Outside desktop applications, nothing this month is known to be exploited and nothing was publicly disclosed before the fix. That gives infrastructure teams a rare chance to patch servers in a planned order instead of a scramble. That window will not stay open long. Four flaws carry a CVSS score of 9.8, and three of them need no credentials and no user action. The Windows LDAP Remote Code Execution Vulnerability (CVE-2026-119958) lets an unauthenticated attacker run code inside the LDAP service, which puts domain controllers and the whole Active Directory environment at risk. The Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2026-116928) can be triggered by anyone able to send email to the organization. The Windows Xbox Live Networking Service Remote Code Execution Vulnerability (CVE-2026-112967) gives an attacker on the same network full control of a Windows system. The fourth, the Azure OpenAI Elevation of Privilege Vulnerability (CVE-2026-119990), sits in a cloud service many teams now depend on.
Behind those headliners are three clusters. Five Message Queuing flaws (CVE-2026-119963, CVE-2026-119964, CVE-2026-116710, CVE-2026-119967, CVE-2026-109459) each allow remote code execution without credentials on any server running the service. Eight Hyper-V elevation of privilege flaws, led by the Windows Hyper-V Elevation of Privilege Vulnerability (CVE-2026-113865), give an attacker inside a guest virtual machine a path to the host and every workload on it. A third group targets the local network itself: the Windows Function Discovery Resource Publication Remote Code Execution Vulnerability (CVE-2026-125134) and two related flaws let anyone on the same segment, including a guest on the office wireless network, take over a Windows device without logging in.
The pattern says a lot about where exposure lives. Identity is in the line of fire again: besides LDAP, the Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVE-2026-118146) and the Active Directory Domain Services Elevation of Privilege Vulnerability (CVE-2026-118148) both turn a low privilege account into control of a domain controller. The virtualization boundary is under similar pressure, and the Windows Graphics Kernel Elevation of Privilege Vulnerability (CVE-2026-125137) adds another route out of a guest. Core network plumbing rounds it out, with unauthenticated code execution in TCP/IP, NAT, Schannel, CredSSP, the RPC runtime, and the Print Spooler. These are services that rarely get a second look because they simply run.
Patch order should follow reach, not product names. Domain controllers and Exchange servers go first, followed by anything that exposes IIS, Schannel or RPC to untrusted networks. Message Queuing deserves an inventory before it gets a patch: find every server where the service is enabled, turn it off where no application needs it, and patch the rest the same day. Hypervisor hosts need their own maintenance window, because one escaped guest becomes a problem for every tenant on that host. Laptops that travel should not wait, since the local network flaws work on any shared wireless network. Cloud owners should confirm the status of Azure Managed Grafana, since Microsoft has published no CVSS score for that flaw. Until patching is complete, watch domain controllers for unusual LDAP traffic and alert on unexpected process launches from Exchange and MSMQ hosts.
If leadership can fund only a few actions this week, start with the Windows LDAP Remote Code Execution Vulnerability (CVE-2026-119958) and the Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2026-116928), because both are reachable without credentials and sit on the systems attackers want most. Next comes the Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVE-2026-118146), which turns any stolen user account into a path to the domain. Then close the Message Queuing exposure, starting with the Windows Message Queuing Queue Manager Remote Code Execution Vulnerability (CVE-2026-119967) on servers that accept anonymous HTTP. Finish with the Hyper-V host fixes before the next change freeze.
