Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

CVE-2026-57099 is a denial-of-service flaw in ASP.NET Core (CWE-770): the framework allocates resources without limits or throttling, so an unauthenticated remote attacker can send crafted network traffic that drives unbounded resource consumption and exhausts the host. It is triggered over the network by requests to an affected ASP.NET Core application, with no privileges or user interaction required. Successful exploitation impacts availability only — the CVSS vector shows no confidentiality or integrity impact — so the attacker can crash, hang, or degrade the service but cannot read or modify data. Any organization running ASP.NET Core applications is potentially affected, with highest risk for internet-facing apps, APIs, and services where anonymous attackers can reach the endpoint directly. No public proof-of-concept or known exploitation exists; the flaw carries a modest EPSS of 0.8% (55th percentile) and was addressed in Microsoft's September 2026 Patch Tuesday release.

Do: Apply the ASP.NET Core/.NET updates released in Microsoft's September 2026 Patch Tuesday, prioritizing internet-facing applications and APIs. As interim mitigations, enable rate limiting, reverse-proxy request size/body limits and timeouts, and connection or concurrency caps to bound resource consumption per client. Inventory which servers and containerized workloads run ASP.NET Core and identify which endpoints are reachable by unauthenticated network users before patching.

CVE-2026-58649 is an origin validation error (CWE-346) in Microsoft's .NET platform, meaning the runtime fails to correctly verify the origin of network requests, allowing an unauthenticated attacker to trigger an information-disclosure condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates the flaw is reachable over a network with low attack complexity and no privileges required, but a victim user must interact with attacker-influenced content for it to fire. A successful attacker gains access to confidential information handled by the affected application (confidentiality impact rated High), with no integrity or availability impact. Any organization running supported .NET deployments that have not yet received the September 2026 Patch Tuesday updates is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation probability at just 0.3%, so no in-the-wild exploitation is known.

Do: Apply Microsoft's September 2026 .NET security updates as part of this month's Patch Tuesday rollout, and check Microsoft's advisory for the exact version ranges that need upgrading. Prioritize internet-facing .NET/ASP.NET applications that perform cross-origin request handling, and review their origin-verification (CORS) configuration as an interim risk reduction. Because exploitation requires user interaction, also treat user-facing lure links as part of the realistic attack path until systems are patched.

CVE-2026-62762 is a null pointer dereference (CWE-476) in Microsoft Active Directory Domain Services (AD DS), the directory service role that provides authentication and identity for Windows Server domains. An authorized, low-privileged user can trigger it remotely — with no user interaction and low attack complexity — by sending crafted network requests to a domain controller, causing the service to dereference a null pointer and crash. The impact is denial of service only (no confidentiality or integrity loss, per the CVSS 6.5 score with Availability:High), and because domain controllers are the authentication backbone of a domain, crashes can disrupt logons and dependent services across the environment. Any organization operating Windows Server domain controllers with the AD DS role is affected; the flaw was addressed in Microsoft's September 2026 Patch Tuesday, which fixed 966 flaws including 2 zero-days, though the data does not identify this CVE as one of the exploited zero-days. There is no known exploitation: no public proof-of-concept, not listed in CISA KEV, and only a modest 0.8% EPSS probability of exploitation within the next 30 days (percentile 53).

Do: Apply Microsoft's September 2026 security updates for AD DS/Windows Server to every domain controller, including remote, branch, and lab DCs, as part of this month's Patch Tuesday rollout. Until patched, restrict which authenticated accounts and hosts can reach domain controllers over directory protocols such as LDAP, and avoid exposing DCs directly to the internet. After patching, review domain controller event logs for crashes or unexpected service restarts that could indicate probing or attempted exploitation.

CVE-2026-62810 is a heap-based buffer overflow (CWE-122) in Active Directory Certificate Services (AD CS), the Windows Server role that operates an organization's certificate authority. An authorized attacker with low privileges on the affected server can trigger the overflow through local interaction with the AD CS service. Successful exploitation elevates the attacker's privileges on that host, with high impact on confidentiality, integrity, and availability. Any organization running the AD CS role on Windows Server is potentially affected; specific version ranges are not provided in the available data. Exploitation status: no public proof-of-concept, not listed in CISA KEV, and a low 0.2% EPSS probability, though the flaw was patched in Microsoft's September 2026 Patch Tuesday release.

Do: Apply the September 2026 Microsoft security updates to all Windows Servers hosting the AD CS role, prioritizing issuing and enterprise CAs. Until patched, restrict interactive and remote logon rights on CA servers to trusted administrators and review local accounts with access to those hosts. Monitor vendor advisories for confirmed affected version ranges, since the flaw requires an authorized local account and no public exploit currently exists.

CVE-2026-62813 is a use-after-free memory-corruption flaw (CWE-416) in Microsoft's Active Directory Domain Services (AD DS), the directory service role that runs on Windows Server domain controllers. A low-privileged, authenticated ("authorized") attacker can trigger it remotely with crafted network traffic to the AD DS service under conditions where the service accesses memory that has already been freed; the high attack-complexity rating (AC:H) means successful exploitation depends on timing and memory state and is less reliably repeatable. A successful attack yields remote code execution on the domain controller with high impact to confidentiality, integrity, and availability, potentially giving an attacker control of the system and the directory that handles authentication for the environment. Any organization running Windows Server domain controllers with the AD DS role is potentially affected; Microsoft shipped the fix in its September 2026 Patch Tuesday release, which addressed 966 flaws including 2 zero-days. Exploitation has not been observed: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.6% probability of exploitation within 30 days (48th percentile).

Do: Apply Microsoft's September 2026 Patch Tuesday security updates for AD DS to all Windows Server domain controllers as soon as practical, prioritizing any domain controllers reachable from the internet or partner networks. Because the flaw requires only low-privileged authenticated access, review which untrusted users, service accounts, or trusts can authenticate to domain controllers, and restrict LDAP/RPC network access to DCs from untrusted segments. No public exploit exists yet, but confirm the exact affected and fixed builds in Microsoft's advisory and monitor for escalation to active exploitation.

Microsoft Azure Arc (CVE-2026-62895) contains a privilege elevation flaw caused by a permissive cross-domain policy that trusts untrusted domains, mapped by Microsoft to CWE-942 (permissive cross-domain policy with untrusted domains), CWE-1390 (weak authentication) and CWE-89 (SQL injection). An unauthenticated attacker can exploit it over a network, with CVSS scoring indicating some user interaction is required (AV:N/AC:L/PR:N/UI:R), by abusing the overly permissive cross-domain trust to elevate privileges, with high impact on confidentiality, integrity and availability (CVSS 3.1: 8.8 High). Any organization using Azure Arc to manage hybrid or multi-cloud resources is potentially affected. There is no evidence of exploitation in the wild, no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% probability of exploitation in the next 30 days (52nd percentile). Microsoft addressed the flaw as part of its September 2026 Patch Tuesday release, which fixed 966 flaws including 2 zero-days.

Do: Apply Microsoft's September 2026 Patch Tuesday updates for Azure Arc across all Arc-enabled infrastructure, prioritizing environments where unauthenticated network users can reach Arc-connected resources. The available data does not include fixed version or KB details, so consult the Microsoft advisory for CVE-2026-62895 to identify the patched build for your components. In the interim, review and tighten the domains Azure Arc trusts in cross-domain policies and treat any unauthenticated network access to Arc-managed resources as a privilege-elevation risk.

CVE-2026-69304 is a denial-of-service flaw in ASP.NET Core caused by improper handling of highly compressed data, where small malicious inputs expand enormously when processed (data amplification, CWE-409). A remote, unauthenticated attacker can trigger it by sending specially crafted highly compressed data to a vulnerable server over the network, although the high attack-complexity rating means exploitation depends on specific processing conditions rather than succeeding on every request. Successful exploitation affects availability only: the CVSS 5.9 score reflects high availability impact with no confidentiality or integrity loss, so the attacker gains the ability to disrupt or exhaust a service, not to steal or modify data. Any application or server built on ASP.NET Core (distributed via NuGet and bundled with the .NET runtime) is potentially affected, and fixes shipped as part of Microsoft's September 2026 Patch Tuesday. There is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a 0.8% 30-day exploitation probability, so no active exploitation is currently known.

Do: Apply Microsoft's September 2026 .NET/ASP.NET Core security updates (via the .NET runtime/SDK installers and updated NuGet packages) and rebuild or redeploy affected web applications. Prioritize services that decompress client-supplied request bodies or accept compressed uploads, and as an interim mitigation enforce limits on decompressed request sizes where supported. With no public PoC or known in-the-wild exploitation, this can be handled within your normal Patch Tuesday patching cycle.

CVE-2026-69329 is an out-of-bounds read (CWE-125, arising from an integer-overflow condition, CWE-190) in the BranchCache component of Microsoft Windows. A remote, unauthenticated attacker can trigger the flaw over the network with no privileges or user interaction by sending malformed input to a system running BranchCache. Successful exploitation results only in denial of service of the BranchCache service — availability impact with no information disclosure or tampering (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Affected systems are Windows installations with the optional BranchCache feature enabled, such as branch-office caching deployments (Hosted Cache Servers or clients in distributed mode); the provided data does not specify affected version ranges. There is currently no known exploitation: the flaw was addressed in Microsoft's September 2026 Patch Tuesday (part of a 966-flaw release), has no public PoC, is not in CISA KEV, and carries an EPSS of 1.1% (62nd percentile).

Do: Apply the September 2026 Microsoft cumulative updates (Windows client and Windows Server) on all systems, prioritizing servers that use BranchCache, such as Hosted Cache Servers and file/web servers behind it. Until patched, mitigate by disabling BranchCache via Group Policy/Windows Features or by restricting network reachability of BranchCache-enabled endpoints. Inventory which systems actually have BranchCache enabled (e.g., via the BranchCache status cmdlets or Group Policy settings) to focus remediation.

CVE-2026-69359 is a heap-based buffer overflow (CWE-122) in Microsoft's Active Directory Domain Services (AD DS), patched as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws including 2 zero-days. An attacker who already holds a low-privileged authorized account on a system running the AD DS role (typically a domain controller) can trigger the overflow locally; per the CVSS vector the attack requires no user interaction and no remote access. Successful exploitation yields local elevation of privilege with high impact on confidentiality, integrity, and availability — on a domain controller this means the attacker gains elevated rights on the host that effectively expose the directory service itself. Any organization operating AD DS on Windows Server domain controllers is potentially affected. There is currently no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS assigns a low 0.3% probability of exploitation within 30 days; whether this CVE is one of the two actively exploited zero-days reported in the September 2026 release is not stated in the available data.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates for Windows Server/AD DS as soon as possible, prioritizing domain controllers. In the interim, restrict interactive logon, RDP, and remote management rights on domain controllers to trusted administrators, since exploitation requires an authorized local account. Given no known public exploit and low EPSS (0.3%), treat this as routine patch prioritization rather than an emergency, but include all domain controllers in the patch wave.

CVE-2026-69395 is an externally-controlled format string flaw (CWE-134) in Active Directory Certificate Services (AD CS), the Microsoft Windows Server role that issues and manages digital certificates for an Active Directory environment. An attacker with low-level authorized access — i.e., a valid authenticated account — can send crafted format-string input to the AD CS service over the network, causing the service to misinterpret that input and leak information. Per the CVSS score of 6.5, the impact is limited to confidentiality: the attacker can disclose sensitive service or process information but cannot alter data or disrupt the service. Any organization running the AD CS role on Windows Server is potentially affected, which includes a large share of enterprise Active Directory deployments. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.9% chance of exploitation in the next 30 days; the issue is addressed in Microsoft's September 2026 Patch Tuesday release.

Do: Install the September 2026 Microsoft security updates on every server running the AD CS role, prioritizing CAs reachable by broad groups of authenticated users. Review whether AD CS network endpoints (such as Web Enrollment or enrollment web services) are exposed to less-trusted network segments and restrict access to them. Monitor Microsoft's advisory for the precise list of affected Windows Server versions, since version details are not included in the data available here.

CVE-2026-69401 is a use-after-free (CWE-416) in the Audio Video Control Transport Protocol (AVCTP) component of Microsoft Windows, the protocol layer used to control Bluetooth audio and video devices. A local, authorized (low-privileged) attacker can trigger the flaw by interacting with the vulnerable protocol handling such that memory is freed while still in use, though the high attack-complexity score indicates reliable triggering is non-trivial. Successful exploitation lets the attacker elevate privileges locally on the affected machine, with high impact to confidentiality, integrity, and availability once elevated. Any Windows system that includes the AVCTP/Bluetooth component is affected, meaning a very broad portion of the Windows installed base. Exploitation status is currently calm: there is no known public proof-of-concept, the flaw is not in CISA KEV, EPSS is low at 0.2%, and the fix shipped as part of Microsoft's September 2026 Patch Tuesday (966 flaws fixed, including 2 zero-days).

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to all Windows endpoints as soon as patching windows allow, prioritizing shared, multi-user, or kiosk-style systems where untrusted local accounts exist. Since the bug requires an authorized local attacker, reduce exposure by limiting local sign-in rights and auditing which users hold accounts on sensitive machines. Consult Microsoft's advisory to identify the exact affected builds for your Windows versions, as the version ranges were not included in the data available here.

CVE-2026-69439 is a heap-based buffer overflow (CWE-122) in Microsoft .NET and Visual Studio that an unauthorized, unauthenticated attacker can exploit over a network, per Microsoft's CVSS vector (AV:N/AC:L/PR:N/UI:R). Triggering the flaw requires user interaction (UI:R), meaning a user must be induced into an action such as opening or processing attacker-influenced content, which then corrupts heap memory in the affected component. Successful exploitation yields elevation of privilege: the attacker gains the targeted user's privileges, with high impact on confidentiality, integrity, and availability (overall 8.8, High). Anyone running an affected .NET runtime/SDK or Visual Studio build is exposed; the source data does not specify the affected version ranges, which must be confirmed against Microsoft's advisory. No public proof-of-concept exists, the flaw is not in CISA's KEV, and EPSS puts 30-day exploitation odds at only 0.7% (52nd percentile); the related news is Microsoft's September 2026 Patch Tuesday (966 fixes, 2 zero-days), which presumably includes this fix but does not indicate in-the-wild exploitation of this issue.

Do: Apply the .NET and Visual Studio security updates from Microsoft's September 2026 Patch Tuesday, prioritizing systems where untrusted users can be induced to open crafted files or content. Because no version ranges are listed here, compare installed .NET runtime/SDK and Visual Studio builds against Microsoft's advisory to confirm coverage. Until patched, caution users against opening untrusted files or projects that exercise network-adjacent .NET processing.

CVE-2026-69516 is a use-after-free (CWE-416) memory-corruption flaw in the Windows Connected Devices Platform Service (Cdpsvc), a service Microsoft ships and runs by default on modern Windows desktops. An authorized attacker who already has a low-privileged foothold on the machine can trigger the flaw by racing the service's memory handling, causing it to reuse freed memory; the high attack-complexity rating indicates timing is not trivially reliable. Successful exploitation elevates the attacker's privileges locally, yielding high impact on confidentiality, integrity, and availability of the host, and is a typical link in chains that pair a local escalation with remote code execution. Any Windows system running Cdpsvc is affected; the flaw was patched in Microsoft's September 2026 Patch Tuesday release, which addressed 966 flaws including 2 zero-days. There is no known public proof-of-concept, no CISA KEV listing, and EPSS assigns only a 0.2% probability of exploitation in the next 30 days.

Do: Apply Microsoft's September 2026 Patch Tuesday updates to all Windows 10 and Windows 11 endpoints; no workarounds for this service are documented, so patching is the primary mitigation. Given the absence of a public PoC, KEV listing, and low EPSS, standard patch-cycle prioritization is acceptable, but bundle it with the other local privilege-escalation fixes from the same release to disrupt common RCE-to-SYSTEM attack chains.

CVE-2026-69546 is a use-after-free (CWE-416) memory corruption flaw in Microsoft's Active Directory Domain Services (AD DS), the directory service role that runs on Windows Server domain controllers. It can be triggered over the network by an unauthenticated attacker, although the high attack-complexity metric suggests exploitation requires favorable timing or conditions rather than a simple, repeatable request. Successful exploitation yields remote code execution on the domain controller with the confidentiality, integrity, and availability of the host all rated high, which in practice risks compromise of the identity infrastructure that underpins the entire domain. Any organization running the AD DS role on Windows Server is affected; the exact server builds are enumerated in Microsoft's September 2026 security updates. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns it roughly a 0.7% chance of exploitation within 30 days.

Do: Apply the September 2026 Windows Server security updates to all domain controllers as a priority, since AD DS hosts are high-value targets even when the flaw is not yet exploited in the wild. Until patching, restrict network reachability of domain controllers to trusted management and authentication traffic and monitor for anomalous DC traffic. Note the high attack complexity means opportunistic exploitation is less likely, but treat the patch as urgent given domain-controller compromise cascades to the whole domain.

CVE-2026-69576 is a use-after-free vulnerability (CWE-416) in the Graphic Fonts component of Microsoft Windows, addressed in Microsoft's September 2026 Patch Tuesday release. An attacker who already has authorized, limited local access to a system can trigger improper memory reuse during font handling, and no user interaction is required. Successful exploitation elevates the attacker's privileges locally, with high impact on confidentiality, integrity, and availability on the compromised host (CVSS 3.1 base score 7.8). Any organization running Windows is potentially affected, but exploitation requires local execution, so internet-facing attack surface is limited. There is currently no evidence of exploitation in the wild: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

Do: Apply Microsoft's September 2026 security updates to all Windows endpoints as soon as practical, prioritizing multi-user systems such as RDS/VDI hosts and shared workstations where low-privileged local accounts are available to untrusted users. Since exploitation requires local access, keep standard-user rights minimal and verify patch levels through WSUS/Intune/SCCM compliance reports. No public PoC or in-the-wild exploitation is known, but track this CVE in routine patch-compliance reporting.

CVE-2026-69624 is an incomplete list of disallowed inputs (CWE-184) in Microsoft Active Directory Certificate Services (AD CS), the Windows Server role that issues and manages digital certificates for Active Directory environments. A network-based attacker who already holds a valid low-privileged (authorized) account can send crafted input that bypasses the flawed disallow list, with no user interaction required. The impact is confined to integrity (CVSS: no confidentiality loss, no availability loss, high integrity impact), meaning the attacker can tamper with certificate-services state or data rather than read secrets or disrupt the service. Any organization running the AD CS role on Windows Server is potentially affected, though exploitation requires authenticated access rather than anonymous internet reachability. As of the September 2026 Patch Tuesday release — which fixed 966 flaws including 2 zero-days — there is no public proof-of-concept, the flaw is not in the CISA KEV catalog, and EPSS estimates only a 0.7% chance of exploitation in the next 30 days.

Do: Apply Microsoft's September 2026 Patch Tuesday security updates to every Windows Server hosting the AD CS role, prioritizing root and issuing CAs. In the interim, review and restrict certificate-enrollment and template permissions for low-privileged accounts, since exploitation requires authenticated access, and monitor CA logs for unexpected certificate or configuration changes. Confirm post-patch that certificate issuance and template settings are intact, given the tampering-only impact.

Microsoft .NET contains a privilege elevation flaw (CWE-73) in which a file name or path processed by the .NET runtime is externally controlled, allowing an unauthorized attacker to elevate privileges over a network. Exploitation requires network access, user interaction, and a high-complexity attack path (CVSS AV:N/AC:H/PR:N/UI:R), meaning the attacker must induce a user into an action that causes .NET to process an attacker-influenced file path, though no privileges are needed. A successful attack carries high impact to confidentiality, integrity, and availability, and the associated CWEs (CWE-200, CWE-522) suggest possible information exposure and insufficiently protected credentials as related effects. Any organization running affected .NET runtimes, SDKs, or .NET Framework installations is potentially exposed; exact version ranges are not specified in the available data, and fixes shipped as part of Microsoft's September 2026 Patch Tuesday (September 8, 2026). There are no known reports of exploitation, no public proof-of-concept, the flaw is absent from CISA's KEV catalog, and EPSS assigns only a 0.5% probability of exploitation within 30 days (42nd percentile).

Do: Inventory all .NET runtimes, SDKs, and .NET Framework installations and apply the .NET updates released in Microsoft's September 2026 Patch Tuesday, checking Microsoft's advisory for the specific affected version ranges since they are not listed in the available data. Prioritize user-facing and developer systems where users may be induced to handle untrusted content, and watch Microsoft's guidance for any published workarounds or version-specific remediation details.

CVE-2026-69806 is an information-exposure flaw in Microsoft .NET (CWE-200, with an associated code-generation issue, CWE-94) that allows an authorized actor to elevate privileges locally. To trigger it, an attacker must already hold a low-privileged foothold on the target system — such as the ability to execute code as a standard local user — and the high-complexity local attack path requires no user interaction. A successful exploit carries high-impact confidentiality, integrity, and availability consequences, effectively yielding elevation of privilege on the affected host. Any organization running the affected .NET components on Windows clients or servers is in scope, and the fix shipped in Microsoft's September 2026 Patch Tuesday (September 8, 2026), part of a record 966-flaw release. There is no public proof-of-concept, the flaw is not in CISA KEV, and no in-the-wild exploitation is known; EPSS assigns a 1.8% probability of exploitation within 30 days (77th percentile).

Do: Apply the .NET updates released with the September 2026 Patch Tuesday set via Windows Update, WSUS, or the Microsoft Update Catalog, verifying both .NET Framework and modern .NET runtimes against Microsoft's advisory for exact affected version ranges. Prioritize multi-user systems where standard users can already run code — RDS/terminal hosts, build and CI servers, and shared workstations — since the attack requires local access. No workaround is described in the available data, so patching is the primary mitigation.

CVE-2026-69809 is a use-after-free-style memory leak (CWE-401) in Microsoft's Active Directory Domain Services, where allocated memory is not released after its effective lifetime. An unauthenticated remote attacker can trigger the flaw by sending network traffic to a domain controller, causing memory to accumulate until the service is exhausted. The impact is denial of service only — no confidentiality or integrity compromise — but the availability impact is rated high, meaning a domain controller can become unresponsive or need restarting. Any organization running the AD DS role on affected Windows Server releases is potentially affected, since the attack requires only network reachability to the DC, not credentials or user interaction. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 1.1% probability of exploitation within 30 days; it was fixed in Microsoft's September 2026 Patch Tuesday release.

Do: Apply the September 2026 cumulative Windows Server security updates to all domain controllers, prioritizing DCs reachable from untrusted networks (VPN, DMZ, or internet-exposed LDAP/Kerberos endpoints). Until patched, restrict network access to domain controllers to trusted sources where possible, since the DoS requires only unauthenticated network reachability. Check your environment for exposed DC services and monitor Microsoft's advisory for the definitive affected-version list.

CVE-2026-69821 is an improper output encoding or escaping flaw (CWE-116) in Microsoft Active Directory Certificate Services (AD CS), the Windows Server role that issues and manages certificates in enterprise Active Directory environments. The flaw is triggered by an authorized, low-privileged attacker who already has local access to an affected system, requires no user interaction, and exploits AD CS failing to correctly encode or escape output it processes. Successful exploitation elevates the attacker's privileges locally on the affected server, with CVSS scoring high impact to confidentiality, integrity, and availability; because CA servers are trusted to issue domain-valid certificates, compromising one can be a stepping stone to broader domain compromise. Any organization running the AD CS role on Windows Server — effectively most enterprises that rely on Active Directory certificate authentication — is affected. There is no evidence of exploitation so far: no public proof-of-concept exists, the flaw is not in CISA's KEV, EPSS puts the 30-day exploitation probability at just 0.3%, and the fix shipped in Microsoft's September 2026 Patch Tuesday release.

Do: Inventory which Windows Servers host the AD CS role, then apply Microsoft's September 2026 Patch Tuesday security updates to all of them, prioritizing enterprise/issuing CAs and any CA reachable over the network. As an interim mitigation, restrict interactive logon and other local access rights on CA servers to administrators only; since there is no public PoC, this can follow your normal patch cycle, but do not defer past your standard 2-4 week window and monitor the Microsoft advisory for updates.

CVE-2026-69857 is an authorization bypass through a user-controlled key (CWE-639, an IDOR-style flaw) in Microsoft Azure Cosmos DB, Microsoft's managed NoSQL database service: an authenticated principal can supply or alter a resource identifier (key) that the service fails to validate against the caller's permissions. Triggered over a network by a low-privileged, authorized user who manipulates such a key (CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N), the flaw lets the attacker bypass access checks and perform spoofing, i.e., impersonate another identity or act outside their authorized scope. Per the CVSS vector, successful exploitation carries high impact on the confidentiality, integrity, and availability of data in the affected database account, since the attacker can read or modify data as a different authorized identity. Any organization using Azure Cosmos DB is potentially affected; because it is a fully managed Azure service there are no customer-managed installations, and no affected version ranges are specified in the advisory data. The flaw was addressed in Microsoft's September 2026 Patch Tuesday cycle (966 flaws fixed, including 2 zero-days); no public proof-of-concept is known, it is not in CISA's KEV, and EPSS estimates only a ~0.4% chance of exploitation within 30 days.

Do: Review Microsoft's September 2026 security update guidance for CVE-2026-69857 and complete any required updates or customer-side actions for Azure Cosmos DB, confirming whether key rotation, RBAC/permission changes, or SDK updates are needed on your accounts. Because exploitation requires an authorized (authenticated) principal, audit who and what has access to Cosmos DB accounts, enforce least privilege on account keys and RBAC roles, and rotate account keys if exposure is suspected. No public PoC or in-the-wild exploitation is known and EPSS is low (~0.4% over 30 days), so treat this as high-priority routine patching within the normal Patch Tuesday cycle rather than an emergency.

CVE-2026-72978 is an unauthenticated denial-of-service flaw in Microsoft Active Directory Federation Services (AD FS) caused by allocation of resources without limits or throttling (CWE-770). An attacker triggers it by sending network requests that cause the AD FS service to allocate resources without bound, exhausting capacity; the high attack-complexity score (AC:H) indicates the exhaustion condition is not reliably achieved on every attempt. A successful attack yields availability impact only (A:H) — the federation service can be knocked offline, interrupting sign-in/SSO for users who depend on it, with no confidentiality or integrity impact. Organizations running AD FS — typically enterprises using federated authentication with Microsoft 365/Entra ID on Windows Server — are affected. There is currently no evidence of exploitation (not in CISA KEV, no public PoC), EPSS puts the 30-day exploitation probability at 0.8%, and the fix shipped in Microsoft's September 2026 Patch Tuesday, which resolved 966 flaws including 2 zero-days.

Do: Apply the September 2026 Microsoft security updates to all AD FS federation servers, including primary and secondary farm members and any internet-facing Web Application Proxy (WAP) endpoints if deployed. Prioritize patching AD FS endpoints exposed to untrusted networks, since the flaw is triggerable by an unauthenticated network attacker. As an interim mitigation, enforce rate limiting or throttling of unauthenticated requests to AD FS sign-in endpoints at the load balancer or firewall.

CVE-2026-73014 is a missing authorization flaw (CWE-862) in the Data Sharing Service Client, a Microsoft component assigned by the Microsoft CNA. A local attacker who already holds a low-privileged authorized account on the machine can invoke the service without a required authorization check and elevate privileges. Successful exploitation yields high impact to confidentiality, integrity, and availability (CVSS 7.8), which typically means gaining elevated rights on the local system. Any system running the affected component is exposed, though the attack requires local access and is not remotely exploitable. There is no known public proof-of-concept, it is not in CISA KEV, and EPSS puts 30-day exploitation probability at just 0.3%; the fix shipped in Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws.

Do: Apply the September 2026 Microsoft Patch Tuesday updates as soon as possible to remediate the missing authorization check. There is no public PoC or confirmed in-the-wild exploitation, but prioritize patching multi-user machines, terminals, and servers where untrusted users hold local accounts, since local elevation flaws are commonly chained with other vulnerabilities.

CVE-2026-77909 is a credential-protection flaw (CWE-522) in Microsoft Azure CycleCloud, Microsoft's tool for creating and managing HPC clusters in Azure, in which credentials are stored or transmitted with insufficient protection. A remote attacker who already holds a low-privileged authorized account can trigger the flaw over the network, with no user interaction required. Because the CVSS scope is changed with high confidentiality impact, the exposed credentials can likely be used in another security scope — for example, to retrieve or reuse secrets that grant access to additional resources beyond the immediate component — resulting in information disclosure, though integrity and availability are unaffected. Organizations running Azure CycleCloud to orchestrate HPC workloads in their Azure subscriptions are affected. There is no known public proof-of-concept, it is not in the CISA KEV catalog, EPSS is a modest 0.6% over 30 days, and no in-the-wild exploitation has been reported; a fix was distributed as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws.

Do: Apply the Azure CycleCloud update from Microsoft's September 2026 Patch Tuesday to all CycleCloud application deployments in your Azure subscriptions, including standalone and cluster-attached instances. Since CycleCloud is customer-deployed, verify your installed build via the CycleCloud portal or CLI and update from the Azure Marketplace if outdated. As a precaution, audit and rotate credentials/API keys configured in CycleCloud, restrict network access to the application to trusted users, and review access logs for unusual credential retrieval by low-privileged accounts.

Microsoft Copilot Studio, the low-code cloud service in the Power Platform used to build AI copilots and agents, fails to properly verify cryptographic signatures on certain network traffic (CWE-347), allowing signature checks to be bypassed. An unauthenticated attacker can trigger the flaw remotely over a network with no user interaction by sending a crafted request whose signature is accepted without correct verification. Successful exploitation elevates the attacker's privileges, and the changed-scope CVSS metric plus high confidentiality, integrity, and availability ratings indicate impact that extends beyond the immediate component. Because Copilot Studio is a multi-tenant Microsoft-hosted service, every organization using the service falls within the blast radius, and there are no on-premises versions to inventory. As of the September 2026 Patch Tuesday disclosure, no in-the-wild exploitation is known, there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a modest 0.3% probability of exploitation within 30 days.

Do: Because Copilot Studio is a Microsoft-managed SaaS offering, there is no customer-side patch to install; verify via the Microsoft 365 admin center (message center and service health) that the September 2026 service update has been applied to your tenant. In the meantime, review tenant audit logs for anomalous privilege changes or unexpected agent activity, and scrutinize the permissions and authentication settings of any agents exposed to unauthenticated users. Follow Microsoft's advisory for the CVE in case compensating controls or configuration guidance are provided.

CVE-2026-81349 is an operating-system command injection flaw (CWE-78) in Microsoft's Azure HDInsights managed big-data service. It is triggered when the service improperly neutralizes special elements passed into an OS command, and per the CVSS vector an attacker must already hold high-level authorized access, exploiting it over the network with no user interaction required. Successful exploitation allows the attacker to elevate privileges, with high impact on the confidentiality, integrity, and availability of the affected HDInsight environment. Only organizations running Azure HDInsight clusters are affected; the flaw was fixed as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws. No public proof-of-concept is known, it is not listed in CISA's KEV catalog, and EPSS estimates roughly a 0.7% chance of exploitation within 30 days.

Do: Review Microsoft's September 2026 Patch Tuesday advisory for CVE-2026-81349 and apply any required service updates or customer actions to HDInsight clusters as directed. Because exploitation requires an already highly privileged authorized attacker, audit and restrict highly privileged roles, service principals, and identities with access to HDInsight resources. Monitor Azure Service Health and the MSRC advisory page for service-side remediation details.

CVE-2026-81380 is a command injection vulnerability (CWE-77) in GitHub Copilot and Visual Studio Code in which special elements used in commands are improperly neutralized. An unauthorized attacker can trigger it remotely over a network, but exploitation requires high attack complexity and user interaction, meaning a user must be led into letting crafted input reach a command executed by Copilot or VS Code. Successful exploitation yields information disclosure only, with high confidentiality impact and no integrity or availability impact. Anyone running affected, unpatched versions of Visual Studio Code with the GitHub Copilot integration is potentially affected, though the available data does not specify exact version ranges. There is no known public proof-of-concept, no CISA KEV listing, and a low EPSS exploitation probability (0.6% over 30 days); per related coverage, Microsoft shipped fixes among its September 2026 Patch Tuesday updates.

Do: Update Visual Studio Code and the GitHub Copilot extension to the latest patched releases distributed through Microsoft's September 2026 security updates (fixed version numbers are not listed in this data, so verify via the VS Code Extensions panel and Microsoft's advisory). Until patched, exercise caution when letting Copilot process untrusted content such as unfamiliar repositories, files, or chat input, since user interaction is part of the attack path.

CVE-2026-81381 is a credential-protection flaw (CWE-522) in GitHub Copilot and Visual Studio Code, addressed by Microsoft's September 2026 Patch Tuesday release. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates that an unauthorized, unauthenticated attacker can trigger the issue over a network, but only with some user interaction. A successful attack has a high confidentiality impact, allowing disclosure of insufficiently protected credentials or other sensitive information, with no integrity or availability impact. Anyone running Visual Studio Code with the GitHub Copilot extension is in scope, which spans the very broad VS Code developer base. There is no public proof-of-concept, the CVE is not in CISA's KEV catalog, and EPSS estimates about a 0.6% chance of exploitation in the next 30 days, so exploitation is not confirmed.

Do: Install the Visual Studio Code and GitHub Copilot fixes released with Microsoft's September 2026 Patch Tuesday, checking the Microsoft advisory for the exact fixed builds. Until patched, avoid using Copilot or stored GitHub credentials in VS Code over untrusted networks and warn users about unexpected interactive prompts. After updating, consider rotating or revoking GitHub personal access tokens and OAuth tokens if credential exposure is suspected.

CVE-2026-83941 is a missing-authorization flaw (CWE-862) in Microsoft Entra ID, the cloud identity service behind Microsoft 365 and Azure. An already-authenticated, low-privileged user can send a network request to an Entra ID endpoint that fails to enforce proper authorization checks, requiring no user interaction. Exploitation lets the attacker elevate their privileges within the directory, with high confidentiality and integrity impact (CVSS 9.9, scope changed). Any organization that uses Microsoft Entra ID is in the affected population. The flaw was patched in Microsoft's September 2026 Patch Tuesday release; it is not in CISA KEV, has no known public proof-of-concept, and carries a low EPSS of roughly 0.7%.

Do: Review Microsoft's September 2026 Patch Tuesday advisory for this CVE and apply any required tenant-side updates or configuration changes, noting that fixes for the cloud-hosted directory service are applied largely by Microsoft. Audit privileged role assignments and sign-in activity in your tenant for signs of unexpected elevation, and tighten who holds elevated roles. Monitor for additions to CISA KEV or public proof-of-concept code, which would raise urgency.