Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs

CVE-2026-55007 is a double-free memory corruption flaw (CWE-415) in Microsoft Exchange Server in which the same heap allocation is freed twice, corrupting memory. A remote, unauthenticated attacker can trigger the flaw over the network, though the high attack complexity (AC:H) means reliable exploitation likely depends on favorable heap/timing conditions, making it harder to weaponize than typical pre-auth RCEs. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.1). Any organization running on-premises Microsoft Exchange Server is in scope, with the greatest risk on servers reachable from untrusted networks. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% chance of exploitation within 30 days; it was disclosed amid Microsoft's record September 2026 Patch Tuesday (974 CVEs), which press coverage highlighted for notable Exchange flaws.

Do: Apply Microsoft's September 2026 Exchange Server security updates as soon as possible, prioritizing internet-facing servers (OWA/ECP and SMTP endpoints); since affected version ranges are not included in this data, confirm affected versions and fixed builds in Microsoft's advisory for CVE-2026-55007. Until patched, restrict untrusted network access to Exchange endpoints, and monitor the MSRC advisory and KEV for exploitation updates given the high-severity, pre-authentication nature of the flaw.

Microsoft Exchange Server contains a missing-authorization vulnerability (CWE-862) in which a network-accessible component fails to properly verify a caller's permissions before handling a request. An attacker who already holds valid low-privileged credentials can send crafted requests over the network to trigger the flaw and elevate privileges. The CVSS ratings show high confidentiality and integrity impact, so successful elevation likely grants access to and control over sensitive mailbox or server resources. Organizations running on-premises Microsoft Exchange Server are affected, whether the server is internet-exposed or reachable by internal users with standard accounts. As of the available data there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.7% probability of exploitation within 30 days; it was addressed in Microsoft's large Patch Tuesday release per related coverage.

Do: Apply the Exchange Server security update from Microsoft's advisory for this CVE as soon as it is available for your installed cumulative update. Because exploitation requires an authenticated low-privileged user, restrict external access to OWA/EWS and other Exchange web endpoints (VPN or IP allowlists) and audit for unexpected privilege changes or new privileged accounts. Follow Microsoft's advisory for exact affected and fixed versions, as none were specified in this data.

CVE-2026-69525 is a use-after-free memory corruption flaw (CWE-416) in Windows Remote Desktop Services, rated critical at CVSS 9.8. Per the CVSS vector, a remote, unauthenticated attacker can reach the vulnerable code path over the network with no privileges and no user interaction, presumably by sending crafted input to the RDP/RDS service. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability. Any Windows system running Remote Desktop Services is affected, and organizations exposing RDP (TCP 3389) to the internet are the primary concern, since public scans show millions of such endpoints. There is no public proof-of-concept or CISA KEV listing yet, and EPSS estimates a ~1.1% (63rd percentile) chance of exploitation within 30 days; the fix shipped as part of Microsoft's record 974-CVE Patch Tuesday, which separately included two exploited Windows zero-days and 20 wormable bugs.

Do: Apply Microsoft's security update for CVE-2026-69525 as soon as possible, prioritizing hosts with RDP (TCP 3389) reachable from untrusted networks. Until patched, restrict RDP exposure via firewall rules, VPN, or RD Gateway, and enable Network Level Authentication as a precaution. Inventory internet-facing systems for exposed RDP listeners and monitor for exploitation activity.

CVE-2026-69730 is a use-after-free memory corruption flaw (CWE-416) in the Windows DNS service that allows an unauthenticated, remote attacker to execute arbitrary code by sending crafted network traffic to the affected system. Because the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1 9.8), any system running the vulnerable DNS service is a direct target. Successful exploitation would give the attacker code execution in the context of the DNS service, which on Windows Server typically runs with high privileges such as SYSTEM, and could enable wormable spread between vulnerable hosts. Affected organizations are those running the Windows DNS Server role — a component deployed on virtually all Windows Server domain controllers and on dedicated Windows DNS servers, especially those exposed to untrusted networks. As of the September 2026 Patch Tuesday release, there is no known public proof-of-concept, the flaw is not listed in CISA's KEV, and it has not been confirmed exploited in the wild, though it was flagged among roughly 20 'wormable' bugs and described in press coverage as a successor to the 2020 SigRed Windows DNS RCE.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server running the DNS Server role as soon as possible, prioritizing internet-facing DNS servers and domain controllers. Until patched, limit exposure of TCP/UDP port 53 from untrusted networks and restrict remote management surfaces. Because the bug is rated wormable and shares characteristics with the 2020 SigRed DNS RCE, treat unpatched domain controllers as high priority and check DNS service event logs for unexpected restarts or anomalous query handling.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.