NCSC-NL Details Critical Microsoft Windows Patches
NCSC-NL advisory lists 13 critical Windows vulnerabilities (CVSS ≥9.0) across iSCSI, DNS, LDAP, Kerberos, Exchange and more enabling RCE or privilege escalation.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 13 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory consolidating Microsoft's latest Patch Tuesday fixes for Windows, highlighting 13 of the most severe vulnerabilities with CVSS scores of 9.0 or higher. These flaws span a wide range of Windows components including iSCSI, Virtual Filtering Platform (VFP), DNS, Xbox Live Networking Service, Windows Media Foundation, DHCP Server, LDAP, Color Management, Microsoft Exchange Server, Kerberos, and DirectMusic. Exploitation of most of these flaws could lead to arbitrary code execution, while the Kerberos vulnerability (CVE-2026-85844) could allow an attacker to elevate privileges.
The advisory covers a broad set of weakness classes including buffer overflows (stack and heap), use-after-free, out-of-bounds read/write, integer overflow/underflow, authentication bypass, improper certificate validation, and race conditions (TOCTOU), among many others — indicating a large monthly patch batch rather than a single vulnerability class. NCSC-NL does not provide technical details for each CVE individually, deferring to the Microsoft Security Response Center (MSRC) portal for specifics, update availability, and any workarounds. No indication of active exploitation in the wild is mentioned in this advisory.
Defenders should prioritize patching for the listed critical CVEs, particularly those affecting internet-facing or widely used services such as DNS, DHCP Server, LDAP, Exchange Server, and Kerberos, given their potential for remote code execution or privilege escalation. Standard patch management processes should be applied promptly across affected Windows environments, with particular attention to Exchange Server and Kerberos given their centrality to enterprise authentication and messaging infrastructure.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0472.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs