Multiple vulnerabilities affecting Microsoft products

Microsoft is a software publisher whose range of products (Windows Server, DNS Server, Exchange Server, etc.) is widely deployed in professional environments. As part of its September 2026 Patch Tuesday, Microsoft fixed 964 vulnerabilities, around a hundred of which are classified as critical. These products are affected by several vulnerabilities labeled as follows: CVE-2026-69730 (CVSS 9.8): Remote code execution via the DNS Server role, due to a use-after-free flaw exploitable without authentication by sending a specially crafted network packet; CVE-2026-69525 (CVSS 9.8): Remote code execution via Remote Desktop Services, due to a use-after-free vulnerability; CVE-2026-69676 (CVSS 8.8): Remote code execution via capture-replay authentication bypass in Windows Kerberos, exploitable by a malicious actor with low-privileged access; CVE-2026-69380 (CVSS 8.1): Privilege escalation due to a lack of authorization checks in Microsoft Exchange Server, allowing an authenticated user with a simple mailbox to access other users' boxes, send and receive emails on their behalf and view their attachments; CVE-2026-81963 (CVSS 7.8): Zero-day privilege escalation via a link following flaw in the Windows Update Stack, allowing SYSTEM privileges to be obtained, actively exploited in the wild Given the criticality of these vulnerabilities, it is strongly recommended to immediately apply the security updates published by Microsoft to all affected products.

• Microsoft products without the 09/09/2026 security update, including Windows Servers running DNS Server roles, RDP and Kerberos, and Exchange servers;