Patch Tuesday released this week and of all the issues the company fixed, only one of the vulnerabilities disclosed this month ended up exploited in the wild, according to a report from Cisco Talos.
That one issue is CVE-2026-96951, a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a command (command injection), Talos said. The vulnerability has a CVSS base score of 8.8.
Just to break down the 85 critical issues, 67 ended up labeled remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely:
CVE-2026-70229, which is a remote code execution vulnerability that affects Windows Active Directory Domain Services. The shared weakness is incorrect authorization. The vulnerability has a CVSS base score of 8.1.
Additionally, CVE-2026-70571 is a remote code execution vulnerability that affects Microsoft Exchange Server. The shared weakness is stack-based buffer overflow. The vulnerability has a CVSS base score of 8.1.
<h6><strong>Exploitation Less Likely</strong></h6>
Microsoft considers exploitation of the following vulnerabilities less likely.
CVE-2026-105733, CVE-2026-102214, and CVE-2026-108399 affect Windows Hyper-V, according to Talos.
CVE-2026-105733 has an impact of remote code execution; involves Incorrect initialization of resource; has a CVSS base score of 8.8, according to Talos. CVE-2026-102214 has an impact of remote code execution; involves use after free; has a CVSS base score of 8.8. CVE-2026-108399 has an impact of elevation of privilege; involves heap-based buffer overflow; has a CVSS base score of 7.2.
CVE-2026-100202 is a remote code execution vulnerability that affects Windows Message Queuing Queue Manager. The shared weakness is use after free, according to Talos. The vulnerability has a CVSS base score of 9.8.
Click here for a complete list of all vulnerabilities Microsoft disclosed this month.
In response to these vulnerability disclosures, Talos released new Snort ruleset that detects attempts to exploit some of them.
Cisco Secure Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Ruleset customers can stay up to date by downloading the latest rule pack.
Snort 2 rule coverage: 1:67210 – 1:67273, 1:67276 – 1:67279, 1:67282 – 1:67311, 1:67313 – 1:67316, 1:67319 – 1:67322.
Snort 3 rule coverage: 1:301663 – 1:301694, 1:301696, 1:301702 – 1:301703, 1:301705 – 1:301706, 1:301709, 1:301711, 1:301717 – 1:301718.