CVE-2026-70571

🚨 Microsoft, Ekim 2026 Patch Tuesday kapsamında devasa sayıda, toplam 1.415 açık için güvenlik güncellemesi yayınladı. Açıkların 85'i kritik, 67'si ise RCE (uzaktan kod çalıştırma) kategorisinde. Öne çıkanlar: 🔴 CVE-2026-100202 — Windows Message Queuing, CVSS 9.8 🔴 CVE-2026-70229 — Active Directory Domain Services, RCE 🔴 CVE-2026-70571 — Exchange Server, RCE ⚠️ CVE-2026-96951 — Windows Shell, güvenlik mekanizmasını atlatma (CVSS 8.8) Microsoft, bu ayki açıklardan birinin aktif olarak istismar edildiğini de doğruladı. Sistemlerinizi güncellemeyi ihmal etmeyin. releaseNote: https://msrc.microsoft.com/update-guide/releaseNote/2026-Oct

#NØØT_Security_Alerts 🚨 #ALERT — MICROSOFT EXCHANGE SERVER: CRITICAL UNAUTHENTICATED REMOTE CODE EXECUTION VIA MALICIOUS EMAIL October 13, 2026 DISCLOSED BY: Microsoft Security Response Center PRODUCT: Microsoft Exchange Server CVE: CVE-2026-70571 SEVERITY: CRITICAL — Microsoft rating CVSS 3.1: 8.1 WEAKNESS: CWE-121 — Stack-Based Buffer Overflow AFFECTED VERSIONS: Exchange Server 2016 CU23. Exchange Server 2019 CU14 and CU15. Exchange Server Subscription Edition RTM. IMPACT: A remote attacker could execute arbitrary code on a vulnerable Exchange server by sending a specially crafted email that triggers its internal content-conversion functionality. EXPOSURE: Network attack vector. No authentication required. No user interaction required. Attack complexity is HIGH. Successful exploitation requires specific conditions; receiving a malicious email does not establish compromise. EXPLOITATION STATUS: VENDOR-CONFIRMED CRITICAL RCE. Microsoft assesses future exploitation as MORE LIKELY. No confirmed in-the-wild exploitation or verified public working PoC identified. Forensic triage: Review Exchange transport and content-conversion errors, abnormal processing crashes, suspicious messages and unexpected processes originating from Exchange services. Preserve relevant message metadata and server telemetry. No verified CVE-specific attacker IOCs have been published. URGENT ACTION: Apply Microsoft’s October 13 Exchange security update for the installed release: Subscription Edition RTM: KB5128895. Exchange 2019 CU15: KB5128896. Exchange 2019 CU14: KB5128897. Exchange 2016 CU23: KB5128898. Run Microsoft’s Exchange Server Health Checker after installation. Verify security-update eligibility for legacy Exchange releases. SOURCE: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571 MICROSOFT PATCH: https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5128895 OFFICIAL CVE RECORD: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70571.json CONFIDENCE: HIGH — Microsoft-authored CVE record and security-update documentation establish the vulnerability, affected releases and remediation. Active exploitation remains unverified. #CyberSecurity #ThreatIntel #MicrosoftExchange #RCE #EmailSecurity #EnterpriseSecurity