Microsoft Patch Tuesday: 972 CVEs, 2 Exploited Zero-Days, 113 Critical Vulnerabilities

What Happened

Microsoft issued updates for 972 vulnerabilities, covering Windows, Office, and related components. Two zero-days—CVE-2026-12345 and CVE-2026-12346—were reported as actively exploited in the wild. Additionally, 113 vulnerabilities were rated critical, affecting authentication, privilege escalation, and remote code execution.

Impact

Systems running affected Windows versions (Windows 10/11, Server 2019/2022) and Office 365 deployments are at risk. Attackers could gain local or remote code execution, bypass authentication, or exfiltrate data. The zero-days were leveraged in targeted campaigns against enterprise networks.

Mitigation Steps

• Apply the latest cumulative updates immediately; verify installation with the provided checksums.
• Use Windows Update or WSUS to automate patch deployment; ensure all client and server machines are covered.
• Validate that the critical CVEs are patched by running the Microsoft Security Update Guide checker or PowerShell scripts.
• Enable and monitor the Windows Defender Exploit Guard and other endpoint protection to detect exploitation attempts.
• Review logs for unusual authentication failures or privilege escalation indicators; correlate with known exploitation signatures.
• For environments with legacy software, consider temporary workarounds documented in the Microsoft advisory, but plan for a full upgrade.

Post‑Patch Monitoring

After patching, maintain a continuous monitoring posture. Use threat intelligence feeds to stay aware of new indicators of compromise linked to the patched CVEs. Conduct periodic vulnerability scans to confirm remediation and adjust detection rules accordingly.