Additionally, Microsoft two of the vulnerabilities disclosed this month underwent active exploitation, according to a report from Cisco Talos.
One of those vulnerabilities is CVE-2026-56155 an important-severity elevation of privilege vulnerability in Active Directory Federation Services (AD FS) caused by insufficient granularity of access control. An authorized attacker could use it to elevate privileges locally.
The other is CVE-2026-56164 a moderate-severity vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. An unauthorized attacker could exploit it to perform spoofing over a network.
The 57 “critical” entries break down by vulnerability type as follows: 48 remote code execution (RCE), seven elevation of privilege (EoP), 1 spoofing and 1 security feature bypass vulnerability, Talos said.
Affected Products
The 48 critical RCE vulnerabilities affect a range of Microsoft Windows services and applications, including Windows Media and Media Foundation, the Windows DHCP client and DHCP Server service, Microsoft Office, Word, Excel and PowerPoint, Windows GDI and GDI+, the DirectX Graphics Kernel, Microsoft SharePoint, Microsoft SQL Server, the Windows Reliable Multicast Transport Driver (RMCAST), Windows TCP/IP, the Windows Server Network driver, the Windows Print Spooler, the Windows Secure Socket Tunneling Protocol (SSTP), Windows Active Directory Domain Services, Microsoft Defender, Microsoft Copilot, Microsoft Message Queuing (MSMQ), the Remote Desktop Client, Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (on-premises), and the Minecraft Bedrock Dedicated Server.
Eleven of the critical RCE vulnerabilities ended up rated “more likely” to undergo exploitation, according to Talos. Heap-based buffer overflows, CVE-2026-50370 and CVE-2026-50518, are in the Windows DHCP Server service, exploitable by an unauthorized attacker over an adjacent network and over a network, respectively.
Additionally, CVE-2026-54128 is a use-after-free in the Windows DHCP client that allows an unauthorized attacker to execute code locally. Furthermore, heap-based buffer overflows, CVE-2026-50327 and CVE-2026-50655, are in Windows Media and Windows Media Foundation.
Meanwhile, CVE-2026-54992 is the case number for a heap-based buffer overflow in the Microsoft Message Queuing Queue Manager. CVE-2026-56188 is a race condition in the Windows Server Network driver. A heap-based buffer overflow, CVE-2026-55010, is in the Minecraft Bedrock Dedicated Server where an unauthorized attacker could exploit over a network.
Deserialization Vulnerabilities
Moreover, CVE-2026-50522 and CVE-2026-58644 are deserialization vulnerabilities in Microsoft SharePoint that allow an unauthorized attacker to execute code over a network. CVE-2026-55944 is a deserialization vulnerability in Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (on-premises) that allows an unauthorized attacker to execute code over a network.
Seven critical elevation of privilege vulnerabilities are CVE-2026-42982 and CVE-2026-50392 in Windows Secure Kernel Mode; CVE-2026-50444 in the Windows Server Update Service (WSUS); CVE-2026-50680 and CVE-2026-54127 in Windows Hyper-V; CVE-2026-54121 in Active Directory Certificate Services; and CVE-2026-57092 in Microsoft Windows VMSwitch.
The single critical spoofing vulnerability is CVE-2026-55008 in Microsoft Exchange Server, caused by a cross-site scripting condition. On top of that, the single critical security feature bypass is CVE-2026-55040 in Microsoft SharePoint Server, caused by weak authentication. Both ended up rated “more likely” to undergo exploitation, according to Talos.
A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.
In response to these vulnerability disclosures, Talos release a new Snort ruleset that detects attempts to exploit some of them.
Snort 2 rules included in this release that protect against the exploitation of many of these vulnerabilities are: 1:66733 – 1:66743, 1:66745 – 1:66785, 1:66791 – 1:66793, 1:66800 – 1:66807.
The following Snort 3 rules are also available: 1:301555 – 1:301579, 1:301581 – 1:301583.