List Patch Tuesday KBs and CVEs with PowerShell and the MSRC API

# Patch Tuesday KB articles and CVEs from the MSRC API, in PowerShell only.
# Same two endpoints as https://github.com/EmmanuelTsouris/ms-patch-tuesday-fetcher.

$ReleaseNoteUri = 'https://api.msrc.microsoft.com/sug/v2.0/en-US/releaseNote'
$CvrfUri        = 'https://api.msrc.microsoft.com/cvrf/v3.0/cvrf'

function Get-PatchTuesdayRelease {
    param([int]$Days = 35)

    $notes  = Invoke-RestMethod -Uri $ReleaseNoteUri -Headers @{ Accept = 'application/json' } -TimeoutSec 30
    $cutoff = [datetimeoffset]::UtcNow.AddDays(-$Days)

    foreach ($note in $notes.value) {
        # PowerShell 7 may already have turned the string into a DateTime.
        $released = if ($note.releaseDate -is [datetime]) {
            [datetimeoffset]$note.releaseDate
        } else {
            [datetimeoffset]::Parse($note.releaseDate, [cultureinfo]::InvariantCulture)
        }
        if ($released -ge $cutoff) {
            [pscustomobject]@{
                Title       = $note.title
                Released    = $released
                CvrfId      = $note.releaseNumber
                Description = $note.description
            }
        }
    }
}

# The description is HTML. Return each table as its header cells and its rows.
function Get-HtmlTable {
    param([string]$Html)

    foreach ($table in [regex]::Matches($Html, '(?s)<table>.*?</table>')) {
        $rows = foreach ($tr in [regex]::Matches($table.Value, '(?s)<tr>(.*?)</tr>')) {
            , @([regex]::Matches($tr.Groups[1].Value, '(?s)<t[hd][^>]*>(.*?)</t[hd]>') |
                ForEach-Object { [System.Net.WebUtility]::HtmlDecode(($_.Groups[1].Value -replace '<[^>]+>', '').Trim()) })
        }
        [pscustomobject]@{ Header = $rows[0]; Rows = @($rows | Select-Object -Skip 1) }
    }
}

function Get-PatchTuesdayKb {
    param([Parameter(ValueFromPipeline)]$Release)
    process {
        foreach ($table in Get-HtmlTable $Release.Description) {
            foreach ($row in $table.Rows) {
                # A KB row's first cell is a bare number; the notable CVE table also has links.
                if ($row.Count -ge 2 -and $row[0] -match '^\d+$') {
                    [pscustomobject]@{ KB = "KB$($row[0])"; Product = $row[1] }
                }
            }
        }
    }
}

function Get-PatchTuesdayNotableCve {
    param([Parameter(ValueFromPipeline)]$Release)
    process {
        foreach ($table in Get-HtmlTable $Release.Description) {
            if ($table.Header[0] -ne 'CVE ID') { continue }
            foreach ($row in $table.Rows) {
                [pscustomobject]@{ CVE = $row[0]; Title = $row[1]; Notable = $row[2] }
            }
        }
    }
}

function Get-PatchTuesdayCve {
    param([Parameter(ValueFromPipeline)]$Release, [string]$Product)
    process {
        $doc   = Invoke-RestMethod -Uri "$CvrfUri/$($Release.CvrfId)" -Headers @{ Accept = 'application/json' } -TimeoutSec 120
        $names = @{}
        foreach ($p in $doc.ProductTree.FullProductName) { $names[$p.ProductID] = $p.Value }
        $rank  = @{ Critical = 4; Important = 3; Moderate = 2; Low = 1 }

        foreach ($vuln in $doc.Vulnerability) {
            $ids = @($vuln.ProductStatuses.ProductID | Select-Object -Unique)
            if ($Product) { $ids = @($ids | Where-Object { $names[$_] -like "*$Product*" }) }
            if ($Product -and -not $ids) { continue }
            $affected = @($ids | ForEach-Object { $names[$_] })

            # Threat Type 3 is severity and Type 1 the exploit status, as the Python tool reads them.
            # Severity and CVSS are given per product, so with -Product only the kept
            # products count; the exploit status names no product and covers them all.
            $ratings = @($vuln.Threats | Where-Object Type -eq 3)
            $scores  = @($vuln.CVSSScoreSets)
            if ($Product) {
                $ratings = @($ratings | Where-Object { $_.ProductID | Where-Object { $_ -in $ids } })
                $scores  = @($scores | Where-Object { $_.ProductID | Where-Object { $_ -in $ids } })
            }
            $severity = $ratings | ForEach-Object { $_.Description.Value } |
                Sort-Object { $rank[$_] } -Descending | Select-Object -First 1
            $status   = ($vuln.Threats | Where-Object Type -eq 1 | ForEach-Object { $_.Description.Value }) -join ';'
            # Keep only the KBs that fix one of the products still in the list.
            $kbs = @($vuln.Remediations |
                Where-Object { $_.Description.Value -match '^\d+$' -and ($_.ProductID | Where-Object { $_ -in $ids }) } |
                ForEach-Object { "KB$($_.Description.Value)" } | Sort-Object -Unique)

            [pscustomobject]@{
                CVE       = $vuln.CVE
                Title     = $vuln.Title.Value
                Severity  = $severity
                CVSS      = ($scores.BaseScore | Measure-Object -Maximum).Maximum
                Exploited = $status -match 'Exploited:Yes'
                KBs       = $kbs
                Products  = $affected
            }
        }
    }
}

$release | Get-PatchTuesdayCve -Product 'Windows Server 2025' |
    Where-Object { $_.Severity -eq 'Critical' -or $_.Exploited } |
    Sort-Object CVSS -Descending |
    Select-Object -First 5 CVE, Severity, CVSS, Exploited, KBs |
    Format-Table

{
  "CVE": "CVE-2026-96951",
  "Title": "Windows Shell Security Feature Bypass Vulnerability",
  "Severity": "Important",
  "CVSS": 8.8,
  "Exploited": true,
  "KBs": [
    "KB5126646"
  ],
  "Products": [
    "Windows Server 2025",
    "Windows Server 2025 (Server Core installation)"
  ]
}

$all |
    Select-Object CVE, Title, Severity, CVSS, Exploited,
        @{ Name = 'KBs'; Expression = { $_.KBs -join ';' } },
        @{ Name = 'Products'; Expression = { $_.Products -join ';' } } |
    Export-Csv -Path patch-tuesday.csv -NoTypeInformation

Get this month's Patch Tuesday information for me in PowerShell. Change
nothing on this system except creating one file, PatchTuesday.ps1, in the
current folder. Install no module and no other software.

1. Save the script below to PatchTuesday.ps1 exactly as given.
   Run steps 2 to 4 in one PowerShell process, for example as one
   pwsh -NoProfile -Command (or powershell -NoProfile -Command)
   invocation or one script, because the functions and $release exist only
   in the session that dot-sourced the file.
2. In PowerShell, dot-source it: . ./PatchTuesday.ps1
   If dot-sourcing fails because running scripts is disabled, run
   Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned in the
   same session and dot-source again. Never change the policy at any other scope.
3. Run $release = Get-PatchTuesdayRelease -Days 35 | Sort-Object Released -Descending | Select-Object -First 1
   If it returns nothing, say so and stop. If the window held more than one
   release, this keeps only the newest.
4. For each of these products, run once (one CVRF download per product):
   $release | Get-PatchTuesdayCve -Product '<product-name>'
   Products: <product-name-1>, <product-name-2>
5. Report, for each product, the CVEs that are exploited or Critical, with
   their severity, CVSS score, and the KBs that fix them.

The API can answer 429 Too Many Requests. Make at most one API call for the release plus one per
product. If a call fails with 429, stop, report it, and do not retry.

<paste the contents of PatchTuesday.ps1 here>