CVE-2026-69824 and 3 Critical Microsoft CVEs (CVSS up to 9.8): XPS, Graphics Component, and Exchange Detection and Remediation Guide

NVD has published four CRITICAL-severity CVEs affecting Microsoft products within a 72-hour window, and every one of them is exploitable over the network. Two carry a CVSS base score of 9.8 — the practical ceiling for severity — and both allow unauthenticated remote code execution:

CVE-2026-69824 (CVSS 9.8): Integer underflow (wrap or wraparound) in Microsoft Standard XPS, enabling unauthorized remote code execution.
CVE-2026-77493 (CVSS 9.8): Double free in Microsoft Graphics Component, enabling unauthorized remote code execution.
CVE-2026-69356 (CVSS 9.3): Improper input neutralization during web page generation (cross-site scripting) in Microsoft Exchange.
CVE-2026-69641 (CVSS 9.1): Missing authorization in Microsoft Exchange Server, allowing an authorized attacker to elevate privileges.

This is a worst-case patch cycle profile: memory corruption in document rendering and graphics parsing (classic initial-access vectors via malicious files and content), paired with Exchange Server flaws that target the single most-attacked on-premises asset in enterprise environments. If you run Exchange on-prem or allow XPS/graphics rendering of untrusted content anywhere in your fleet, treat this as an emergency change window.

Technical Analysis

CVE-2026-69824 — Integer Underflow in Microsoft Standard XPS (CVSS 9.8)

An integer underflow occurs when an arithmetic operation on an unsigned integer wraps below zero, producing a massive positive value. In a parsing context, that value is frequently used as a size or length parameter for a subsequent memory allocation or copy operation — and a wrapped length means an attacker-controlled buffer operation. The result, as Microsoft's advisory confirms, is remote code execution by an unauthorized attacker over the network.

Defender's perspective on the attack chain:

Attacker crafts a malicious XPS document with fields designed to trigger the underflow during parsing.
Delivery is network-based: email attachment, SharePoint/Teams upload, web download, or file share. The vulnerability triggers when the XPS content is processed — by the XPS Viewer, XPS services, or any application that renders XPS via the affected component.
Successful exploitation yields code execution in the context of the parsing process, which for a user-context render means a beachhead for hands-on-keyboard activity.

The XPS attack surface on Windows includes the XPS Viewer (xpsrchvw.exe), the Microsoft XPS Document Writer print driver, and the XPS services (XpsPrint / Print Spooler interactions). Any process that opens attacker-supplied XPS content is a potential execution sink.

CVE-2026-77493 — Double Free in Microsoft Graphics Component (CVSS 9.8)

A double free corrupts heap metadata by releasing the same allocation twice, which a skilled attacker can shape into arbitrary write primitives and ultimately code execution. The Microsoft Graphics Component is the rendering layer reached by a huge swath of the OS and Office suite — image parsing in Explorer preview panes, Office document rendering, browser content, and thumbnail generation all touch this code path.

Practically, this means exploitation may not even require a user to open a file: preview pane rendering and thumbnail indexing are enough in some graphics-component scenarios. Assume malicious image-bearing emails, chat messages, and downloads are viable delivery vectors.

CVE-2026-69356 — Cross-Site Scripting in Microsoft Exchange (CVSS 9.3)

Stored or reflected XSS in Exchange (the summary truncates the component, but Exchange/OWA is the affected surface) with a 9.3 score implies high impact — almost certainly script execution in the context of an authenticated OWA/Exchange admin session. This is a session-hijack and mailbox-access primitive, and XSS in Exchange has historically been chained with other bugs to reach full server compromise.

CVE-2026-69641 — Missing Authorization in Microsoft Exchange Server (CVSS 9.1)

Missing authorization (CWE-862) means an authenticated low-privilege user can invoke functionality that was never properly access-checked, elevating privileges within Exchange. In real-world Exchange intrusions, privilege-elevation flaws like this are the second stage: an attacker with a phished mailbox credential escalates to Exchange administrative functionality, then moves to server-level persistence (webshells, transport agents, new admin accounts).

Exploitation Status

At publication, these CVEs are newly published to NVD with no confirmed in-the-wild exploitation or CISA KEV listing that we can verify. That status changes fast for Microsoft network-vector 9.8s — historically, PoC code for Exchange and graphics-component flaws appears within days to weeks of disclosure. Do not use the absence of a KEV entry as a justification to delay. Monitor the CISA KEV catalog and the MSRC advisories daily until patching is complete.

Detection & Response

The detections below target observable post-exploitation behavior — because with memory-corruption bugs, the pre-exploit signature is unreliable and the post-exploit behavior (rendering processes spawning shells, Exchange worker processes dropping files) is where you get high-fidelity signal.

Sigma Rules

YAML

---
title: XPS Viewer or Print Spooler Spawning Suspicious Child Processes
id: 3f8a2c61-9d4b-4e7a-b1c2-5a6d7e8f9012
status: experimental
description: Detects XPS rendering or print components spawning command interpreters or scripting engines, consistent with post-exploitation after CVE-2026-69824 XPS integer underflow exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69824
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\xpsrchvw.exe'
      - '\spoolsv.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wmic.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate XPS viewing should not spawn interpreters
level: high
---
title: Office or Graphics Rendering Process Spawning Shell After Content Render
id: 8c1d4e52-7f3a-4b6c-9d2e-1a3b5c7d9e01
status: experimental
description: Detects common document/graphics rendering processes spawning command or script interpreters, consistent with exploitation of CVE-2026-77493 Microsoft Graphics Component double free via malicious content.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77493
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\explorer.exe'
      - '\dllhost.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  filter_explorer_noise:
    CommandLine|contains:
      - 'shell:AppsFolder'
  condition: selection_parent and selection_child and not filter_explorer_noise
falsepositives:
  - Legacy Office macros and add-ins (tune against baseline)
  - Explorer launching admin tools interactively
level: high
---
title: Exchange IIS Worker Process Dropping Executable or Script Content
id: 5b2e7f93-4a1c-4d8e-8c3b-2d4e6f8a0b12
status: experimental
description: Detects the Exchange IIS worker process writing executable or script files to Exchange web directories, consistent with webshell deployment following CVE-2026-69641 privilege elevation or post-XSS compromise via CVE-2026-69356.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69641
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69356
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith: '\w3wp.exe'
    TargetFilename|contains:
      - '\FrontEnd\HttpProxy\'
      - '\ClientAccess\'
      - '\inetpub\wwwroot\'
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.asmx'
      - '.asp'
      - '.dll'
      - '.exe'
      - '.ps1'
  condition: selection
falsepositives:
  - Exchange cumulative update installation writing legitimate files (correlate with change windows)
level: critical

KQL — Microsoft Sentinel / Defender

// Hunt: Exchange worker process spawning shells or writing web-accessible content
// Covers post-exploitation behavior for CVE-2026-69641 / CVE-2026-69356
let ExchangeProcs = dynamic(["w3wp.exe", "MSExchangeMailboxReplication.exe", "UMWorkerProcess.exe"]);
union
(DeviceProcessEvents
| where InitiatingProcessFileName in~ (ExchangeProcs)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","net.exe","net1.exe","whoami.exe","wmic.exe","rundll32.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName
),
(DeviceFileEvents
| where InitiatingProcessFileName =~ "w3wp.exe"
| where FolderPath has_any ("FrontEnd\\HttpProxy", "ClientAccess", "inetpub\\wwwroot")
| where FileName has_any (".aspx", ".ashx", ".asmx", ".asp", ".dll", ".ps1")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine, SHA256
)
| order by TimeGenerated desc;

// Hunt: XPS/graphics rendering processes spawning interpreters (CVE-2026-69824 / CVE-2026-77493)
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("xpsrchvw.exe","spoolsv.exe","winword.exe","excel.exe","powerpnt.exe","outlook.exe","dllhost.exe")
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe","regsvr32.exe","certutil.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc;

Velociraptor VQL

VQL — Velociraptor

-- Hunt for recently modified web-accessible files in Exchange directories (webshell triage)
-- Relevant to post-exploitation of CVE-2026-69641 and CVE-2026-69356
SELECT FullPath, Size, Mtime, Atime, Ctime,
       hash(path=FullPath) AS Hashes
FROM glob(globs=[
  'C:/Program Files/Microsoft/Exchange Server/*/FrontEnd/HttpProxy/**/*.aspx',
  'C:/Program Files/Microsoft/Exchange Server/*/FrontEnd/HttpProxy/**/*.ashx',
  'C:/Program Files/Microsoft/Exchange Server/*/ClientAccess/**/*.aspx',
  'C:/inetpub/wwwroot/**/*.aspx'
])
WHERE Mtime > now() - 14*24*3600
ORDER BY Mtime DESC