60
60
30
Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1
Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.
Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.
65
30
60
60
55
60
60
60
47
60
35
60
60
URGENT — 4 Actively Exploited 0
60
Microsoft Expands Coverage for Exchange Server Bugs
60
Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)
60
60
60
35
Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)
About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.
CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.
72
60
Fat Patch Tuesday, February 2024 Edition
60
60
60
60
60
42
60
30
60
Patch Tuesday, October 2025 ‘End of 10’ Edition
60
Critical Exchange Server Flaw (CVE-2024
60
55
57
60
30
Microsoft patches three zero-days actively exploited by attackers
60