77493<\/td>\nWindows Graphics Component Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-78509<\/td>\nMicrosoft Office Outlook Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-78510<\/td>\nMicrosoft Word Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69285<\/td>\nMicrosoft Office Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69632<\/td>\nMicrosoft Office Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69678<\/td>\nMicrosoft Office PowerPoint Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69767<\/td>\nMicrosoft Office PowerPoint Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69797<\/td>\nMicrosoft Office PowerPoint Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-78439<\/td>\nMicrosoft Office Graphics Component Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-78505<\/td>\nMicrosoft Office Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-78519<\/td>\nMicrosoft Office Outlook Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-78525<\/td>\nMicrosoft Office Outlook Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-81952<\/td>\nMicrosoft Word Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-81955<\/td>\nWindows Graphics Component Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81948<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81949<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81950<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81951<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81953<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.8<\/td>\nCVE-2026-81959<\/td>\nMicrosoft Excel Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n7.5<\/td>\nCVE-2026-77898<\/td>\nMicrosoft Office Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n6.5<\/td>\nCVE-2026-78520<\/td>\nMicrosoft Office Outlook Information Disclosure Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows Secure Socket Tunneling Protocol<\/h2>\n

CVE-2026-73009<\/a> is a Critical<\/b> RCE vulnerability in the Windows Secure Socket Tunneling Protocol (SSTP) service and has a CVSS<\/b> score of 9.8<\/b>. An unauthenticated attacker can send a specially crafted packet to the SSTP listener and execute code on the target system.<\/p>\n

SSTP is the Microsoft-native VPN protocol supported out-of-the-box by Windows Server\u2019s Routing and Remote Access Service (RRAS). Organizations that offer SSTP-based remote-access VPN typically expose the vulnerable service directly to the internet on TCP\/443, which means exploitation does not require prior network access or credential theft. A compromise of SSTP is a perimeter breach with immediate lateral-movement opportunity.<\/p>\n

Edge-facing VPN infrastructure has historically been a favored target for both nation-state threat actors and ransomware operators because a single exploited gateway can bypass significant internal segmentation work.<\/p>\n\n\n\n\n
Table 9. Critical RCE vulnerability in Windows Secure Socket Tunneling Protocol<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n9.8<\/td>\nCVE-2026-73009<\/td>\nWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows Kerberos<\/h2>\n

CVE-2026-69676<\/a> is a Critical<\/b> RCE vulnerability in Windows Kerberos and has a CVSS<\/b> score of 8.8<\/b>. The flaw stems from an authentication bypass via capture-replay: An attacker who has already obtained low-privileged credentials in the target environment can intercept a legitimate Kerberos authentication exchange and replay a modified variant back to the server, which processes it as authentic and executes attacker-controlled code. No further user interaction is required.<\/p>\n

Kerberos issues authentication tickets for every domain-joined resource in an Active Directory environment. A code execution flaw in this component can provide an attacker with a foothold inside the authentication layer that every domain service implicitly trusts. Successful exploitation could allow an adversary to forge or manipulate ticket-granting operations, potentially enabling lateral movement across the entire forest. Kerberos-layer attacks have historically been a preferred technique in both ransomware intrusions and targeted campaigns because they offer persistent, stealthy access that survives individual host remediation.<\/p>\n\n\n\n\n
Table 10. Critical RCE vulnerability in Windows Kerberos<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69676<\/td>\nWindows Kerberos Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerabilities and Elevation of Privilege Vulnerability in Windows Hyper-V<\/h2>\n

CVE-2026-69603<\/a>, CVE-2026-80083<\/a>, and CVE-2026-72961<\/a> are Critical<\/b> vulnerabilities in Windows Hyper-V and have CVSS<\/b> scores of 8.8<\/b>, 8.8<\/b>, and 8.2<\/b>, respectively. CVE-2026-69603 allows arbitrary code execution through a heap-based buffer overflow via a malformed hypercall payload size. CVE-2026-80083 allows arbitrary code execution on the host through an untrusted pointer dereference reachable from a guest application. CVE-2026-69603 and CVE-2026-80083 enable an attacker operating inside a guest VM to breach the hypervisor isolation boundary. CVE-2026-72961 exploits a buffer overflow in virtual TPM state handling to escalate from host admin to Virtual Trust Level 1 (VTL1) privileges.<\/p>\n

A guest-to-host escape compromises the hypervisor, which means the attacker can inspect or manipulate memory for all co-resident VMs, extract secrets from isolated tenants, and persist below the operating-system layer where most endpoint detection stops. In multi-tenant or shared-infrastructure environments, this class of flaw converts a single compromised workload into a platform-wide incident. Hypervisor-escape vulnerabilities have historically been a priority target for sophisticated adversaries because the payoff scales with consolidation density.<\/p>\n\n\n\n\n\n\n
Table 11. Critical vulnerabilities in Windows Hyper-V<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69603<\/td>\nWindows Hyper-V Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-80083<\/td>\nWindows Hyper-V Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.2<\/td>\nCVE-2026-72961<\/td>\nWindows Hyper-V Elevation of Privilege Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Critical RCE Vulnerability in Windows Remote Desktop<\/h2>\n

CVE-2026-69518<\/a> is a Critical<\/b> RCE vulnerability in Windows Remote Desktop and has a CVSS<\/b> score of 8.8<\/b>. An attacker who joins a Remote Desktop sharing session can send specially crafted clipboard data to the sharing host and execute code on the host system. User interaction is required only to the extent that a sharing session must be active; the attacker does not need additional prompts or clicks once connected.<\/p>\n

The attack-surface concern here is the clipboard channel, a feature enabled by default in most RDP configurations because it supports legitimate productivity workflows. Environments that permit clipboard redirection between client and host (the default) are exposed whenever a sharing session is active. This includes help-desk scenarios, remote-support tools built on RDP, and any third-party application that leverages the Remote Desktop API for screen sharing. RDP services have historically been a primary initial-access vector for ransomware operators and opportunistic attackers scanning for exposed endpoints, though this particular flaw requires session participation rather than unauthenticated network access.<\/p>\n\n\n\n\n
Table 12. Critical RCE vulnerability in Windows Remote Desktop<\/caption>\n
Severity<\/b><\/td>\nCVSS Score<\/b><\/td>\nCVE<\/b><\/td>\nDescription<\/b><\/td>\nAction Required?<\/b><\/td>\n<\/tr>\n
Critical<\/b><\/td>\n8.8<\/td>\nCVE-2026-69518<\/td>\nWindows Remote Desktop Remote Code Execution Vulnerability<\/td>\nYes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Additional Critical Vulnerabilities Addressed This Month<\/h2>\n