Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days

CVE-2023-21674 is a use-after-free flaw (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) facility, the kernel-level mechanism Windows uses for fast communication between processes and system services. An attacker who can already run code on a Windows machine can trigger the bug by sending crafted ALPC requests, corrupting memory in a privileged process. Successful exploitation allows a local, low-privileged attacker to elevate to SYSTEM/administrator privileges, typically to gain full control of the host or to complete an exploit chain after an initial compromise. Essentially all supported Windows client and server installations from Microsoft are affected; the source data does not list specific versions, and the fix shipped with Microsoft's January 2023 Patch Tuesday, which addressed a record 974 vulnerabilities including this and one other actively exploited Windows zero-day. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2023-01-10, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is undetermined, and EPSS estimates a 41.8% probability of exploitation in the next 30 days (99th percentile).

Do: Apply Microsoft's January 2023 (released 2023-01-10) or later Windows cumulative security updates to all Windows clients and servers, per CISA's required action to 'apply updates per vendor instructions.' Because this is a local privilege escalation, prioritize hosts where low-privileged users or untrusted code execute, such as endpoints, RDS/VDI servers, and multi-user systems, and verify installation via your update-management inventory. Treat this as actively exploited; with no public PoC or documented workaround, timely patching is the primary mitigation.

CVE-2026-55007 is a double-free memory corruption flaw (CWE-415) in Microsoft Exchange Server in which the same heap allocation is freed twice, corrupting memory. A remote, unauthenticated attacker can trigger the flaw over the network, though the high attack complexity (AC:H) means reliable exploitation likely depends on favorable heap/timing conditions, making it harder to weaponize than typical pre-auth RCEs. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.1). Any organization running on-premises Microsoft Exchange Server is in scope, with the greatest risk on servers reachable from untrusted networks. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% chance of exploitation within 30 days; it was disclosed amid Microsoft's record September 2026 Patch Tuesday (974 CVEs), which press coverage highlighted for notable Exchange flaws.

Do: Apply Microsoft's September 2026 Exchange Server security updates as soon as possible, prioritizing internet-facing servers (OWA/ECP and SMTP endpoints); since affected version ranges are not included in this data, confirm affected versions and fixed builds in Microsoft's advisory for CVE-2026-55007. Until patched, restrict untrusted network access to Exchange endpoints, and monitor the MSRC advisory and KEV for exploitation updates given the high-severity, pre-authentication nature of the flaw.

Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched).

Do: Apply the SQL Server security updates from Microsoft's September 2026 Patch Tuesday as soon as practical, prioritizing internet-exposed instances and servers that accept untrusted input whose output feeds downstream components. With no public PoC or KEV listing, near-term risk appears low, but re-prioritize if technical details or exploit code emerge. Verify deployed SQL Server builds against Microsoft's advisory for CVE-2026-65669 to confirm remediation.

CVE-2026-69465 is a missing authorization flaw (CWE-862) in Microsoft Office SharePoint, specifically SharePoint Server. An attacker who already holds valid, low-privileged credentials can send a crafted network request to the server, and because the application fails to properly verify permissions, the request results in arbitrary code execution. Successful exploitation gives the attacker code execution on the server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High), with no user interaction required. Organizations running on-premises SharePoint Server are affected; the specific version ranges are not stated in the available data. There is currently no known in-the-wild exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV, with EPSS estimating a 0.8% chance of exploitation within 30 days.

Do: Apply the SharePoint Server security update that addresses this CVE as published in Microsoft's Patch Tuesday release (consult the Microsoft Security Update Guide for the exact KB and affected versions). Until patched, reduce exposure by limiting which accounts can reach SharePoint externally (VPN/extranet access) and monitoring authenticated requests for anomalous activity. Since exploitation requires an authorized account, review whether low-privileged or external users have access to internet-facing SharePoint servers.

CVE-2026-69525 is a use-after-free memory corruption flaw (CWE-416) in Windows Remote Desktop Services, rated critical at CVSS 9.8. Per the CVSS vector, a remote, unauthenticated attacker can reach the vulnerable code path over the network with no privileges and no user interaction, presumably by sending crafted input to the RDP/RDS service. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability. Any Windows system running Remote Desktop Services is affected, and organizations exposing RDP (TCP 3389) to the internet are the primary concern, since public scans show millions of such endpoints. There is no public proof-of-concept or CISA KEV listing yet, and EPSS estimates a ~1.1% (63rd percentile) chance of exploitation within 30 days; the fix shipped as part of Microsoft's record 974-CVE Patch Tuesday, which separately included two exploited Windows zero-days and 20 wormable bugs.

Do: Apply Microsoft's security update for CVE-2026-69525 as soon as possible, prioritizing hosts with RDP (TCP 3389) reachable from untrusted networks. Until patched, restrict RDP exposure via firewall rules, VPN, or RD Gateway, and enable Network Level Authentication as a precaution. Inventory internet-facing systems for exposed RDP listeners and monitor for exploitation activity.

CVE-2026-69595 is a use-after-free memory corruption flaw (CWE-416) in the ONCRPC XDR driver of Microsoft's Windows Services for NFS (Network File System). An unauthenticated remote attacker can trigger it by sending crafted ONCRPC/XDR network traffic to a machine running the NFS service, causing the driver to reference freed memory. Successful exploitation yields arbitrary code execution on the target with full confidentiality, integrity, and availability impact (CVSS 9.8, no credentials or user interaction required). Affected organizations are those that have installed and enabled the optional Services for NFS interoperability feature, primarily on Windows Server in mixed Windows/Unix file-sharing environments; the source data does not specify affected version ranges. No exploitation is publicly known at this time: the flaw is not in CISA's KEV, no public proof-of-concept exists, and EPSS estimates only a 1.1% chance of exploitation within 30 days; Microsoft patched it as part of its record 974-flaw release.

Do: Apply Microsoft's update for this CVE from the 974-flaw patch release as a priority. If the NFS feature is not needed, disable or remove Services for NFS; otherwise restrict ONCRPC/NFS traffic (typical ports 2049 and 111, TCP and UDP) to trusted networks only. Audit your Windows servers for whether the Services for NFS feature is installed, since it is optional and easily overlooked.

CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server running the DNS Server role as soon as possible, prioritizing internet-facing DNS servers and domain controllers. Until patched, limit exposure of TCP/UDP port 53 from untrusted networks and restrict remote management surfaces. Because the bug is rated wormable and shares characteristics with the 2020 SigRed DNS RCE, treat unpatched domain controllers as high priority and check DNS service event logs for unexpected restarts or anomalous query handling.

CVE-2026-69829 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Shell. According to its CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), an unauthorized remote attacker could trigger the flaw over a network without needing privileges, user interaction, or special conditions. Successful exploitation would allow the attacker to execute code on the affected host, with high impact on confidentiality, integrity, and availability. All Windows installations that include the Windows Shell component are potentially affected, though the available data does not enumerate specific vulnerable version ranges. There is currently no known public proof-of-concept, the CVE is not in CISA's KEV, and EPSS assigns roughly a 1.1% probability of exploitation within 30 days; the related headlines note Microsoft's record patch release of 974 flaws included two other exploited Windows zero-days, but no confirmed in-the-wild exploitation of this specific CVE is documented.

Do: Apply Microsoft's latest Windows security updates across all Windows systems, prioritizing internet-facing machines, and confirm the update covering CVE-2026-69829 is installed on each host. If patching must be deferred, reduce exposure by limiting network access to Windows services that invoke shell functionality, and monitor Microsoft's advisory, CISA KEV, and public PoC releases for signs of rising exploitation risk.

CVE-2026-7296 is a use-after-free memory-corruption flaw (CWE-416) in the Windows DHCP Server role, rated critical (CVSS 9.8). An unauthenticated attacker can trigger it by sending network traffic to the DHCP service, with no credentials or user interaction required. Successful exploitation allows arbitrary code execution on the DHCP server, with high impact on confidentiality, integrity, and availability per the CVSS vector. Any Windows Server with the DHCP Server role enabled is affected; the available data does not enumerate specific affected or fixed build numbers. As of the September 2026 Patch Tuesday release (which patched a record 974 flaws, including two separately exploited Windows zero-days), there is no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 1% probability of exploitation within 30 days.

Do: Apply the September 2026 Microsoft security updates to every Windows Server with the DHCP Server role, prioritizing servers reachable from untrusted networks such as guest Wi-Fi, branch, and edge sites. Until patched, restrict DHCP traffic (UDP ports 67 and 68) to trusted network segments and monitor for anomalous DHCP activity. Inventory the role on your estate (e.g., via Windows Server role/DHCP server audits) to confirm patch coverage.

CVE-2026-80097 is an improper authentication flaw (CWE-287) in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally, rated 8.6 (high) with no privileges required, required user interaction, and a changed scope. Exploitation requires local access to a device running the app plus user interaction, and because the scope is changed, a successful attack crosses a security boundary beyond the Authenticator component itself. A successful exploit yields local privilege elevation with high impact to confidentiality, integrity, and availability. Anyone running affected versions of Microsoft Authenticator is affected; the app is Microsoft's standard multi-factor authentication app for Entra ID/Microsoft 365 and is widely deployed across enterprise and personal mobile devices. As of the September 2026 disclosure it is not known to be exploited - no public PoC, not in CISA KEV, EPSS 0.4% (33rd percentile) - and it was patched amid the record 974-flaw Patch Tuesday, though the two actively exploited zero-days in that release are Windows flaws, not this one.

Do: Update Microsoft Authenticator through its usual app-store distribution channels (iOS App Store/Google Play) to the build released with September 2026 Patch Tuesday, and verify updated versions across the fleet via MDM or app inventory; specific patched build numbers were not provided in the source data. Prioritize shared workstations, kiosks, and hot-desked or BYOD endpoints where unprivileged local users interact with the app. No public PoC or in-the-wild exploitation is known, so routine prompt patching is appropriate.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.