Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days

CVE-2023-21674 is a use-after-free flaw (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) facility, the kernel-level mechanism Windows uses for fast communication between processes and system services. An attacker who can already run code on a Windows machine can trigger the bug by sending crafted ALPC requests, corrupting memory in a privileged process. Successful exploitation allows a local, low-privileged attacker to elevate to SYSTEM/administrator privileges, typically to gain full control of the host or to complete an exploit chain after an initial compromise. Essentially all supported Windows client and server installations from Microsoft are affected; the source data does not list specific versions, and the fix shipped with Microsoft's January 2023 Patch Tuesday, which addressed a record 974 vulnerabilities including this and one other actively exploited Windows zero-day. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2023-01-10, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is undetermined, and EPSS estimates a 41.8% probability of exploitation in the next 30 days (99th percentile).

Do: Apply Microsoft's January 2023 (released 2023-01-10) or later Windows cumulative security updates to all Windows clients and servers, per CISA's required action to 'apply updates per vendor instructions.' Because this is a local privilege escalation, prioritize hosts where low-privileged users or untrusted code execute, such as endpoints, RDS/VDI servers, and multi-user systems, and verify installation via your update-management inventory. Treat this as actively exploited; with no public PoC or documented workaround, timely patching is the primary mitigation.

CVE-2026-55007 is a double-free memory corruption flaw (CWE-415) in Microsoft Exchange Server in which the same heap allocation is freed twice, corrupting memory. A remote, unauthenticated attacker can trigger the flaw over the network, though the high attack complexity (AC:H) means reliable exploitation likely depends on favorable heap/timing conditions, making it harder to weaponize than typical pre-auth RCEs. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.1). Any organization running on-premises Microsoft Exchange Server is in scope, with the greatest risk on servers reachable from untrusted networks. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% chance of exploitation within 30 days; it was disclosed amid Microsoft's record September 2026 Patch Tuesday (974 CVEs), which press coverage highlighted for notable Exchange flaws.

Do: Apply Microsoft's September 2026 Exchange Server security updates as soon as possible, prioritizing internet-facing servers (OWA/ECP and SMTP endpoints); since affected version ranges are not included in this data, confirm affected versions and fixed builds in Microsoft's advisory for CVE-2026-55007. Until patched, restrict untrusted network access to Exchange endpoints, and monitor the MSRC advisory and KEV for exploitation updates given the high-severity, pre-authentication nature of the flaw.

Microsoft SQL Server contains an injection vulnerability (CWE-74) in which special elements in output used by a downstream component are not properly neutralized. An unauthorized attacker can trigger the flaw remotely over a network, though the CVSS vector indicates that some form of user interaction is required in the attack path. Successful exploitation allows elevation of privileges with high impact on confidentiality, integrity, and availability, and the changed-scope metric suggests the attack crosses a security boundary into another component. Any organization running affected Microsoft SQL Server versions is potentially exposed, although the data provided does not specify exact affected version ranges. No public proof of concept, CISA KEV listing, or known exploitation exists; EPSS estimates only a 0.7% probability of exploitation in the next 30 days, and the fix shipped with Microsoft's record-setting September 2026 Patch Tuesday release (974 flaws patched).

Do: Apply the SQL Server security updates from Microsoft's September 2026 Patch Tuesday as soon as practical, prioritizing internet-exposed instances and servers that accept untrusted input whose output feeds downstream components. With no public PoC or KEV listing, near-term risk appears low, but re-prioritize if technical details or exploit code emerge. Verify deployed SQL Server builds against Microsoft's advisory for CVE-2026-65669 to confirm remediation.

CVE-2026-69465 is a missing authorization flaw (CWE-862) in Microsoft Office SharePoint, specifically SharePoint Server. An attacker who already holds valid, low-privileged credentials can send a crafted network request to the server, and because the application fails to properly verify permissions, the request results in arbitrary code execution. Successful exploitation gives the attacker code execution on the server with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8 High), with no user interaction required. Organizations running on-premises SharePoint Server are affected; the specific version ranges are not stated in the available data. There is currently no known in-the-wild exploitation, no public proof-of-concept, and the flaw is not listed in CISA KEV, with EPSS estimating a 0.8% chance of exploitation within 30 days.

Do: Apply the SharePoint Server security update that addresses this CVE as published in Microsoft's Patch Tuesday release (consult the Microsoft Security Update Guide for the exact KB and affected versions). Until patched, reduce exposure by limiting which accounts can reach SharePoint externally (VPN/extranet access) and monitoring authenticated requests for anomalous activity. Since exploitation requires an authorized account, review whether low-privileged or external users have access to internet-facing SharePoint servers.

CVE-2026-69525 is a use-after-free memory corruption flaw (CWE-416) in Windows Remote Desktop Services, rated critical at CVSS 9.8. Per the CVSS vector, a remote, unauthenticated attacker can reach the vulnerable code path over the network with no privileges and no user interaction, presumably by sending crafted input to the RDP/RDS service. Successful exploitation yields remote code execution with high impact on confidentiality, integrity, and availability. Any Windows system running Remote Desktop Services is affected, and organizations exposing RDP (TCP 3389) to the internet are the primary concern, since public scans show millions of such endpoints. There is no public proof-of-concept or CISA KEV listing yet, and EPSS estimates a ~1.1% (63rd percentile) chance of exploitation within 30 days; the fix shipped as part of Microsoft's record 974-CVE Patch Tuesday, which separately included two exploited Windows zero-days and 20 wormable bugs.

Do: Apply Microsoft's security update for CVE-2026-69525 as soon as possible, prioritizing hosts with RDP (TCP 3389) reachable from untrusted networks. Until patched, restrict RDP exposure via firewall rules, VPN, or RD Gateway, and enable Network Level Authentication as a precaution. Inventory internet-facing systems for exposed RDP listeners and monitor for exploitation activity.

CVE-2026-80097 is an improper authentication flaw (CWE-287) in Microsoft Authenticator that allows an unauthorized attacker to elevate privileges locally, rated 8.6 (high) with no privileges required, required user interaction, and a changed scope. Exploitation requires local access to a device running the app plus user interaction, and because the scope is changed, a successful attack crosses a security boundary beyond the Authenticator component itself. A successful exploit yields local privilege elevation with high impact to confidentiality, integrity, and availability. Anyone running affected versions of Microsoft Authenticator is affected; the app is Microsoft's standard multi-factor authentication app for Entra ID/Microsoft 365 and is widely deployed across enterprise and personal mobile devices. As of the September 2026 disclosure it is not known to be exploited - no public PoC, not in CISA KEV, EPSS 0.4% (33rd percentile) - and it was patched amid the record 974-flaw Patch Tuesday, though the two actively exploited zero-days in that release are Windows flaws, not this one.

Do: Update Microsoft Authenticator through its usual app-store distribution channels (iOS App Store/Google Play) to the build released with September 2026 Patch Tuesday, and verify updated versions across the fleet via MDM or app inventory; specific patched build numbers were not provided in the source data. Prioritize shared workstations, kiosks, and hot-desked or BYOD endpoints where unprivileged local users interact with the app. No public PoC or in-the-wild exploitation is known, so routine prompt patching is appropriate.

CVE-2026-81963 is a link-following flaw (CWE-59, improper link resolution before file access) in the Microsoft Windows Update Stack, in which the component fails to correctly resolve file links before opening them. A local attacker with low privileges can plant or manipulate a link (symlink/junction) that the privileged update stack follows during operation, redirecting its file access to an attacker-controlled target. The result is local privilege escalation — CVSS 3.1 rates this 7.8 (high) with high confidentiality, integrity, and availability impact — allowing an authorized local user or malware already on the machine to gain elevated rights. Affected products are Windows 11 23H2, 24H2, 25H2, and 26H1 and Windows Server 2025; any unpatched system on those versions is exposed to any local account holder. The flaw was fixed in Microsoft's record September 2026 Patch Tuesday (974 CVEs), was added to CISA's KEV on 2026-09-08 as one of two Windows zero-days reported as exploited in the wild, and has no known public PoC or confirmed ransomware use.

Do: Immediately deploy the September 2026 Patch Tuesday cumulative updates to every Windows 11 23H2/24H2/25H2/26H1 and Windows Server 2025 host; as a KEV entry under BOD 26-04, prioritize internet-exposed and high-value assets, apply vendor mitigations (or discontinue use) where patching is delayed, and follow CISA's forensics triage requirements if compromise is suspected. Verify deployment via patch telemetry and review which local accounts can trigger update-stack activity on shared or multi-user systems.