Patch Tuesday August 2026 Updates – Vulnerability Digest from Action1
This digest covers the most serious vulnerabilities patched by Microsoft in this month’s Patch Tuesday release.
Microsoft Vulnerabilities
Microsoft’s August 2026 Patch Tuesday addresses 398 vulnerabilities, including 44 rated critical and two zero-days. One of those zero-days, CVE-2026-68820, is already being exploited in the wild, while CVE-2026-62832 was publicly disclosed before a fix became available.
The numbers are significant, but the actively exploited vulnerability is the more immediate concern. For security teams, this month’s update cycle is less about counting patches and more about quickly identifying which vulnerabilities create the greatest exposure—and making sure the highest-risk fixes are deployed first.
CVE-2026-62832 – Windows User Profile Service Elevation of Privilege Vulnerability
“A local foothold could become administrator access, putting other users’ data and the entire system at greater risk.”
Windows User Profile Service contains an improper link resolution vulnerability that can allow an authenticated local attacker to elevate privileges. An attacker with credentials for another local account could run a specially crafted application to load another user’s registry hive, potentially accessing or modifying that user’s data and gaining administrator privileges. No user interaction is required.
CVSS Score: 7.8
SEVERITY: Important
THREAT:
An attacker who already has local access and the required account credentials could exploit this vulnerability to gain administrator privileges. Successful exploitation can result in high confidentiality, integrity, and availability impact.
EXPLOITS:
The vulnerability is publicly disclosed, but it is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as More Likely. No confirmed public exploit or proof-of-concept code is identified.
TECHNICAL SUMMARY:
The vulnerability is caused by improper link resolution before file access (CWE-59) in Windows User Profile Service. An authenticated attacker with credentials for another local account could execute a specially crafted application that causes another user’s registry hive to be loaded. Successful exploitation could enable access to or modification of another user’s data and elevate the attacker to administrator privileges. The attack is local, has low attack complexity, requires low privileges, and requires no user interaction.
EXPLOITABILITY:
Affected software includes Windows 10 versions 21H2 and 22H2, Windows 11 versions 24H2 and 26H1, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations and supported architectures. Exploitation requires authenticated local access, credentials for another local account, and execution of a specially crafted application.
BUSINESS IMPACT:
Administrator-level privilege escalation can turn limited local access into broad control of an affected system. Successful exploitation could expose or alter another user’s data and compromise system confidentiality, integrity, and availability, increasing the potential impact of an existing foothold inside an organization.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available.
URGENCY:
The vulnerability is publicly disclosed and exploitation is assessed as More Likely. Although active exploitation is not reported, organizations should prioritize deployment because successful exploitation could provide administrator privileges and compromise sensitive user data.
CVE-2026-68820 – Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
“An attacker who gets a foothold can turn limited access into SYSTEM control, putting the entire Windows host at risk.”
CVE-2026-68820 is a use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker with low privileges could run a specially crafted application and trigger a race condition. Successful exploitation could elevate the attacker to SYSTEM privileges. The vulnerability requires no user interaction, although exploitation has high attack complexity.
CVSS Score: 7
SEVERITY: Important
THREAT:
The primary threat is local privilege escalation. An attacker who already has low-privileged access could exploit the vulnerability to gain SYSTEM privileges, potentially obtaining extensive control over the affected Windows system. Confidentiality, integrity, and availability impacts are all rated High.
EXPLOITS:
Exploitation has been detected, making this an actively exploited vulnerability. It was not publicly disclosed at the time of the exploitability assessment. Exploit code maturity is listed as Unproven, so public proof-of-concept exploit code cannot be confirmed.
TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition in the Windows Ancillary Function Driver for WinSock. A locally authenticated attacker can run a specially crafted application to trigger a race condition. Exploitation requires the attacker to successfully win that race condition, which contributes to the High attack complexity rating. If successful, the attacker can elevate privileges to SYSTEM. The vulnerability has a local attack vector, requires Low privileges, and does not require user interaction.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and applicable x86, x64 and ARM64 editions. A low-privileged local attacker can exploit the flaw by running a specially crafted application and successfully triggering the race condition.
BUSINESS IMPACT:
Successful exploitation can transform limited local access into SYSTEM-level privileges. This could give an attacker powerful control over a compromised Windows endpoint or server and expose the confidentiality, integrity, and availability of information and services on that system. Because exploitation has already been detected, organizations running affected Windows systems face an immediate privilege-escalation risk.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated through the applicable Windows security update.
URGENCY:
Exploitation has been detected in the wild, so deployment should be prioritized even though the vulnerability is rated Important rather than Critical. Successful exploitation can grant SYSTEM privileges, and there is no documented workaround or mitigation when the patch cannot be applied.
CVE-2026-64898 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document action into remote code execution, putting sensitive data and systems at risk.”
CVE-2026-64898 is a Critical remote code execution vulnerability in affected Microsoft Office products. A heap-based buffer overflow involving an integer overflow or wraparound can allow an unauthorized attacker to execute code locally. An attacker can send a malicious Office file and convince a user to open it; the Preview Pane is also an attack vector. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker can craft a malicious Office file that triggers the vulnerability when processed on an affected system. The attack has low complexity and requires no privileges, but user interaction is required. Successful exploitation can execute attacker-controlled code and compromise the confidentiality, integrity, and availability of the affected system.
EXPLOITS:
This vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Exploit code maturity is rated Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.
TECHNICAL SUMMARY:
CVE-2026-64898 is caused by a heap-based buffer overflow associated with an integer overflow or wraparound in Microsoft Office. An attacker must deliver a specially crafted Office file and have it processed on the victim’s system. Opening the malicious file can trigger exploitation, and the Preview Pane is also identified as an attack vector. Although the vulnerability is classified as remote code execution because the attacker may operate remotely, the actual code execution occurs locally on the affected machine. Successful exploitation can result in unauthorized code execution with high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Office 2019 32-bit and 64-bit, Office LTSC 2021 and 2024 32-bit and 64-bit, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires no privileges but does require user interaction with a malicious Office file; the Preview Pane can also be an attack vector.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an employee’s system, potentially exposing sensitive information, altering data, or disrupting system availability. Malicious Office documents are particularly concerning in business environments because document-based workflows can provide an attacker with a practical route to target users.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making deployment of the security update the primary remediation.
URGENCY:
This patch should be prioritized because the vulnerability carries a Critical severity rating and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is currently reported, a malicious Office file can exploit the issue without requiring attacker privileges.
CVE-2026-63532 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document interaction into code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-63532 is a Critical Microsoft Office remote code execution vulnerability caused by an integer overflow or wraparound and a heap-based buffer overflow. An unauthorized attacker can exploit the vulnerability by convincing a user to open a malicious Office file. The Preview Pane is also an attack vector. Successful exploitation can execute code locally and result in high impact to confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker can create a malicious Office file designed to trigger the vulnerability. Attack complexity is low and no privileges are required, although user interaction is required. The Preview Pane can also expose users to the attack vector.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
The vulnerability involves an integer overflow or wraparound and a heap-based buffer overflow in Microsoft Office. A specially crafted Office file can trigger the flaw and allow an unauthorized attacker to execute code locally. Although the vulnerability is categorized as remote code execution because the attacker may be remote, the actual code execution occurs on the local machine. Exploitation requires no privileges, has low attack complexity, and requires user interaction. Successful exploitation can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Microsoft Office 2016 and 2019 32-bit and 64-bit editions, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024 32-bit and 64-bit editions, and Microsoft Office LTSC for Mac 2021 and 2024. An attacker can attempt exploitation using a malicious Office file that a user opens; the Preview Pane is also an attack vector.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on an affected endpoint, creating high risks to the confidentiality, integrity, and availability of business information and systems. A weaponized Office document could therefore turn common document handling into a route for significant endpoint compromise.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation path.
URGENCY:
This vulnerability is rated Critical and can lead to remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, particularly because exploitation requires no privileges and the Preview Pane is an attack vector.
CVE-2026-62878 – Windows DNS Server Remote Code Execution Vulnerability
“A single malicious network packet could turn a vulnerable DNS service into a path for remote code execution, with no authentication or user action required.”
CVE-2026-62878 is a Critical stack-based buffer overflow vulnerability in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.
CVSS Score: 9.8
SEVERITY: Critical
THREAT:
The vulnerability creates a network-based remote code execution threat against affected Windows systems running the vulnerable DNS service. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
No exploitation is currently reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-62878 is caused by a stack-based buffer overflow (CWE-121) in Windows DNS. An unauthenticated attacker can target an affected service by sending a specially crafted network packet. The attack vector is network-based, attack complexity is low, privileges are not required, and no user interaction is needed. Successful exploitation could allow execution of code on the target system and result in high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur remotely through a specially crafted packet sent to the affected service without authentication.
BUSINESS IMPACT:
Successful exploitation could allow an unauthorized remote attacker to execute code on an affected system. For organizations operating vulnerable Windows DNS services, this creates the potential for serious system compromise, disruption of critical services, unauthorized access to sensitive information, and loss of data integrity or availability.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making security update deployment the documented remediation.
URGENCY:
This Critical vulnerability has a CVSS base score of 9.8 and can be attacked remotely with low complexity, without privileges or user interaction. Although exploitation is currently assessed as Less Likely and no exploitation is reported, the potential for unauthenticated remote code execution makes timely patch deployment important.
CVE-2026-64909 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document open into code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-64909 is a critical remote code execution vulnerability in Microsoft Office involving integer underflow, out-of-bounds read, and heap-based buffer overflow weaknesses. An attacker can send a specially crafted Office file and convince a user to open it. The Preview Pane is also identified as an attack vector. Although the vulnerability is described as remote code execution because the attacker may be remote, exploitation itself occurs locally on the affected system.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An unauthorized attacker could use a malicious Office file to execute code on an affected system. Attack complexity is low and no privileges are required, but user interaction is required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.
TECHNICAL SUMMARY:
The vulnerability is associated with integer underflow or wraparound (CWE-191), out-of-bounds read (CWE-125), and heap-based buffer overflow (CWE-122) weaknesses in Microsoft Office. An attacker must send a malicious Office file and convince a user to open it. The Preview Pane can also provide an attack vector. The CVSS attack vector is Local, with low attack complexity, no privileges required, required user interaction, and unchanged scope. Successful exploitation allows code execution and can result in high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires interaction with a malicious Office file, including through the Preview Pane.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected endpoint, creating significant risk to sensitive information, system integrity, and business operations. Compromise of Office endpoints could expose business data, permit unauthorized changes, or disrupt system availability.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation path.
URGENCY:
This vulnerability carries a Critical severity rating and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely and no active exploitation is identified, organizations should prioritize deployment of the official fix because a malicious Office file can trigger a high-impact compromise with low attack complexity and no attacker privileges required.
CVE-2026-64910 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file could turn one user action into high-impact code execution, putting sensitive data and system integrity at risk.”
CVE-2026-64910 is a critical Microsoft Office remote code execution vulnerability caused by an untrusted pointer dereference. An attacker can send a malicious Office file and convince a user to open it, which could allow unauthorized code execution on the local machine. The vulnerability requires no attacker privileges but does require user interaction. It is not publicly disclosed or known to be exploited.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can provide code execution with high impact to confidentiality, integrity, and availability. The attack has low complexity and requires no privileges, although the targeted user must open a malicious Office file.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is caused by an untrusted pointer dereference (CWE-822) in Microsoft Office. Exploitation requires an attacker to deliver a malicious Office file and convince the targeted user to open it. Although classified as remote code execution because the attacker can be remote, the actual attack vector is local because the malicious content must be executed on the victim’s machine. Successful exploitation allows an unauthorized attacker to execute code locally, with high potential impact to confidentiality, integrity, and availability. The Preview Pane is not an attack vector.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a user to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected system, potentially exposing sensitive information, compromising data integrity, and disrupting system availability. A malicious Office document used in phishing or similar delivery could therefore create a significant security incident when opened.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, so affected Office installations should be updated.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations even though exploitation is currently assessed as less likely and no active exploitation is identified.
CVE-2026-64911 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file could turn a single user action into complete compromise of confidentiality, integrity, and availability.”
CVE-2026-64911 is a critical remote code execution vulnerability in affected Microsoft Office products. An integer overflow or wraparound can lead to a heap-based buffer overflow and allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file, but the attacker does not require privileges. The Preview Pane is not an attack vector.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker can send a specially crafted Office file and convince a user to open it. Successful exploitation can execute code on the local machine and has the potential for high impact to confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.
TECHNICAL SUMMARY:
CVE-2026-64911 involves integer overflow or wraparound and heap-based buffer overflow weaknesses in Microsoft Office. The attack has low complexity, requires no attacker privileges, and requires user interaction. An attacker must deliver a malicious Office file and persuade the victim to open it. Although categorized as remote code execution because the attacker can be remotely located, the actual exploitation is performed locally when the malicious content is opened. Successful exploitation can result in unauthorized code execution with high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office LTSC 2021 and 2024 (32-bit and 64-bit), Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file to be opened by a user.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution and cause significant loss of confidentiality, integrity, and availability. For organizations, a convincing malicious document could therefore expose sensitive information, enable unauthorized changes, or disrupt affected systems.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making deployment of the applicable Office update the documented remediation.
URGENCY:
This vulnerability carries a Critical severity rating and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no active exploitation is identified, affected Office installations should be updated promptly because opening a malicious document can trigger exploitation without requiring attacker privileges.
CVE-2026-62819 – Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
“A specially crafted network packet could turn an exposed RRAS service into a path for remote code execution, putting the confidentiality, integrity, and availability of the system at risk.”
CVE-2026-62819 is a critical use-after-free vulnerability (CWE-416) in Windows Routing and Remote Access Service (RRAS). An unauthenticated remote attacker could send a specially crafted packet to an affected service and, after successfully winning a race condition, execute code on the target system. The attack requires no privileges and no user interaction, although exploitation has high attack complexity.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
The vulnerability can be attacked over the network and has the potential to provide unauthorized remote code execution on an affected system. Successful exploitation carries high confidentiality, integrity, and availability impact. Exploitation requires the attacker to win a race condition, which contributes to the high attack complexity.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitability assessment is “Exploitation Less Likely,” and exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept (PoC) exploitation.
TECHNICAL SUMMARY:
CVE-2026-62819 is caused by a use-after-free weakness in Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network. Successful exploitation requires winning a race condition and can result in attacker-controlled code executing on the target system. The CVSS metrics identify a network attack vector, high attack complexity, no required privileges, no required user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and applicable architectures. Exploitation is remote through a specially crafted network packet and requires winning a race condition.
BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute code remotely on an affected system without authentication or user interaction. This creates potentially serious consequences for organizations because confidentiality, integrity, and availability can all be impacted at a high level, potentially exposing sensitive information, allowing unauthorized changes, or disrupting affected systems and services.
WORKAROUND:
No workaround or mitigation is specified. An official fix is identified as the remediation, so affected systems should receive the applicable security update.
URGENCY:
This vulnerability is rated Critical and enables remote code execution without privileges or user interaction. Although exploitation is assessed as less likely and no active exploitation is identified, the potential impact is high across confidentiality, integrity, and availability. Prioritize deployment of the applicable security update across affected Windows systems.
CVE-2026-66807 – Microsoft Office Graphics Component Remote Code Execution Vulnerability
“A malicious Office file can turn a simple file-opening action into code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-66807 is a stack-based buffer overflow vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file, and the Preview Pane is also identified as an attack vector. No privileges are required. The vulnerability is not publicly disclosed and is not reported as exploited.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker can send a specially crafted Office file and convince a user to open it. Successful exploitation can result in code execution with high impact to confidentiality, integrity, and availability. The attack complexity is low and no privileges are required, although user interaction is necessary.
EXPLOITS:
No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is caused by a stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. A malicious Office file can trigger the vulnerability when processed locally, including through the Preview Pane. Although the vulnerability title describes remote code execution, the CVSS attack vector is Local because exploitation requires code to be executed from the local machine. Successful exploitation allows code execution and can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file to be opened or processed through the Preview Pane.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on affected systems, putting sensitive information, data integrity, and system availability at risk. In an organization, a convincing malicious document could turn routine Office file handling into a system-compromise opportunity.
WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and can lead to code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix, particularly because exploitation has low attack complexity, requires no privileges, and can involve malicious Office documents or the Preview Pane.
CVE-2026-65664 – Microsoft Office Graphics Component Remote Code Execution Vulnerability
“A malicious Office file can turn one user action into code execution, putting sensitive data and system integrity at risk.”
CVE-2026-65664 is a heap-based buffer overflow vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file supplied by an attacker. No privileges are required, but user interaction is required. The Preview Pane is not an attack vector.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can result in remote code execution, with high potential impact to confidentiality, integrity, and availability. The attack has low complexity and requires no privileges, although the targeted user must be convinced to open a malicious Office file.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.
TECHNICAL SUMMARY:
CVE-2026-65664 is caused by a heap-based buffer overflow in the Microsoft Office Graphics Component. An attacker can send a specially crafted malicious Office file and convince a user to open it. Although the vulnerability is categorized as remote code execution because the attacker can be remote, the actual attack vector is local: the malicious content must be executed from the local machine. Successful exploitation can allow unauthorized code execution and cause high confidentiality, integrity, and availability impact. Attack complexity is low, no privileges are required, and user interaction is required.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 and 2024 (32-bit and 64-bit), Microsoft Office 365 for Mac, and Microsoft Office LTSC for Mac 2021 and 2024. Exploitation requires the user to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute code and compromise sensitive information, alter data, or disrupt system availability. For organizations, a convincing malicious document could turn a routine file-opening action into a serious endpoint compromise.
WORKAROUND:
No workaround or mitigation is identified. An official fix is listed as the remediation.
URGENCY:
This vulnerability carries a Critical severity rating and can result in code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is currently identified, organizations should prioritize deployment of the official fix because exploitation requires no privileges and has low attack complexity.
CVE-2026-70130 – Microsoft Office Remote Code Execution Vulnerability
“A memory corruption flaw in Microsoft Office could give an attacker the ability to run code with serious consequences for data and systems.”
CVE-2026-70130 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Microsoft Office. An unauthorized attacker can exploit the flaw locally to execute code. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
CVSS Score: 8.4
SEVERITY: Critical
THREAT:
The vulnerability creates a significant code execution threat through memory corruption in Microsoft Office. Attack complexity is low, and exploitation requires neither privileges nor user interaction. Successful exploitation could compromise sensitive information, alter data, or disrupt affected systems.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-70130 is a heap-based buffer overflow, identified as CWE-122, affecting Microsoft Office. The flaw involves improper handling of memory on the heap and can allow an unauthorized attacker to execute code locally. The attack has low complexity, requires no privileges, and requires no user interaction. The security impact is rated high for confidentiality, integrity, and availability, meaning successful exploitation could expose information, modify data, and affect system availability.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019 for 32-bit and 64-bit editions; Microsoft Office LTSC 2021 for 32-bit and 64-bit editions; and Microsoft Office LTSC 2024 for 32-bit and 64-bit editions. Exploitation uses a local attack vector with low attack complexity and requires no privileges or user interaction.
BUSINESS IMPACT:
Successful exploitation could enable unauthorized code execution and lead to loss of confidentiality, integrity, and availability. For organizations, this creates risks to sensitive business information, system trust, and operational continuity. A successful compromise could turn an Office installation into an entry point for broader security consequences.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, so affected Microsoft Office installations should be updated using the applicable Click-to-Run servicing mechanism.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no active exploitation is reported, its low attack complexity and lack of privilege or user-interaction requirements make timely deployment important.
CVE-2026-62889 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
“A specially crafted network packet could turn an SSTP flaw into remote code execution, with no authentication or user action required.”
CVE-2026-62889 is a Critical remote code execution vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). A double-free memory flaw can allow an unauthenticated remote attacker to execute code by sending a specially crafted packet to an affected SSTP service. Exploitation requires winning a race condition, making attack complexity high.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
An attacker can target an affected SSTP service remotely over the network without privileges or user interaction. Successful exploitation can result in high impact to confidentiality, integrity, and availability. Exploitation is rated less likely because successfully triggering the vulnerability requires winning a race condition.
EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is caused by a CWE-415 double-free condition in Windows Secure Socket Tunneling Protocol (SSTP). An unauthenticated attacker can send a specially crafted packet over the network to an affected service. Successful exploitation requires the attacker to win a race condition but, if successful, can allow code execution on the target system. The CVSS metrics identify a network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and supported architectures. Exploitation uses a specially crafted network packet and requires winning a race condition.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution on affected systems, putting sensitive information, system integrity, and service availability at risk. For organizations with affected SSTP services, compromise could disrupt operations and expose critical Windows systems to attacker-controlled code.
WORKAROUND:
No workaround or mitigation is identified. An official fix is listed, so affected systems should be updated with the applicable security update.
URGENCY:
This vulnerability carries a Critical severity rating and can enable unauthenticated remote code execution with no user interaction. Although exploitation is assessed as less likely and no exploitation is reported, the potential impact is high. Organizations should prioritize deployment of the applicable security updates across affected Windows systems.
CVE-2026-65657 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document open into code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-65657 is a critical use-after-free vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code locally. An attacker must convince a user to open a malicious Office file, and the Preview Pane is also identified as an attack vector. Exploitation requires no privileges but does require user interaction.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can result in arbitrary code execution on an affected system. The vulnerability has high confidentiality, integrity, and availability impacts, creating the potential for sensitive information exposure, unauthorized modification, and disruption of affected systems.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-65657 is caused by a use-after-free weakness (CWE-416) in Microsoft Office. The attack vector is classified as local with low attack complexity, no privileges required, and user interaction required. An attacker can send a malicious Office file and convince the intended victim to open it. The Preview Pane can also serve as an attack vector. Although the vulnerability is titled remote code execution because the attacker may be remote, exploitation itself involves code being executed from the local machine. Successful exploitation can execute code and cause high confidentiality, integrity, and availability impacts.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office LTSC 2021 and 2024 (32-bit and 64-bit), Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file to be opened by a user; the Preview Pane is also an attack vector.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on business endpoints and place sensitive information, system integrity, and service availability at risk. A malicious Office document could therefore become an entry point for significant compromise when handled on a vulnerable system.
WORKAROUND:
No workaround or mitigation is identified. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and can lead to remote code execution with high confidentiality, integrity, and availability impacts. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, particularly because exploitation requires no existing privileges.
CVE-2026-63519 – Microsoft Office Graphics Component Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document opening into code execution, putting sensitive data and system integrity at risk.”
CVE-2026-63519 is a critical heap-based buffer overflow vulnerability in the Microsoft Office Graphics Component. An unauthorized attacker can potentially execute code by sending a specially crafted Office file and convincing a user to open it. The Preview Pane is also an attack vector. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
The vulnerability creates a remote code execution risk through malicious Office content. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation could allow attacker-controlled code to execute on the affected system.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-63519 is caused by a heap-based buffer overflow (CWE-122) in the Microsoft Office Graphics Component. The CVSS attack vector is Local because exploitation requires code to be executed from the local machine, while “Remote Code Execution” describes the attacker being remote. An attacker can send a malicious Office file and persuade a user to open it; the Preview Pane can also serve as an attack vector. The vulnerability requires no privileges and has low attack complexity, but user interaction is required. Successful exploitation can result in arbitrary code execution with high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (32-bit and 64-bit), and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file and user interaction, with the Preview Pane also identified as an attack vector.
BUSINESS IMPACT:
Successful exploitation could enable unauthorized code execution on affected endpoints, potentially compromising sensitive information, altering data, and disrupting system availability. Because Office documents are routinely used in business workflows, a malicious document could create significant operational and security consequences.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, especially where users routinely process Office documents or use Preview Pane functionality.
CVE-2026-62817 – Windows DNS Server Remote Code Execution Vulnerability
“A nearby attacker could turn a DNS memory flaw into remote code execution, putting critical Windows systems at risk without needing privileges or user interaction.”
CVE-2026-62817 is a critical out-of-bounds write vulnerability in Windows DNS that can allow an unauthorized attacker on an adjacent network to execute code. Exploitation requires low attack complexity, no privileges, and no user interaction. Microsoft assesses exploitation as less likely, and the vulnerability is neither publicly disclosed nor known to be exploited.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
An attacker with adjacent network access could exploit the out-of-bounds write to achieve remote code execution by calling arbitrary endpoints. A successful attack could have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
No known exploitation or public disclosure is reported. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.
TECHNICAL SUMMARY:
The vulnerability is caused by an out-of-bounds write in Windows DNS. An unauthorized in-network attacker could exploit the flaw by calling arbitrary endpoints, resulting in remote code execution. The attack vector is Adjacent and attack complexity is Low. No privileges or user interaction are required, and the scope remains unchanged. Successful exploitation can have High confidentiality, integrity, and availability impacts.
EXPLOITABILITY:
Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation can occur from an adjacent network without privileges or user interaction.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution on affected Windows systems. This creates significant risk to sensitive information, system integrity, and service availability. For organizations operating affected DNS or Windows infrastructure, compromise could disrupt critical services and give an attacker the ability to execute code on vulnerable systems.
WORKAROUND:
No workaround or mitigation is identified. The official fix should be applied to affected systems.
URGENCY:
This vulnerability is rated Critical and can enable remote code execution with low attack complexity, no privileges, and no user interaction. Although exploitation is assessed as Less Likely and no active exploitation is reported, affected systems should be prioritized for deployment of the official fix because successful exploitation can have High confidentiality, integrity, and availability impacts.
CVE-2026-62911 – Microsoft Exchange Server Elevation of Privilege Vulnerability
“A successful attack could turn access to one Exchange account into control over every user’s mailbox, exposing email, attachments, and trusted communications.”
CVE-2026-62911 is a Critical elevation-of-privilege vulnerability in Microsoft Exchange Server caused by an authentication bypass through capture-replay. An authorized attacker with low privileges can exploit the vulnerability over a network, with user interaction required, to elevate privileges and take over Exchange users’ mailboxes. The vulnerability is not publicly disclosed and is not known to be exploited.
CVSS Score: 8
SEVERITY: Critical
THREAT:
A successful attacker could take over the mailboxes of all Exchange users. This could allow the attacker to read emails, download attachments, and send emails from compromised mailboxes, putting sensitive communications and trusted identities at risk.
EXPLOITS:
No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is an authentication bypass caused by a capture-replay weakness (CWE-294) in Microsoft Exchange Server. An authorized attacker with low privileges can exploit it over a network to elevate privileges. Attack complexity is Low, privileges required are Low, and user interaction is Required. Successful exploitation could provide access to all Exchange users’ mailboxes, enabling the attacker to send and read emails and download attachments. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.
EXPLOITABILITY:
Affected versions are Microsoft Exchange Server 2016 CU23, Exchange Server 2019 CU14, Exchange Server 2019 CU15, and Exchange Server Subscription Edition RTM. Exploitation can occur over the network with low privileges and low attack complexity, but requires user interaction.
BUSINESS IMPACT:
Compromise could expose sensitive corporate email and attachments while allowing attackers to send messages through trusted Exchange mailboxes. This creates serious risks to confidentiality, integrity, business communications, and organizational trust, with the potential for broad mailbox compromise.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is specified, and customer action is required.
URGENCY:
This vulnerability is rated Critical and can result in takeover of all Exchange users’ mailboxes. Although exploitation is assessed as less likely and no exploitation is reported, the combination of network accessibility, low attack complexity, and high confidentiality, integrity, and availability impact makes prompt deployment of the official fix important.
CVE-2026-63515 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document open into full code execution, putting sensitive data and systems at risk.”
CVE-2026-63515 is a critical remote code execution vulnerability affecting multiple Microsoft Office products. The issue involves an out-of-bounds read and integer underflow. An unauthorized attacker can send a malicious Office file and convince a user to open it, resulting in code execution on the local machine. The Preview Pane is also identified as an attack vector.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can allow attacker-controlled code to execute locally with high impact to confidentiality, integrity, and availability. Attack complexity is low, no privileges are required, and user interaction is required. The Preview Pane can also serve as an attack vector.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.
TECHNICAL SUMMARY:
CVE-2026-63515 is caused by out-of-bounds read and integer underflow conditions in Microsoft Office, identified as CWE-125 and CWE-191. A crafted malicious Office file can trigger the vulnerability and lead to local arbitrary code execution. Although the vulnerability is titled remote code execution because the attacker can be remote, exploitation itself occurs locally. An attacker can send a malicious Office document to a target and convince the user to open it. The Preview Pane is also an attack vector. Successful exploitation can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024, as well as Microsoft Office 365 for Mac and Office LTSC for Mac 2021 and 2024. Exploitation requires no privileges but does require user interaction.
BUSINESS IMPACT:
Successful exploitation could enable unauthorized code execution and cause serious compromise of affected Office environments. The high confidentiality, integrity, and availability impacts mean an attack could expose sensitive information, alter data, or disrupt systems. A malicious document can therefore become a direct path from user interaction to system compromise.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation.
URGENCY:
This vulnerability is rated Critical and carries a CVSS base score of 7.8. Its low attack complexity, lack of required privileges, malicious-file attack path, and potential for high confidentiality, integrity, and availability impact make timely deployment important. Although exploitation is assessed as less likely and no exploitation is reported, affected Office installations should receive the official fix as a priority.
CVE-2026-63526 – Microsoft Office Graphics Component Remote Code Execution Vulnerability
“A malicious Office file can turn a simple document open or Preview Pane action into code execution, putting sensitive data and system integrity at risk.”
CVE-2026-63526 is a critical remote code execution vulnerability caused by a stack-based buffer overflow in Microsoft Office. An attacker can send a specially crafted Office file and convince a user to open it; the Preview Pane is also an attack vector. Successful exploitation can execute code locally without requiring attacker privileges and can have a high impact on confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
The vulnerability creates a remote code execution risk through malicious Office content. Attack complexity is low, privileges are not required, and user interaction is required. Although the attacker may deliver the malicious file remotely, exploitation executes code on the local machine.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-63526 is a stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. A specially crafted Office file can trigger the vulnerability when processed locally. An attacker must send the malicious file and convince the user to open it, while the Preview Pane can also serve as an attack vector. No attacker privileges are required, attack complexity is low, and successful exploitation can execute unauthorized code with high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires malicious Office content to be processed locally, with user interaction required.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution and lead to exposure or modification of sensitive information and disruption of affected systems. Because Office documents are commonly exchanged in business environments, a malicious document could create significant risk when opened or processed through the Preview Pane.
WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified, so affected Office installations should be updated where possible.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office products, particularly systems where users routinely handle externally sourced Office documents.
CVE-2026-62820 – Windows DNS Server Remote Code Execution Vulnerability
“A specially crafted network packet could turn a DNS race condition into remote code execution, with no authentication or user action required.”
CVE-2026-62820 is a critical remote code execution vulnerability caused by improper synchronization of a shared resource in Windows DNS. An unauthenticated remote attacker could send a specially crafted packet to an affected service and attempt to win a race condition. Successful exploitation could allow attacker-controlled code to execute on the target system.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
An attacker can target the vulnerable service remotely over the network without privileges or user interaction. Although exploitation requires winning a race condition and therefore has high attack complexity, successful exploitation can have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is a race condition (CWE-362) involving concurrent execution using a shared resource without proper synchronization in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Exploitation requires the attacker to successfully win the race condition, which accounts for the High attack complexity rating. If successful, the attacker could execute code on the target system. The CVSS metrics identify Network attack vector, no privileges required, no user interaction required, unchanged scope, and High confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products are Windows 10 Version 1607 (32-bit and x64), Windows 10 Version 1809 (32-bit and x64), Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service and successfully triggering the race condition.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution and result in significant compromise of confidentiality, integrity, and availability. For organizations operating affected Windows systems, compromise could disrupt services, expose sensitive information, or enable unauthorized changes on the targeted system.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available for the listed affected software.
URGENCY:
This vulnerability is rated Critical and can enable remote code execution without authentication or user interaction. Although exploitation is assessed as Less Likely and requires winning a race condition, the potential impact is high across confidentiality, integrity, and availability. The official fix should therefore be prioritized for affected systems.
CVE-2026-62815 – Microsoft QUIC Remote Code Execution Vulnerability
“A single malicious network packet could turn a memory flaw into full remote code execution.”
CVE-2026-62815 is a Critical use-after-free vulnerability in Microsoft QUIC that can allow an unauthenticated remote attacker to execute code on an affected Windows system. Exploitation requires low attack complexity and can be performed over the network without privileges or user interaction.
CVSS Score: 9.8
SEVERITY: Critical
THREAT:
An unauthorized remote attacker can target an affected QUIC service by sending a specially crafted network packet. Successful exploitation could result in remote code execution with high impact to confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.
TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free memory condition in Microsoft QUIC (CWE-416). An unauthenticated attacker can send a specially crafted packet to an affected service over the network to trigger the flaw. Attack complexity is low, and successful exploitation can allow execution of attacker-controlled code on the target system. No privileges or user interaction are required.
EXPLOITABILITY:
Affected software includes Windows 11 versions 24H2, 25H2, and 26H1 on ARM64 and x64 systems, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service.
BUSINESS IMPACT:
Successful exploitation could compromise affected endpoints or servers through remote code execution, threatening the confidentiality, integrity, and availability of business systems. Because authentication and user interaction are not required, exposed vulnerable services could present a significant organizational risk.
WORKAROUND:
No mitigation or workaround is identified. An official fix is available, and affected systems require a restart when applying the listed updates.
URGENCY:
This is a Critical vulnerability with a CVSS base score of 9.8 and a network-based attack path requiring no privileges or user interaction. Although exploitation is not currently reported, the low attack complexity and potential for remote code execution make timely deployment important.
CVE-2026-65665 – Microsoft SharePoint Server Remote Code Execution Vulnerability
“A compromised SharePoint Site Owner account could turn untrusted data into remotely executed code, putting sensitive business systems at risk.”
Microsoft SharePoint Server contains a critical remote code execution vulnerability caused by deserialization of untrusted data. An authenticated attacker with at least Site Owner privileges could inject arbitrary code and execute it remotely on a vulnerable SharePoint Server. Successful exploitation could have a high impact on confidentiality, integrity, and availability.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
The vulnerability is network-accessible, has low attack complexity, and requires low privileges with no user interaction. Successful exploitation could allow arbitrary code execution on the SharePoint Server. It is assessed as “Exploitation More Likely.”
EXPLOITS:
This vulnerability is not publicly disclosed and is not currently exploited. Exploit code maturity is listed as Unproven, so no confirmed public exploit, zero-day exploitation, or proof-of-concept code can be established from the source information.
TECHNICAL SUMMARY:
CVE-2026-65665 is a deserialization of untrusted data vulnerability (CWE-502) in Microsoft Office SharePoint. In a network-based attack, an authenticated attacker with at least Site Owner privileges could write arbitrary code that is injected and executed remotely on the SharePoint Server. Attack complexity is low, scope remains unchanged, and successful exploitation can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products are Microsoft SharePoint Server 2019 and Microsoft SharePoint Server Subscription Edition. Exploitation requires an authenticated attacker with at least Site Owner privileges, but no user interaction is required.
BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute arbitrary code on a SharePoint Server, threatening sensitive information, system integrity, and service availability. For organizations relying on SharePoint for collaboration and business content, compromise could disrupt operations and expose critical organizational data.
WORKAROUND:
No workaround or mitigation is identified. Apply all applicable security updates offered for the installed SharePoint software; some affected installations require multiple update packages.
URGENCY:
This is a Critical remote code execution vulnerability with a CVSS base score of 8.8 and an “Exploitation More Likely” assessment. Its network attack vector, low attack complexity, and lack of required user interaction make timely deployment important. Apply all applicable updates for affected SharePoint installations.
CVE-2026-62827 – Microsoft SharePoint Server Elevation of Privilege Vulnerability
“A compromised SharePoint account could become a doorway to administrator control, putting sensitive business data and server operations at risk.”
CVE-2026-62827 is a Critical elevation-of-privilege vulnerability caused by improper authentication in Microsoft SharePoint Server. An authenticated attacker with domain access and low privileges could exploit the vulnerability over the network to elevate themselves to SharePoint administrator. The vulnerability can have a high impact on confidentiality, integrity, and availability.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
An attacker who already has authenticated domain access could target a vulnerable SharePoint server remotely. Successful exploitation could elevate the attacker to SharePoint administrator, significantly expanding their control over the environment. Attack complexity is low, and no user interaction is required.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.
TECHNICAL SUMMARY:
The vulnerability is caused by improper authentication (CWE-287) in Microsoft Office SharePoint. An authenticated attacker with low privileges and access to the domain can exploit the issue over the network. The described attack could enable remote code execution on the SharePoint server as part of elevating the attacker to SharePoint administrator. The CVSS metrics identify network-based access, low attack complexity, low privileges required, no user interaction, and high potential impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products are Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Exploitation requires an authenticated attacker with domain access and low privileges; no user interaction is required.
BUSINESS IMPACT:
Successful exploitation could give an attacker SharePoint administrator privileges, creating serious risk to information stored and managed through SharePoint. With confidentiality, integrity, and availability all rated High for impact, exploitation could expose sensitive information, enable unauthorized changes, and disrupt SharePoint services.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, and all applicable security updates for the installed SharePoint software should be applied.
URGENCY:
This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although it is not known to be exploited or publicly disclosed, its network attack vector, low attack complexity, and potential for SharePoint administrator privilege elevation make timely deployment important.
CVE-2026-65791 – Windows iSCSI Target Service Remote Code Execution Vulnerability
“A single malicious network packet could turn an exposed iSCSI service into a path for remote code execution.”
CVE-2026-65791 is a critical heap-based buffer overflow in the Windows iSCSI Target Service. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.
CVSS Score: 9.8
SEVERITY: Critical
THREAT:
The vulnerability presents a significant remote code execution threat to affected Windows systems running the vulnerable iSCSI Target Service. An attacker can target the service over the network without authentication. Successful exploitation can have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is listed as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-65791 is caused by a heap-based buffer overflow (CWE-122) in the Windows iSCSI Target Service. An unauthenticated attacker can send a specially crafted packet over the network to an affected service. Processing that packet can trigger the memory corruption condition and allow remote code execution on the target system. The CVSS metrics identify a network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope, with high confidentiality, integrity, and availability impacts.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 variants. Exploitation can occur by sending a specially crafted network packet to the affected iSCSI Target Service without authentication.
BUSINESS IMPACT:
Successful exploitation could allow an unauthorized remote attacker to execute code on an affected system, creating serious risks to sensitive information, system integrity, and service availability. For organizations with reachable affected services, this could turn a network-facing vulnerability into a route for system compromise and operational disruption.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is listed, so affected systems should receive the applicable security update.
URGENCY:
This is a Critical vulnerability with a CVSS base score of 9.8 and a low-complexity network attack path requiring no privileges or user interaction. Although exploitation is not reported and exploit maturity is Unproven, its remote code execution potential and high confidentiality, integrity, and availability impacts make prompt deployment important.
CVE-2026-68804 – Microsoft Excel Remote Code Execution Vulnerability
“A malicious Excel file could turn a routine document opening into arbitrary code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-68804 is a critical remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office editions. The vulnerability involves numeric truncation and a heap-based buffer overflow. An attacker can send a specially crafted Office file and convince a user to open it, potentially allowing unauthorized code execution on the local machine. Exploitation requires no privileges but does require user interaction.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can allow an unauthorized attacker to execute code locally after a user opens a malicious Office file. The CVSS assessment rates the potential confidentiality, integrity, and availability impacts as High. The Preview Pane is not an attack vector.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.
TECHNICAL SUMMARY:
The vulnerability is associated with CWE-197 numeric truncation and CWE-122 heap-based buffer overflow conditions in Microsoft Office Excel. Exploitation involves an attacker sending a malicious Office file and persuading the target to open it. Although classified as remote code execution because the attacker may be remote, the actual attack vector is Local (AV:L), meaning exploitation occurs when the malicious content is executed from the local machine. Attack complexity is Low, privileges are not required, and user interaction is required. Successful exploitation can result in high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected software includes 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a user to open a malicious Office file; no privileges are required.
BUSINESS IMPACT:
Successful exploitation could enable arbitrary code execution and expose organizations to serious compromise of sensitive information, system integrity, and business availability. A convincing malicious document could make an ordinary file-opening action the trigger for a high-impact security incident.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the specified remediation path.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impacts. Although exploitation is currently assessed as Less Likely and no active exploitation is identified, affected Microsoft Office and Excel installations should be patched urgently to remove the vulnerable condition.
CVE-2026-66799 – Windows Key Guard Elevation of Privilege Vulnerability
“A local attacker with limited privileges could turn a Windows Key Guard memory flaw into highly privileged access, putting sensitive systems and data at risk.”
CVE-2026-66799 is a critical elevation-of-privilege vulnerability in Windows Key Guard caused by a heap-based buffer overflow. An authorized local attacker with low privileges could exploit the flaw to gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
The vulnerability can allow an attacker who already has low-level local access to elevate privileges through Windows Key Guard. A successful attack could have a high impact on confidentiality, integrity, and availability. The attack complexity is rated Low, although exploitation requires local access and low privileges.
EXPLOITS:
No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploit, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-66799 is a heap-based buffer overflow (CWE-122) affecting Windows Key Guard. The flaw can be triggered locally by an authorized attacker with low privileges. Successful exploitation can elevate the attacker’s privileges to Virtual Trust Level 1 (VTL1). The CVSS metrics rate attack complexity as Low, privileges required as Low, user interaction as None, and scope as Unchanged, with High potential impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation requires local access and low privileges but requires no user interaction.
BUSINESS IMPACT:
Successful exploitation could allow an attacker with existing local access to reach VTL1 privileges, increasing their ability to compromise sensitive system resources. Because confidentiality, integrity, and availability impacts are all rated High, successful privilege escalation could expose sensitive information, enable unauthorized changes, and disrupt affected Windows systems.
WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified, so affected systems should be updated using the applicable security update.
URGENCY:
This vulnerability is rated Critical and affects numerous Windows client and server releases. Although exploitation is assessed as Less Likely and no exploitation is reported, its low attack complexity, lack of required user interaction, and potential for VTL1 privilege escalation make timely deployment important.
CVE-2026-68794 – Microsoft Excel Remote Code Execution Vulnerability
“A malicious Excel file can turn a routine document open into code execution, putting sensitive data and systems at risk.”
CVE-2026-68794 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Microsoft Office Excel. An attacker can send a specially crafted Office file and convince a user to open it, triggering the vulnerability locally. Successful exploitation could allow unauthorized code execution with high impact to confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker could use a malicious Office file to trigger a heap-based buffer overflow and execute code on the affected system. Attack complexity is low and no privileges are required, although the targeted user must open the malicious file. The Preview Pane is not an attack vector.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified in the source information.
TECHNICAL SUMMARY:
CVE-2026-68794 is a heap-based buffer overflow (CWE-122) affecting Microsoft Office Excel. The attack vector is rated Local because exploitation occurs when code or content is executed from the local machine, even though an attacker may deliver the malicious document remotely. An attacker must send a specially crafted Office file and convince the victim to open it. Successful exploitation can result in arbitrary code execution and has High confidentiality, integrity, and availability impact. No privileges are required, but user interaction is required.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Excel 2016 (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (32-bit and 64-bit), and Office LTSC for Mac 2021 and 2024. Exploitation requires the victim to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution, potentially exposing sensitive information, compromising data integrity, and disrupting system availability. Malicious Office documents can also create a practical delivery path because exploitation can be initiated when a targeted user is persuaded to open the file.
WORKAROUND:
No workaround or mitigation is specified. An official fix is identified, so affected products should be updated through the applicable servicing method.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely and no exploitation is reported, organizations should prioritize deployment of the official fix across affected Microsoft Office and Excel installations.
CVE-2026-62816 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
“A single malicious network packet could turn a memory flaw into remote code execution, with no authentication or user action required.”
CVE-2026-62816 is a critical remote code execution vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). A heap-based buffer overflow involving an integer overflow or wraparound can be triggered by an unauthenticated attacker sending a specially crafted packet to an affected service over an adjacent network. Successful exploitation could allow attacker-controlled code to execute on the target system.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
An attacker with adjacent network access could target an affected RMCAST service using a specially crafted packet. Attack complexity is low, privileges are not required, and no user interaction is needed. Successful exploitation can have high confidentiality, integrity, and availability impact.
EXPLOITS:
This vulnerability was not publicly disclosed and was not reported as exploited at publication. Exploit code maturity is listed as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow associated with an integer overflow or wraparound in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker can send a specially crafted packet to an affected service over an adjacent network. Processing that packet can trigger the memory corruption condition and allow remote code execution on the target system. The attack requires low complexity, no privileges, and no user interaction, while successful exploitation can compromise confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. Exploitation can occur by sending a specially crafted packet to an affected service from an adjacent network.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution and result in loss of confidentiality, unauthorized changes, or service disruption on affected systems. Because authentication and user interaction are not required, exposed affected services on reachable adjacent networks represent a significant organizational risk.
WORKAROUND:
No mitigations or workarounds are specified. An official fix is available, so affected systems should be updated with the applicable security update.
URGENCY:
This vulnerability is rated Critical and can enable remote code execution without privileges or user interaction. Although it was not reported as exploited or publicly disclosed and exploitation is assessed as Less Likely, its potential for high confidentiality, integrity, and availability impact makes timely deployment important.
CVE-2026-68816 – Microsoft Excel Remote Code Execution Vulnerability
“A malicious Excel file can turn a simple file open into high-impact code execution.”
CVE-2026-68816 is a Critical remote code execution vulnerability caused by a stack-based buffer overflow in Microsoft Office Excel. An attacker can send a specially crafted Office file and convince a user to open it, triggering the vulnerability locally. Successful exploitation can result in high impact to confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker can use a malicious Office file to trigger a stack-based buffer overflow and execute code on the affected system. Attack complexity is low and no privileges are required, although user interaction is required. The Preview Pane is not an attack vector.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-68816 is a stack-based buffer overflow vulnerability (CWE-121) affecting Microsoft Office Excel. Exploitation requires an attacker to deliver a malicious Office file and persuade the victim to open it. Although classified as remote code execution because the attacker may be remote, the malicious code is executed locally on the victim’s machine. The attack has low complexity, requires no privileges, and requires user interaction. Successful exploitation can execute unauthorized code and cause high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Excel 2016 (32-bit and 64-bit), Office 2019 (32-bit and 64-bit), Office 365 for Mac, Office LTSC 2021 and 2024 (32-bit and 64-bit), and Office LTSC for Mac 2021 and 2024. Exploitation requires a user to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on employee systems, potentially exposing sensitive information, modifying data, or disrupting system availability. A convincing malicious document could turn ordinary document handling into a significant security incident.
WORKAROUND:
No workaround or mitigation is identified. An official fix is identified as the remediation.
URGENCY:
This vulnerability carries a Critical severity rating and can result in remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft Office and Excel installations, particularly systems where users regularly receive Office documents from external sources.
CVE-2026-62890 – Windows GDI+ Elevation of Privilege Vulnerability
“A local foothold could become full SYSTEM control, putting sensitive data and critical Windows operations at risk.”
CVE-2026-62890 is a heap-based buffer overflow vulnerability in Windows GDI+. An authorized local attacker with low privileges could exploit the flaw to execute code and gain SYSTEM privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
The primary threat is local privilege escalation through a heap-based buffer overflow in Windows GDI+. An attacker who already has low-level access could potentially elevate to SYSTEM privileges. The attack complexity is rated Low and no user interaction is required.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-62890 is caused by a heap-based buffer overflow (CWE-122) in Windows GDI+. The attack vector is Local, with Low attack complexity and Low privileges required. No user interaction is necessary. Successful exploitation allows an authorized attacker to execute code locally and could result in SYSTEM privileges. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations and supported architectures. Exploitation requires local access and low privileges but no user interaction.
BUSINESS IMPACT:
Successful exploitation could turn limited local access into SYSTEM-level control. This could expose sensitive information, permit unauthorized system changes, and disrupt affected Windows systems, with high potential impacts to confidentiality, integrity, and availability.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is listed as the remediation, so affected systems should receive the applicable security update.
URGENCY:
This vulnerability carries a Critical severity rating and can allow an attacker with low privileges to gain SYSTEM privileges without user interaction. Although exploitation is assessed as Less Likely and no active exploitation is identified, organizations should prioritize deployment of the official fix because successful exploitation could provide extensive control over affected systems.
CVE-2026-62822 – Windows GDI+ Remote Code Execution Vulnerability
“A malicious file can turn a simple user action into remote code execution, putting sensitive data and system integrity at risk.”
CVE-2026-62822 is a Critical Windows GDI+ remote code execution vulnerability caused by an integer overflow or wraparound and a heap-based buffer overflow. An unauthorized remote attacker can exploit the vulnerability by convincing a user to open a specially crafted file. Successful exploitation can execute code on the affected system, with potentially high impact to confidentiality, integrity, and availability.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
The vulnerability affects Windows GDI+ and involves integer overflow or wraparound and heap-based buffer overflow conditions. An attacker can remotely deliver a specially crafted file, but exploitation requires the user to open that file. The attack vector is network-based, attack complexity is low, and no privileges are required. Successful exploitation allows unauthorized remote code execution in the target context and can have high impact on the confidentiality, integrity, and availability of the affected system.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation requires a user to open a specially crafted attacker-controlled file.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected Windows system, potentially exposing sensitive information, enabling unauthorized system changes, or disrupting system availability. Because no attacker privileges are required and attack complexity is low, malicious-file delivery presents a significant organizational risk even though user interaction is required.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the identified remediation.
URGENCY:
This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although it is not publicly disclosed or known to be exploited and exploitation is assessed as Less Likely, affected Windows systems should be prioritized for patching because exploitation requires no attacker privileges and has low attack complexity.
CVE-2026-64907 – Microsoft Office Word Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document open into code execution, putting sensitive data and system integrity at risk.”
CVE-2026-64907 is a Critical remote code execution vulnerability caused by a stack-based buffer overflow in Microsoft Office Word. An attacker can send a specially crafted Office file and convince a user to open it. The resulting attack executes locally and can compromise confidentiality, integrity, and availability. The vulnerability requires no attacker privileges but does require user interaction.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An unauthorized attacker could use a malicious Office document to trigger a stack-based buffer overflow and execute code on the affected system. Attack complexity is Low, privileges are not required, and successful exploitation could have a High impact on confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is Unproven, and the exploitation assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-64907 is a stack-based buffer overflow, identified as CWE-121, affecting Microsoft Office Word. Exploitation requires an attacker to send a malicious Office file and persuade a user to open it. Although the vulnerability is categorized as remote code execution because the attacker may be remote, the actual attack vector is Local: code must be executed from the victim’s local machine. The vulnerability has Low attack complexity, requires no privileges, and requires user interaction. Successful exploitation allows code execution and can result in High confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office 365 for Mac, Microsoft Office LTSC 2021 and 2024 (32-bit, 64-bit, and listed Mac editions), and Microsoft Word 2016 (32-bit and 64-bit). Exploitation requires the victim to open a malicious Office file sent by an attacker.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on employee systems, potentially exposing sensitive information, allowing unauthorized modification of data, or disrupting system availability. A convincing malicious document could therefore turn normal document handling into a route for system compromise.
WORKAROUND:
No mitigations or workarounds are identified. An official fix is identified as the remediation.
URGENCY:
This vulnerability carries a Critical severity rating and can result in code execution with High impact across confidentiality, integrity, and availability. Organizations using the affected Microsoft Office and Word products should prioritize deployment of the official fix, particularly where users routinely receive and open Office documents from external sources.
CVE-2026-63518 – Microsoft Office Word Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document open into code execution, putting sensitive data and system integrity at risk.”
CVE-2026-63518 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Microsoft Office Word. An attacker can send a malicious Office file and convince a user to open it, triggering code execution on the local machine. No attacker privileges are required, but user interaction is necessary. Confidentiality, integrity, and availability can all be impacted.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can allow an unauthorized attacker to execute code locally. The vulnerability has low attack complexity and requires no attacker privileges, although the targeted user must open a malicious Office file. A successful attack can have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as less likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.
TECHNICAL SUMMARY:
CVE-2026-63518 is a heap-based buffer overflow vulnerability in Microsoft Office Word. It can allow an unauthorized attacker to execute code locally after a user opens a specially crafted malicious Office file. Although the vulnerability title describes remote code execution because the attacker can be remote, the CVSS attack vector is Local. Exploitation has low complexity, requires no privileges, and requires user interaction. Successful exploitation can result in high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise on 32-bit and 64-bit systems, Office 2019, Office LTSC 2021 and 2024, Office 365 for Mac, Office LTSC for Mac 2021 and 2024, and Outlook 2016 32-bit and 64-bit editions. Exploitation requires the victim to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected system, creating risks to sensitive information, system integrity, and service availability. In an organization, a malicious document could turn a common user action into a serious endpoint compromise.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, so affected Office installations should be updated.
URGENCY:
This vulnerability is rated Critical and can result in code execution with high confidentiality, integrity, and availability impact. While exploitation is assessed as less likely and no active exploitation is identified, organizations should prioritize deployment of the official fix because opening a malicious Office file can trigger the vulnerability.
CVE-2026-63513 – Microsoft Office Graphics Component Remote Code Execution Vulnerability
“A malicious Office file can turn a simple document open or Preview Pane action into an opportunity to run attacker-controlled code.”
CVE-2026-63513 is a heap-based buffer overflow in the Microsoft Office Graphics Component that can allow an unauthorized attacker to execute code locally. An attacker must deliver a malicious Office file and convince the user to open it, while the Preview Pane can also act as an attack vector. Successful exploitation can result in high impact to confidentiality, integrity, and availability.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
The vulnerability creates a remote code execution risk through malicious Office content. Although the CVSS attack vector is Local, the attacker can be remote and deliver a crafted Office file that triggers exploitation when processed on the local system. Attack complexity is Low, no privileges are required, and user interaction is required.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitability assessment is Exploitation Less Likely, and exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.
TECHNICAL SUMMARY:
CVE-2026-63513 is caused by a heap-based buffer overflow in the Microsoft Office Graphics Component. A malicious Office file can trigger the vulnerability when processed locally. The attacker must send the crafted file to a user and convince them to open it; the Preview Pane is also identified as an attack vector. Successful exploitation can allow arbitrary code execution, with high potential impact to confidentiality, integrity, and availability. The vulnerability requires no attacker privileges but does require user interaction.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires malicious Office content to be processed locally, with user interaction required.
BUSINESS IMPACT:
Successful exploitation could allow attacker-controlled code to run on an affected system, potentially compromising sensitive information, altering data, and disrupting system availability. Malicious Office documents also present a practical delivery mechanism for attacks, making exposure to untrusted files an important organizational risk.
WORKAROUND:
No workaround or mitigation is listed. An official fix is identified as the remediation, so affected Office installations should be patched through the applicable update mechanism.
URGENCY:
This vulnerability is rated Critical and can lead to code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no active exploitation is identified, affected Microsoft Office products should be prioritized for deployment of the official fix.
CVE-2026-64903 – Microsoft Office Remote Code Execution Vulnerability
“A malicious Office file can turn a routine document-opening action into code execution with high impact to confidentiality, integrity, and availability.”
CVE-2026-64903 is a Critical Microsoft Office remote code execution vulnerability involving integer overflow or wraparound and a heap-based buffer overflow. An unauthorized attacker can send a malicious Office file and convince a user to open it, enabling code execution on the local machine. The Preview Pane is also identified as an attack vector. The vulnerability requires no attacker privileges but does require user interaction.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
An attacker could use a specially crafted Microsoft Office file to trigger the vulnerability and execute code locally. Successful exploitation carries High confidentiality, integrity, and availability impacts. Attack complexity is Low, and no privileges are required, increasing the potential threat from malicious documents.
EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
CVE-2026-64903 involves an integer overflow or wraparound and heap-based buffer overflow in Microsoft Office. An attacker can create a malicious Office file and convince a user to open it. The Preview Pane can also act as an attack vector. Although the CVSS attack vector is Local, “Remote” in the vulnerability title refers to the attacker’s location; exploitation itself requires code to be executed from the local machine. Successful exploitation can result in arbitrary code execution with High impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Office 2016, Office 2019, Office LTSC 2021, Office LTSC 2024, Microsoft Office 365 for Mac, and Office LTSC for Mac 2021 and 2024. Exploitation requires a malicious Office file and user interaction. No attacker privileges are required.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on affected systems, potentially exposing sensitive information, altering data, or disrupting system availability. In organizations where Office documents are routinely exchanged, a convincing malicious document could create a significant security incident.
WORKAROUND:
No workaround or mitigation is identified. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impacts. Organizations should prioritize deployment of the official fix across affected Microsoft Office installations, particularly because exploitation has Low attack complexity and requires no attacker privileges.
CVE-2026-63525 – Microsoft Office Word Remote Code Execution Vulnerability
“A malicious Office file can turn a simple document open into code execution, putting sensitive data and systems at risk.”
CVE-2026-63525 is a critical remote code execution vulnerability caused by a numeric truncation error in Microsoft Office Word. An attacker can send a specially crafted Office file and convince a user to open it, resulting in code execution on the local machine. Exploitation requires no privileges but does require user interaction. The vulnerability is not publicly disclosed and is not currently exploited.
CVSS Score: 7.8
SEVERITY: Critical
THREAT:
Successful exploitation can allow an unauthorized attacker to execute code locally, with potentially high impact to confidentiality, integrity, and availability. The attack complexity is low and no privileges are required, although a targeted user must open a malicious Office file.
EXPLOITS:
The vulnerability is assessed as exploitation less likely. It is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, so confirmed public exploit or proof-of-concept code cannot be established from the source information.
TECHNICAL SUMMARY:
CVE-2026-63525 results from a numeric truncation error, identified as CWE-197, in Microsoft Office Word. The vulnerability can allow an unauthorized attacker to execute code locally. Although classified as remote code execution because the attacker may operate remotely, exploitation itself occurs on the victim’s local machine. An attacker must deliver a malicious Office file and persuade the user to open it. The Preview Pane is not an attack vector. The vulnerability has low attack complexity, requires no privileges, requires user interaction, and can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft Word 2016. Exploitation requires the victim to open a malicious Office file.
BUSINESS IMPACT:
Successful exploitation could expose sensitive information, allow unauthorized modification of data, and disrupt system availability. Because malicious code can execute without the attacker already having privileges, a successful document-based attack could create significant security and operational impact.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation path.
URGENCY:
This vulnerability is rated Critical and can lead to code execution with high confidentiality, integrity, and availability impact. Although it is not known to be exploited and exploitation is assessed as less likely, organizations should prioritize the official fix because exploitation requires no existing privileges and has low attack complexity.
CVE-2026-62824 – Remote Desktop Client Remote Code Execution Vulnerability
“A malicious Remote Desktop server could turn a single user connection into remote code execution on the client.”
A stack-based buffer overflow in Microsoft Remote Desktop Client could allow an unauthorized attacker to execute code over a network. An attacker could host a malicious server and convince a user on an affected client to connect to it. Processing the malicious server response can trigger the vulnerability and lead to code execution. The attack requires no privileges but does require user interaction.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
An attacker can use a malicious Remote Desktop server to target vulnerable clients over the network. Attack complexity is low, privileges are not required, and successful exploitation could have a high impact on confidentiality, integrity, and availability.
EXPLOITS:
The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is classified as unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
The vulnerability is caused by a stack-based buffer overflow (CWE-121) in the Remote Desktop Client. An attacker could operate a malicious server and convince a user with an affected client to connect to it. When the client processes the malicious server response, the buffer overflow can occur and allow the attacker to execute code on the client system. The attack is network-based, has low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can significantly affect the confidentiality, integrity, and availability of the affected system.
EXPLOITABILITY:
Affected products are Windows 10 Version 1607 for 32-bit and x64-based systems; Windows Server 2012 and Server Core; Windows Server 2012 R2 and Server Core; and Windows Server 2016 and Server Core. Exploitation requires a user to connect an affected Remote Desktop Client to an attacker-controlled malicious server.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on affected systems, creating risks to sensitive information, system integrity, and service availability. Compromise of business endpoints or servers could disrupt operations and expose systems to further attacker-controlled activity.
WORKAROUND:
No workaround or mitigation is identified. An official security fix is available, and installing the applicable update is the stated remediation.
URGENCY:
This vulnerability is rated Critical and can enable remote code execution with low attack complexity and no attacker privileges. Although exploitation is currently assessed as less likely and no exploitation is reported, affected systems should be prioritized for deployment of the official security update because successful exploitation could have high confidentiality, integrity, and availability impacts.
CVE-2026-64921 – Microsoft SharePoint Server Elevation of Privilege Vulnerability
“A low-complexity network attack could turn an authenticated domain account into SharePoint administrator access, putting sensitive data and server integrity at risk.”
CVE-2026-64921 is a critical elevation-of-privilege vulnerability in Microsoft SharePoint Server caused by missing authentication for a critical function. An authenticated attacker with domain access could exploit the issue over the network and execute code on the SharePoint server to elevate privileges to SharePoint administrator. Successful exploitation can result in high impact to confidentiality, integrity, and availability.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
The vulnerability has a network attack vector, low attack complexity, and requires low privileges with no user interaction. Successful exploitation could give an attacker SharePoint administrator privileges and lead to remote code execution on the SharePoint server.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and no confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.
TECHNICAL SUMMARY:
The vulnerability results from missing authentication for a critical function in Microsoft Office SharePoint. An authenticated attacker with access to the domain can target the SharePoint server over the network and perform remote code execution to elevate themselves to SharePoint administrator. Exploitation has low attack complexity, requires low privileges, and does not require user interaction. A successful attack can have high confidentiality, integrity, and availability impact while leaving the security scope unchanged.
EXPLOITABILITY:
Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition are affected. An authenticated attacker with domain access can exploit the vulnerability remotely over the network. Low privileges are required, but no user interaction is needed.
BUSINESS IMPACT:
Successful exploitation could allow an attacker to gain SharePoint administrator privileges and execute code on the SharePoint server. For organizations relying on SharePoint for business information and collaboration, this creates the potential for unauthorized access to sensitive information, modification of content, and disruption of SharePoint services.
WORKAROUND:
No workaround or mitigation is identified. Apply all applicable security updates for the installed SharePoint software. Where multiple updates apply, all offered updates should be installed.
URGENCY:
This vulnerability is rated Critical and can be exploited over the network with low attack complexity and no user interaction once an attacker has authenticated domain access. Organizations should prioritize deployment of the applicable Microsoft security updates to prevent privilege escalation and potential remote code execution on affected SharePoint servers.
CVE-2026-62823 – Windows DHCP Server Remote Code Execution Vulnerability
“A specially crafted network packet could turn a vulnerable DHCP service into a path for remote code execution.”
CVE-2026-62823 is a critical heap-based buffer overflow vulnerability in Windows DHCP Server. An unauthenticated attacker on an adjacent network can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack requires low complexity, no privileges, and no user interaction.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
An attacker with adjacent network access could target the Windows DHCP Server service with a malicious packet. Successful exploitation could compromise confidentiality, integrity, and availability, with each rated High in the CVSS metrics.
EXPLOITS:
This vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows DHCP Server. An unauthenticated attacker can send a specially crafted packet to an affected service over an adjacent network. Because attack complexity is Low and neither privileges nor user interaction are required, successful exploitation could allow the attacker to execute code on the target system. The vulnerability has High potential impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires an attacker to send a specially crafted packet from an adjacent network to an affected service.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized code execution on systems running the affected DHCP service. This creates the potential for system compromise, unauthorized access to sensitive information, modification of system resources, and disruption of service. Compromise of infrastructure providing DHCP services could also create significant operational risk.
WORKAROUND:
No mitigation or workaround is identified. An official fix is available, so affected systems should be updated where possible.
URGENCY:
This vulnerability is rated Critical and exploitation is assessed as More Likely. Its combination of low attack complexity, no required privileges, no user interaction, and potential remote code execution makes prompt deployment important, particularly on systems exposing affected DHCP services to adjacent networks.
CVE-2026-62818 – Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
“A crafted network request could turn authenticated access into remote code execution, putting critical Windows services and their data at risk.”
CVE-2026-62818 is a critical use-after-free vulnerability in Windows Active Directory Certificate Services (AD CS). An authenticated attacker with low privileges can send a specially crafted request to an affected service over the network and potentially execute code on the target system. Exploitation requires no user interaction and could have a high impact on confidentiality, integrity, and availability.
CVSS Score: 8.8
SEVERITY: Critical
THREAT:
The vulnerability presents a remote code execution threat to affected Windows systems running the vulnerable AD CS functionality. Attack complexity is low, and exploitation can occur over the network. An attacker must have authenticated low-privilege access, but no interaction from another user is required.
EXPLOITS:
The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as less likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.
TECHNICAL SUMMARY:
CVE-2026-62818 is caused by a use-after-free condition (CWE-416) in Active Directory Certificate Services. An authenticated attacker can send a specially crafted request to an affected service over the network. Successful exploitation could allow code execution on the target system. The vulnerability has low attack complexity, requires low privileges, requires no user interaction, and has an unchanged scope. Successful exploitation can have high confidentiality, integrity, and availability impact.
EXPLOITABILITY:
Affected software includes Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. An authenticated attacker with low privileges can exploit the vulnerability by sending a specially crafted network request to an affected service.
BUSINESS IMPACT:
Successful exploitation could allow an attacker to execute code on an affected system, potentially compromising sensitive information, modifying data, or disrupting system availability. For organizations operating AD CS on affected Windows infrastructure, compromise of a critical service could create significant operational and security consequences.
WORKAROUND:
No workaround or mitigation is specified. An official fix is available, making deployment of the applicable security update the documented remediation.
URGENCY:
This vulnerability is rated Critical and enables remote code execution with low attack complexity and no user interaction. Although exploitation is currently assessed as less likely and no active exploitation is identified, affected systems should be prioritized for patching because successful exploitation could have a high impact on confidentiality, integrity, and availability.
CVE-2026-62893 – Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
“A single malicious network packet could turn an exposed Windows Deployment Services server into a path for remote code execution.”
CVE-2026-62893 is a critical use-after-free vulnerability in Windows Deployment Services. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires low attack complexity, no privileges, and no user interaction, with successful exploitation carrying high confidentiality, integrity, and availability impact.
CVSS Score: 9.8
SEVERITY: Critical
THREAT:
The vulnerability creates a network-based remote code execution threat against affected Windows Deployment Services systems. Because exploitation requires neither authentication nor user interaction, a reachable vulnerable service could be attacked directly with a specially crafted network packet.
EXPLOITS:
The vulnerability is assessed as “Exploitation More Likely,” but it was not publicly disclosed and was not exploited at the time of publication. Exploit Code Maturity is listed as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
CVE-2026-62893 is caused by a use-after-free weakness (CWE-416) in Windows Deployment Services. The flaw involves improper use of memory after it has been freed. An unauthenticated remote attacker can target an affected service by sending a specially crafted packet over the network. The attack has low complexity and requires no privileges or user interaction. Successful exploitation can execute code on the target system and has a high potential impact on confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 Windows 10 editions. An attacker can exploit the flaw remotely by sending a specially crafted packet to an affected service.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution, creating the potential for serious compromise of affected Windows systems. The high confidentiality, integrity, and availability impacts mean an attack could expose sensitive information, alter system resources, or disrupt critical services. Systems running Windows Deployment Services can therefore represent a significant organizational risk when left unpatched.
WORKAROUND:
No workaround or mitigation is identified. An official fix is available, so affected systems should receive the applicable security update.
URGENCY:
This Critical vulnerability carries a CVSS base score of 9.8 and can be attacked remotely with low complexity, without privileges or user interaction. Although exploitation and public disclosure are both listed as No, exploitation is assessed as more likely. Prompt deployment is important because successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impact.
CVE-2026-71331 – Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
“A specially crafted network packet could turn a memory corruption flaw into remote code execution, putting affected Windows systems at serious risk.”
CVE-2026-71331 is a critical remote code execution vulnerability in Windows Device Health Attestation (DHA). The vulnerability involves integer overflow or wraparound and heap-based buffer overflow weaknesses. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires no privileges or user interaction, although the attack complexity is rated High.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
The vulnerability can be attacked remotely over a network and could result in high confidentiality, integrity, and availability impact. Successful exploitation could allow an unauthenticated attacker to execute code on the targeted system. Attack complexity is High, meaning exploitation depends on a combination of factors and requires a deep understanding of the system.
EXPLOITS:
The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is rated Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.
TECHNICAL SUMMARY:
The vulnerability is associated with CWE-190 Integer Overflow or Wraparound and CWE-122 Heap-based Buffer Overflow weaknesses in Windows Device Health Attestation. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Successful exploitation could lead to remote code execution on the target system, with potentially high impact to confidentiality, integrity, and availability. No privileges or user interaction are required. However, exploitation has High attack complexity, is not guaranteed, and can depend on the environment, system configuration, and additional security measures.
EXPLOITABILITY:
Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted network packet to an affected service.
BUSINESS IMPACT:
Successful exploitation could allow remote code execution and potentially compromise sensitive information, system integrity, and service availability. For organizations operating affected Windows servers or endpoints, a successful attack could lead to system compromise and disruption of business services.
WORKAROUND:
No workaround or mitigation is specified. An official fix is identified, so affected systems should be updated using the applicable security update.
URGENCY:
This vulnerability is rated Critical and can enable remote code execution without authentication or user interaction. Although exploitation is considered less likely and attack complexity is High, the potential impact across confidentiality, integrity, and availability makes prompt deployment important.
CVE-2026-66802 – Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
“A specially crafted network packet could turn a race condition into remote code execution, with no authentication or user action required.”
CVE-2026-66802 is a critical remote code execution vulnerability affecting Microsoft Azure Attestation service and Device Health Attestation Service. Improper synchronization of a shared resource can create a race condition leading to a use-after-free condition. An unauthenticated remote attacker who successfully wins the race condition could execute code on the target system.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
The vulnerability is remotely reachable over the network and can affect confidentiality, integrity, and availability at a high level. Exploitation requires high attack complexity because an attacker must successfully win a race condition, but no privileges, authentication, or user interaction are required.
EXPLOITS:
This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed.
TECHNICAL SUMMARY:
The vulnerability results from concurrent execution using a shared resource without proper synchronization, identified as a race condition and use-after-free weakness (CWE-362 and CWE-416). An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Successful exploitation depends on winning the race condition and could result in arbitrary code execution on the target system. The CVSS metrics indicate network-based attack access, high attack complexity, no required privileges, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts.
EXPLOITABILITY:
Affected products include Windows 10 Version 1809 (32-bit and x64), Windows 11 Version 26H1 (ARM64 and x64), Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. An unauthenticated attacker could exploit the issue remotely with a specially crafted network packet but must successfully win a race condition.
BUSINESS IMPACT:
Successful exploitation could allow unauthorized remote code execution and cause serious compromise of affected systems. Because confidentiality, integrity, and availability impacts are all rated High, successful attacks could expose sensitive information, alter system resources, or disrupt affected services. “No login and no user click means the vulnerable service itself is the attack surface.”
WORKAROUND:
No mitigations or workarounds are specified. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and permits network-based remote code execution without privileges or user interaction. Although exploitation is assessed as Less Likely and is not reported as occurring, affected systems should be prioritized for deployment of the official fix because successful exploitation could have high confidentiality, integrity, and availability impacts.
CVE-2026-65789 – Windows DNS Server Remote Code Execution Vulnerability
“A specially crafted network packet could turn a DNS service flaw into remote code execution, with no authentication or user action required.”
CVE-2026-65789 is a critical use-after-free vulnerability (CWE-416) in Windows DNS that can allow an unauthenticated attacker to execute code remotely. Exploitation requires specific network configurations and timing conditions, making attacks more difficult and less reliable. The vulnerability is not publicly disclosed or known to be exploited.
CVSS Score: 8.1
SEVERITY: Critical
THREAT:
An attacker with network access to an affected DNS service could send a specially crafted packet and potentially achieve remote code execution. No privileges or user interaction are required, although successful exploitation depends on specific conditions and has only been observed in limited scenarios.
EXPLOITS:
No exploitation has been reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven, and exploitation is assessed as unlikely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.
TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free memory condition in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network. If the required network configuration and timing conditions are met, successful exploitation can allow code execution on the target system. The CVSS metrics indicate network-based attack access, high attack complexity, no privileges required, no user interaction, unchanged scope, and high potential impact to confidentiality, integrity, and availability.
EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809 for 32-bit and x64 systems, Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires a specially crafted network packet and specific configuration and timing conditions.
BUSINESS IMPACT:
Successful exploitation could give an unauthenticated attacker the ability to execute code on an affected system, potentially causing serious confidentiality, integrity, and availability impacts. For organizations operating affected DNS services, compromise of infrastructure providing a core network function could create significant operational and security risk.
WORKAROUND:
No workaround or mitigation is listed. An official fix is identified as the remediation.
URGENCY:
This vulnerability is rated Critical and can result in remote code execution without authentication or user interaction. Although exploitation is assessed as unlikely and requires favorable conditions, the potential impact is high across confidentiality, integrity, and availability. Organizations running the affected Windows versions should prioritize deployment of the official fix.
