Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-54518 | Improper isolation of shared resources within the CPU operation cache on Zen 2-based products could allow an attacker to corrupt instructions executed at a… | 7.3 | <1% | ||
CVE-2026-33109+1 related CVE | Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network | 9.9 group max | <1% | ||
| CVE-2026-33117 | The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison… | 9.1 | <1% | ||
| CVE-2026-33823 | Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network | 6.5 | <1% | ||
| CVE-2026-35428 | Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing… | 9.6 | <1% | ||
CVE-2026-40364+1 related CVE | Access of resource using incompatible type ('type confusion') in Microsoft Office Word allows an unauthorized attacker to execute code locally | 8.4 | 4% | ||
| CVE-2026-40379 | Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network | 7.5 | <1% | ||
CVE-2026-41096+1 related CVE | Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network | 9.8 group max | 3% | PoC | |
| CVE-2026-41089 | Unauthenticated Stack Buffer Overflow RCE in Windows Server Netlogon (CVE-2026-41089) | 9.8 | 78% | PoC ×6 | |
| CVE-2026-41103 | Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a… | 9.1 | 5% | ||
| CVE-2026-42823 | Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network | 9.9 | <1% | ||
| CVE-2026-42826 | Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network | 7.5 | <1% | ||
CVE-2026-42898+1 related CVE | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network | 9.9 group max | 1% |
From the original article
6 min read at thehackernews.com
Microsoft on Tuesday released patches for 138 security vulnerabilities spanning its product portfolio, although none of them have been listed as publicly known or under active attack. Of the 138 flaws, 30 are rated Critical, 104 are rated Important, three are rated Moderate, and one is rated Low in severity.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.