Windows Deployment Archives

Winsage

September 9, 2026

Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities

Microsoft's September 2026 security update revealed 973 vulnerabilities, with 113 classified as critical. Two actively exploited vulnerabilities are CVE-2026-81963 (Windows Update Stack, elevation of privilege, CVSS 7.8) and CVE-2026-85880 (Windows ALPC, elevation of privilege, CVSS 7.8). Among the 113 critical vulnerabilities, 82 are remote code execution (RCE) vulnerabilities. Notable vulnerabilities include: - CVE-2026-69676: RCE in Windows Kerberos, CVSS 8.8, authentication bypass. - CVE-2026-69852: RCE in Windows RRAS, CVSS 7.5, heap-based buffer overflow. - CVE-2026-72957: RCE in Windows Deployment Services, CVSS 7.8. - CVE-2026-69854: Elevation of privilege in Spring Cloud Azure, CVSS 9.0, improper authentication. - CVE-2026-83501: Information disclosure in Windows VBS, CVSS 5.5. - CVE-2026-69730: RCE in Windows DNS Server, CVSS 9.8. Less likely to be exploited vulnerabilities include: - CVE-2026-69845: RCE in Windows DHCP Server, CVSS 9.8, heap-based buffer overflow. - CVE-2026-65772: Vulnerability in Microsoft Dynamics 365 On-Premises, CVSS 8.8, deserialization of untrusted data. - CVE-2026-66302: RCE in Skype for Business, CVSS 9.8. Additional critical vulnerabilities include: - CVE-2026-62916: Elevation of privilege in Microsoft Entra ID, CVSS 9.1. - CVE-2026-83941: Elevation of privilege in Entra ID, CVSS 9.9. - CVE-2026-80098: Vulnerability in Copilot Studio, CVSS 9.3, improper verification of cryptographic signatures. Talos is releasing a new Snort ruleset to detect attempts to exploit these vulnerabilities, with specific SIDs for Snort 2 and Snort 3 rule coverage.

Winsage

August 20, 2026

Microsoft shares detailed guide for IT admins on saving massive internet data on Windows 11

Microsoft has released a guide for IT administrators focused on optimizing Windows deployments and reducing bandwidth usage through Windows Delivery Optimization configured via Microsoft Intune. Delivery Optimization uses a peer-to-peer sharing system, allowing devices to download content from each other instead of solely from Microsoft servers, which helps reduce internet strain for organizations with many Windows PCs. Administrators can create specific peer groups based on network topology and control bandwidth usage for downloads, with options to set different limits for business and off-hours. Microsoft also introduced Connected Cache, which stores frequently accessed content locally to further minimize bandwidth consumption. A statistic shared by Microsoft indicates that using Delivery Optimization can significantly reduce internet traffic, as a 1 GB update for 10,000 devices could otherwise generate 10 TB of internet traffic. The guide recommends starting with a small seeder ring of devices to populate peer caches before wider deployment. Microsoft provides specific policy settings for Delivery Optimization, including default and recommended values for settings such as download mode, peer selection, cache size, minimum file size for caching, cache age, and monthly upload data cap. Proper configuration of Delivery Optimization is suggested to benefit organizations managing large numbers of devices.