Patch Tuesday July 2026

Patch Tuesday July 2026 Updates – Vulnerability Digest from Action1

This digest explains the most serious vulnerabilities in popular Windows software that have been patched over the past month.

Microsoft Vulnerabilities

Microsoft’s July 2026 Patch Tuesday delivers fixes for a staggering 570 vulnerabilities, including 61 critical flaws and three zero-days. Microsoft has warned that organizations should expect security updates to become more frequent as the company expands its use of AI to uncover vulnerabilities and accelerate patch development, while continuing to rely on human engineers for final validation and release decisions.

For defenders, this means the challenge is no longer just keeping up with attackers, but also keeping pace with an accelerating stream of security fixes.

Critical or Zero Day – Immediate DeploymentCVE-2026-50661 – Windows BitLocker Security Feature Bypass Vulnerability

“Encryption only protects data when its defenses remain intact. A single security bypass can turn a stolen device into a source of exposed business information.”

A protection mechanism failure in Microsoft Windows BitLocker allows an unauthorized attacker with physical access to a device to bypass the BitLocker Device Encryption security feature. If successfully exploited, the vulnerability could allow access to data stored on encrypted system drives, reducing the protection that BitLocker is designed to provide. Microsoft has classified this issue as requiring customer action and has released security updates for affected Windows client and server platforms.

CVSS Score: 6.1

SEVERITY: Important

THREAT:

This vulnerability targets Windows BitLocker, Microsoft’s full-disk encryption feature. An attacker who gains physical possession of a vulnerable system may be able to bypass BitLocker protection and access encrypted data. Although the attack requires physical access, the potential exposure of sensitive corporate or personal information makes this a significant security concern, particularly for lost, stolen, or unattended devices.

EXPLOITS:

At the time of publication, the vulnerability has been publicly disclosed but has not been reported as exploited. Microsoft rates exploitation as less likely, and there is no confirmed public proof-of-concept or zero-day exploitation documented in the provided information.

TECHNICAL SUMMARY:

The vulnerability is caused by a protection mechanism failure (CWE-693) within Windows BitLocker. Instead of compromising encryption algorithms directly, the flaw allows an attacker with physical access to bypass the BitLocker Device Encryption feature protecting the system storage device. Successful exploitation can result in unauthorized access to encrypted information stored on the affected system. The vulnerability does not impact system availability but has a high impact on both confidentiality and integrity of protected data.

EXPLOITABILITY:

Affected products include multiple supported versions of Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including applicable Server Core installations listed in Microsoft’s advisory. Exploitation requires physical access to the target device and does not require user interaction or privileges.

BUSINESS IMPACT:

Organizations relying on BitLocker to protect sensitive information on laptops, desktops, and servers face an increased risk if devices are lost, stolen, or accessed by unauthorized individuals. A successful attack could expose confidential business data, regulated information, intellectual property, or credentials that organizations expect to remain protected by disk encryption. Systems deployed in remote locations or shared environments may be particularly vulnerable.

WORKAROUND:

No mitigations or workarounds are available. Microsoft has published security updates to address the vulnerability, and applying the appropriate update is the recommended remediation.

Critical or Zero Day – Immediate DeploymentCVE-2026-56155 – Active Directory Federation Services Elevation of Privilege Vulnerability

“When attackers turn ordinary user access into administrator control, a single compromised account can become the key to the entire environment.”

An insufficient granularity of access control vulnerability in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally. A successful attack could grant administrator privileges, enabling an attacker to gain complete control over the affected system. Microsoft has confirmed active exploitation of this vulnerability and released security updates for affected Windows client and server platforms.

CVSS Score: 7.8

SEVERITY: Important

THREAT:

This vulnerability affects Active Directory Federation Services by allowing a locally authenticated attacker with low privileges to elevate their permissions to administrator level. Once elevated, an attacker could execute privileged commands, modify system settings, install malicious software, create additional administrative accounts, or disable security controls. Because AD FS is commonly used for identity and authentication services, successful exploitation can have significant security implications.

EXPLOITS:

Microsoft confirms that active exploitation has been detected. The vulnerability was not publicly disclosed before the security update, but attackers are known to be exploiting it in the wild. The provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by insufficient granularity of access control (CWE-1220) within Active Directory Federation Services. Improper enforcement of authorization boundaries allows an authenticated local attacker with low privileges to gain administrator privileges. The vulnerability impacts the confidentiality, integrity, and availability of affected systems, giving an attacker broad control once exploitation is successful.

EXPLOITABILITY:

Affected products include Windows 10 Version 1607 and Version 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including applicable Server Core installations listed in Microsoft’s advisory. Exploitation requires local access and a low-privileged authenticated account but does not require user interaction.

BUSINESS IMPACT:

Privilege escalation vulnerabilities pose a serious risk because they allow attackers who have already gained limited access to take complete control of affected systems. In environments using AD FS for authentication and identity services, administrator-level compromise can lead to unauthorized access to sensitive business resources, disruption of critical services, deployment of ransomware, theft of credentials, and broader compromise of enterprise infrastructure.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends deploying the appropriate security updates to eliminate the vulnerability.

URGENCY:

This vulnerability should be prioritized because Microsoft has confirmed active exploitation in the wild. Although local access is required, attackers who obtain an initial foothold can use this flaw to gain administrator privileges and significantly expand their control over affected systems. Organizations should prioritize patching AD FS servers and other affected systems that are accessible by users or administrators.

Critical or Zero Day – Immediate DeploymentCVE-2026-56164 – Microsoft SharePoint Server Elevation of Privilege Vulnerability

“An internet-facing server without proper authentication can give attackers an open door where there should only be a locked gate.”

A missing authentication vulnerability in Microsoft SharePoint Server allows an unauthorized attacker to elevate privileges over the network. Because the flaw is remotely exploitable without requiring authentication or user interaction, attackers can target vulnerable SharePoint servers directly. Microsoft has confirmed active exploitation of this vulnerability and has released security updates for affected SharePoint versions.

CVSS Score: 5.3

SEVERITY: Moderate

THREAT:

This vulnerability affects Microsoft SharePoint Server by allowing an unauthenticated attacker to perform privilege escalation over the network. The flaw stems from missing authentication for a critical function, enabling an attacker to reach functionality that should require authorization. Internet-facing SharePoint servers are particularly exposed because the attack can be performed remotely without valid credentials.

EXPLOITS:

Microsoft confirms that active exploitation has been detected. The vulnerability was not publicly disclosed before the security update. The CVSS v3.1 temporal metrics indicate Functional exploit code maturity, demonstrating that working exploit code exists. The provided information does not specifically confirm publicly available proof-of-concept code.

TECHNICAL SUMMARY:

The vulnerability is caused by missing authentication for a critical function (CWE-306) within Microsoft SharePoint Server. An attacker can send specially crafted network requests to access functionality that should require authentication, resulting in privilege escalation. The vulnerability primarily impacts system integrity by allowing unauthorized actions without requiring prior authentication or user interaction.

EXPLOITABILITY:

Affected products include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. The vulnerability is remotely exploitable over the network with no privileges required and no user interaction, making internet-accessible SharePoint deployments the highest priority for remediation.

BUSINESS IMPACT:

Organizations using SharePoint for document management, collaboration, and business workflows face increased risk if vulnerable servers are exposed. Successful exploitation could allow attackers to gain elevated privileges, modify SharePoint content, compromise collaboration environments, and establish a foothold for further attacks against enterprise infrastructure. Since SharePoint often stores sensitive corporate information, compromise of these systems can have significant operational and security consequences.

WORKAROUND:

No workaround is available. Microsoft recommends installing the appropriate security updates. As an additional mitigation, organizations should enable Antimalware Scan Interface (AMSI) integration and configure Request Body Scan mode to Full to improve detection of malicious SharePoint requests until updates are fully deployed.

URGENCY:

This vulnerability should be prioritized because Microsoft has confirmed active exploitation in the wild. The combination of remote network access, no authentication requirement, no user interaction, and functional exploit code significantly lowers the barrier to successful attacks. Organizations with internet-facing SharePoint servers should deploy the security updates as soon as possible.

Critical or Zero Day – Immediate DeploymentCVE-2026-49164 – Windows Active Directory Domain Services Remote Code Execution Vulnerability

“When attackers can target the heart of identity management, the entire enterprise is placed at risk.”

A heap-based buffer overflow vulnerability in Windows Active Directory Domain Services (AD DS) allows an unauthorized attacker to execute arbitrary code over the network. Although successful exploitation requires a high level of attack complexity, no authentication or user interaction is required. Microsoft has released security updates to address this vulnerability across affected Windows client and server platforms.

CVSS Score: 8.1

SEVERITY: Critical

THREAT:

This vulnerability affects Windows Active Directory Domain Services, a core component of enterprise identity and authentication. An attacker can exploit a heap-based buffer overflow to execute arbitrary code remotely over the network without requiring authentication. If successfully exploited, the vulnerability could allow complete compromise of the affected system, making domain infrastructure a high-value target.

EXPLOITS:

At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as unlikely due to the high attack complexity required. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Active Directory Domain Services. By sending specially crafted network requests, an attacker may trigger memory corruption that leads to arbitrary code execution. Although exploitation requires additional preparation of the target environment, as reflected by the High attack complexity rating, successful exploitation can result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:

Affected products include Windows 10 Versions 1607, 1809, 21H2, and 22H2, Windows 11 Versions 24H2, 25H2, and 26H1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations. Exploitation is performed over the network and requires no privileges and no user interaction, but does require additional preparation of the target environment.

BUSINESS IMPACT:

Active Directory Domain Services is central to authentication and access control in Windows environments. A successful remote code execution attack against AD DS could allow attackers to compromise identity infrastructure, execute malicious code, disrupt authentication services, steal sensitive information, and potentially gain control over critical enterprise resources. Organizations should treat vulnerabilities affecting domain services as high priority because of their potential to impact the entire network.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends deploying the appropriate security updates to all affected systems.

URGENCY:

This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 base score of 8.1. While Microsoft considers exploitation unlikely due to the high attack complexity, the vulnerability allows unauthenticated remote code execution against Active Directory Domain Services. Prompt patching is recommended to protect one of the most critical components of enterprise infrastructure.

Critical or Zero Day – Immediate DeploymentCVE-2026-48561 – Microsoft Copilot Remote Code Execution Vulnerability

“AI assistants are becoming trusted productivity tools, but a single unchecked request can turn that trust into an opportunity for attackers.”

A command injection vulnerability in Microsoft Copilot allows an unauthorized attacker to execute code over the network. An attacker can exploit the flaw by hosting a malicious website that causes Microsoft Edge for Android to automatically send crafted prompts to Copilot when a user visits the site. Because the affected component processes these requests without confirmation or origin validation, unintended actions may occur without the user’s awareness. Microsoft has released security updates for the affected Copilot applications.

CVSS Score: 9.6

SEVERITY: Critical

THREAT:

This vulnerability affects Microsoft Copilot by allowing command injection through specially crafted prompts delivered over the network. An attacker does not require privileges and can trigger the attack by enticing a user to visit a malicious website. The affected component may process attacker-controlled prompts without validating their origin or requesting user confirmation, potentially allowing code execution and unauthorized actions. The vulnerability also has a Scope: Changed rating, indicating that successful exploitation can impact resources beyond the originally vulnerable component.

EXPLOITS:

At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by improper neutralization of special elements used in a command (CWE-77), resulting in a command injection flaw within Microsoft Copilot. According to Microsoft, an attacker can host a malicious website that causes Microsoft Edge for Android to automatically submit crafted prompts to Copilot. Because these requests are processed without adequate confirmation or origin checks, Copilot may execute unintended actions such as accessing or modifying data. Microsoft also notes that the Changed scope reflects that successful exploitation can cross a security boundary, allowing impacts beyond the vulnerable component.

EXPLOITABILITY:

Affected products include Microsoft 365 Copilot for Android and Microsoft 365 Copilot for iOS. Exploitation is performed over the network, requires no privileges, and requires user interaction, specifically a user visiting a malicious website. The attack has low complexity, making exploitation straightforward once the user interaction occurs.

BUSINESS IMPACT:

As AI assistants become integrated into daily business workflows, vulnerabilities affecting them can expose sensitive corporate information and automate malicious actions. Successful exploitation could allow attackers to execute code, manipulate data processed by Copilot, and potentially affect systems beyond the initial target because of the scope change. Organizations using Microsoft Copilot should prioritize remediation to reduce the risk of compromise through malicious web content.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends installing the available security updates for affected Microsoft 365 Copilot applications.

URGENCY:

This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 base score of 9.6, one of the highest severity ratings. Although Microsoft has not observed active exploitation, the combination of network-based attack capability, no privileges required, low attack complexity, and the potential to cross security boundaries makes this a high-priority update for organizations using Microsoft 365 Copilot.

Critical or Zero Day – Immediate DeploymentCVE-2026-55012 – Microsoft Defender Remote Code Execution Vulnerability

“Security software should stop attacks—not become another path attackers can use to compromise a system.”

An integer overflow and heap-based buffer overflow vulnerability in the Microsoft Malware Protection Engine allows an unauthorized attacker to execute code locally. Although the CVE is classified as a Remote Code Execution vulnerability, the attack itself is carried out locally after a user interacts with malicious content. Microsoft has released an official fix for the affected Microsoft Malware Protection Engine.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:

This vulnerability affects the Microsoft Malware Protection Engine used by Microsoft Defender. By exploiting integer overflow and heap-based buffer overflow conditions, an attacker can execute arbitrary code on a target system. The attack requires no privileges but does require user interaction, such as convincing a user to download and open specially crafted malicious content. Successful exploitation allows code execution with the privileges of the current user.

EXPLOITS:

At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by integer overflow or wraparound (CWE-190) and heap-based buffer overflow (CWE-122) within the Microsoft Malware Protection Engine. An attacker can trigger these memory handling flaws using specially crafted malicious content, resulting in arbitrary code execution. Although the vulnerability is categorized as Remote Code Execution, Microsoft clarifies that the attack is executed locally after user interaction, such as opening a malicious file obtained through social engineering.

EXPLOITABILITY:

The affected product is the Microsoft Malware Protection Engine. Exploitation requires no privileges but does require user interaction, typically involving a user opening specially crafted malicious content. The attack has low complexity and executes locally on the affected system.

BUSINESS IMPACT:

Microsoft Defender is a widely deployed security component across enterprise environments. A successful attack against the malware protection engine could allow attackers to execute malicious code, compromise endpoints, install additional malware, steal sensitive information, or use the affected device as a launching point for further attacks. Because security software is a trusted component, vulnerabilities within it require prompt attention.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends applying the official fix for the Microsoft Malware Protection Engine.

URGENCY:

This vulnerability should be deployed urgently because it is rated Critical and affects the Microsoft Malware Protection Engine, a core security component used to protect Windows systems. Although Microsoft has not observed active exploitation and user interaction is required, successful exploitation could allow arbitrary code execution on protected endpoints. Prompt deployment of the official fix reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55011 – Microsoft Defender Remote Code Execution Vulnerability

“Security tools are trusted to stop attacks, but vulnerabilities within those tools can give attackers an unexpected advantage.”

An integer underflow vulnerability in the Microsoft Malware Protection Engine allows an unauthorized attacker to execute code locally. Although the CVE is classified as a Remote Code Execution vulnerability, the attack itself occurs locally after a user interacts with malicious content. Microsoft has released an official fix for the affected Microsoft Malware Protection Engine.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:

This vulnerability affects the Microsoft Malware Protection Engine used by Microsoft Defender. By exploiting an integer underflow condition, an attacker can trigger memory handling errors that may result in arbitrary code execution. The attack requires no privileges but does require user interaction, typically by convincing a user to open specially crafted malicious content. Successful exploitation allows code execution with the privileges of the current user.

EXPLOITS:

At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by an integer underflow (wrap or wraparound) (CWE-191) within the Microsoft Malware Protection Engine. Improper handling of numeric values can lead to unexpected memory operations that allow arbitrary code execution. Microsoft notes that although the vulnerability is categorized as Remote Code Execution, the attack is executed locally after user interaction, such as opening a specially crafted malicious file delivered through social engineering.

EXPLOITABILITY:

The affected product is the Microsoft Malware Protection Engine. Exploitation requires no privileges but does require user interaction, typically involving a user opening specially crafted malicious content. The attack has low complexity and executes locally on the affected system.

BUSINESS IMPACT:

Microsoft Defender is a core security component used across enterprise environments. A successful attack against the malware protection engine could allow attackers to execute malicious code, compromise endpoints, install malware, steal sensitive information, or establish persistence for further attacks. Because organizations rely on Defender as a primary layer of endpoint protection, vulnerabilities affecting its protection engine should be addressed promptly.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends applying the official fix for the Microsoft Malware Protection Engine.

URGENCY:

This vulnerability should be deployed urgently because it is rated Critical and affects the Microsoft Malware Protection Engine, a key security component protecting Windows systems. Although Microsoft has not observed active exploitation and user interaction is required, successful exploitation could result in arbitrary code execution on protected endpoints. Prompt deployment of the official fix is recommended.

Critical or Zero Day – Immediate DeploymentCVE-2026-55944 – Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

“A server that accepts untrusted data without proper validation can give attackers complete control without ever asking for credentials.”

A deserialization of untrusted data vulnerability in Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) allows an unauthorized attacker to execute arbitrary code over the network. An attacker can exploit the vulnerability by sending a specially crafted login request to an affected server. The attack requires no authentication and no user interaction, making it a significant risk for exposed systems. Microsoft has released an official fix for affected deployments.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:

This vulnerability affects Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises). An unauthenticated attacker can send a specially crafted login request to a vulnerable server and execute arbitrary code remotely. Because the attack is performed over the network with no privileges or user interaction required, internet-facing or otherwise accessible servers are at the greatest risk.

EXPLOITS:

At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:

The vulnerability is caused by deserialization of untrusted data (CWE-502) within Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises). By sending a specially crafted login request, an attacker can trigger insecure deserialization, resulting in arbitrary code execution on the target server. Successful exploitation can fully compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY:

The confirmed affected product is Microsoft Dynamics NAV 2018. Microsoft states the vulnerability also affects Microsoft Dynamics 365 Business Central (On Premises), although the affected software table in the provided information confirms only Microsoft Dynamics NAV 2018. Exploitation is performed over the network, requires no privileges, no user interaction, and can be carried out by sending a specially crafted login request to the vulnerable server.

BUSINESS IMPACT:

Microsoft Dynamics platforms frequently manage financial records, customer information, inventory, and other business-critical data. Successful exploitation could allow attackers to gain complete control of an affected server, steal or manipulate sensitive business information, disrupt operations, deploy ransomware, and use the compromised server as a pivot point for attacks against other enterprise systems.

WORKAROUND:

No mitigations or workarounds are available. Microsoft recommends installing the official security update for affected systems.

URGENCY:

This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 base score of 9.8, the highest severity range. The attack can be performed remotely over the network without authentication or user interaction, and Microsoft assesses exploitation as more likely. Organizations running affected Dynamics environments should prioritize deployment of the security update to reduce the risk of complete server compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55008 – Microsoft Exchange Server Spoofing Vulnerability

“A single malicious email can become far more dangerous when trusted webmail sessions execute attacker-controlled code.”

A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over the network. An attacker can send a specially crafted email that, if opened in Outlook Web Access (OWA) and certain conditions are met, causes arbitrary JavaScript to execute within the user’s browser session. Microsoft has released security updates for supported Exchange Server versions.

CVSS Score: 9.6

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Exchange Server by allowing an attacker to exploit improper neutralization of web page input. A specially crafted email can trigger JavaScript execution when viewed through Outlook Web Access, enabling spoofing attacks within the user’s browser context. Because the vulnerability has a Changed scope, successful exploitation can affect resources beyond the vulnerable component, increasing the overall security impact.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by improper neutralization of input during web page generation (Cross-site Scripting) (CWE-79) in Microsoft Exchange Server. An attacker can send a specially crafted malicious email that, when opened in Outlook Web Access, causes arbitrary JavaScript to execute within the browser context if certain conditions are met. This can enable spoofing attacks and compromise the confidentiality, integrity, and availability of affected sessions. The Changed scope indicates that successful exploitation can impact resources outside the original security boundary.

EXPLOITABILITY:
Affected products include Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Updates 14 and 15, and Microsoft Exchange Server Subscription Edition RTM. Exploitation is performed over the network, requires no attacker privileges, but does require user interaction, specifically opening a specially crafted email in Outlook Web Access.

BUSINESS IMPACT:
Microsoft Exchange Server is a critical communication platform in many organizations. Successful exploitation could allow attackers to impersonate trusted content, execute malicious JavaScript within user sessions, access sensitive information, manipulate webmail interactions, and potentially facilitate additional attacks against users and enterprise systems. Organizations with internet-accessible Outlook Web Access deployments should prioritize remediation.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for affected Exchange Server versions.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 base score of 9.6. Although Microsoft has not detected active exploitation, it assesses exploitation as more likely. The combination of network-based exploitation, high potential impact, and the widespread use of Exchange Server makes prompt patching essential.

Critical or Zero Day – Immediate DeploymentCVE-2026-55022 – Microsoft Office Remote Code Execution Vulnerability

“One malicious Office document can be enough to turn an everyday business task into a serious security incident.”

A type confusion vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office file. An attacker can distribute the malicious document through email, file-sharing services, or other delivery methods and convince a user to open or preview it. Because the Preview Pane is also an attack vector, users may be exposed while previewing malicious files. Successful exploitation allows the attacker to execute code with the privileges of the current user.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by type confusion (CWE-843) within Microsoft Office. Improper handling of object types can lead to memory corruption when processing a specially crafted Office document. An attacker can exploit this flaw to execute arbitrary code on the target system. Although the CVE is classified as a Remote Code Execution vulnerability, Microsoft clarifies that the attack itself is executed locally after user interaction, such as opening or previewing a malicious Office file.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office is one of the most widely used business applications and remains a common target for phishing and document-based attacks. Successful exploitation could allow attackers to install malware, steal sensitive information, deploy ransomware, or establish a foothold for lateral movement within the enterprise. Organizations that frequently exchange Office documents with external parties face increased exposure.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical and affects one of the most commonly used productivity platforms in enterprise environments. While Microsoft has not observed active exploitation and user interaction is required, Office documents remain a primary delivery method for phishing and malware campaigns. Prompt deployment of security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55049 – Microsoft Office Remote Code Execution Vulnerability

“A single malicious Office document can turn a routine task into a full system compromise if security updates are missing.”

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office file. Although the vulnerability is classified as Remote Code Execution, Microsoft clarifies that the attack itself is carried out locally after user interaction. Microsoft has released an official fix for the affected Microsoft Office product.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office document. An attacker can distribute the malicious file through email, file-sharing services, or other delivery methods and persuade a user to open it. Once opened, the vulnerability can be triggered, allowing the attacker to execute code with the privileges of the current user.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office. A specially crafted Office file can trigger memory corruption, allowing arbitrary code execution on the affected system. Microsoft notes that although the vulnerability is categorized as Remote Code Execution, the attack itself is executed locally after a user opens the malicious document. Successful exploitation can result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
The confirmed affected product is Microsoft Office 365 for Mac. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted Office file. The attack has low complexity and is carried out locally after the malicious document is opened.

BUSINESS IMPACT:
Office applications remain one of the most common targets for phishing and document-based attacks. Successful exploitation could allow attackers to execute malicious code, steal sensitive information, deploy malware, or establish persistence on affected systems. Organizations using Microsoft Office on macOS should ensure updates are applied promptly to reduce the risk of compromise through malicious documents.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the official security update for the affected Microsoft Office product.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical and affects Microsoft Office, one of the most widely used productivity platforms. Although Microsoft has not observed active exploitation and user interaction is required, malicious Office documents remain a common attack vector. Prompt installation of the security update helps prevent successful compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55045 – Microsoft Office Remote Code Execution Vulnerability

“A malicious document doesn’t have to look suspicious to become the starting point of a serious security breach.”

An out-of-bounds read vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Although the vulnerability is classified as Remote Code Execution, Microsoft explains that the attack itself is carried out locally. Microsoft also confirms that the Preview Pane is an attack vector. Security updates have been released for affected Microsoft Office and Microsoft SharePoint products.

CVSS Score: 8.4

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office and Microsoft SharePoint through an out-of-bounds read flaw that can result in arbitrary code execution. Successful exploitation could allow an attacker to run malicious code with the privileges of the affected process, potentially leading to compromise of sensitive information, installation of malware, or further attacks against the environment. Microsoft advises installing all applicable updates for affected software where multiple update packages are offered.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by an out-of-bounds read (CWE-125) in Microsoft Office. Improper memory access can allow an attacker to execute arbitrary code on the affected system. Microsoft states that although the vulnerability is categorized as Remote Code Execution, the attack itself is executed locally. Microsoft also confirms that the Preview Pane is an attack vector, and customers should install all applicable security updates when multiple update packages are listed for affected products.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. The provided CVSS v3.1 metrics indicate no privileges required and no user interaction. Microsoft also states that the Preview Pane is an attack vector and that users may be convinced to open a malicious Office file. For Microsoft Office 2019 (32-bit and 64-bit editions), the affected software table lists the CVSS score set as N/A, while the overall CVSS:3.1 highest base score for this CVE is 8.4.

BUSINESS IMPACT:
Microsoft Office and SharePoint are widely used to create, store, and share business information. Successful exploitation could allow attackers to execute malicious code, compromise endpoints or collaboration servers, steal sensitive information, deploy malware, or establish a foothold for broader attacks across the enterprise. Organizations using both Office and SharePoint should ensure all applicable updates are deployed.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing all applicable security updates for the affected Office and SharePoint products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 base score of 8.4. Although Microsoft has not observed active exploitation, the vulnerability affects widely deployed Office and SharePoint products and can result in arbitrary code execution. Organizations should prioritize installing every applicable update package listed for affected software.

Critical or Zero Day – Immediate DeploymentCVE-2026-50314 – Microsoft Office Remote Code Execution Vulnerability

“A document that appears harmless can become a powerful attack tool when memory corruption vulnerabilities are left unpatched.”

A use-after-free vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office file, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office document. An attacker can distribute the malicious file through phishing emails, file-sharing platforms, or other delivery methods and convince a user to open or preview it. Because the Preview Pane is also an attack vector, users may be exposed without fully opening the document. Successful exploitation allows the attacker to execute code with the privileges of the current user.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free (CWE-416) memory management flaw in Microsoft Office. An attacker can craft a malicious Office document that triggers access to memory after it has been freed, resulting in memory corruption and arbitrary code execution. Although Microsoft classifies the issue as a Remote Code Execution vulnerability, the attack itself is executed locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector, meaning specially crafted documents may trigger the vulnerability during preview.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office remains one of the primary entry points for phishing and malware campaigns. Successful exploitation could allow attackers to execute malicious code, install ransomware, steal sensitive business information, establish persistence on endpoints, or use compromised systems as a foothold for further attacks. Organizations that frequently exchange Office documents with external users should prioritize remediation.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical and affects one of the most widely used productivity platforms in enterprise environments. Although Microsoft has not observed active exploitation and rates exploitation as less likely, Office documents remain a common delivery mechanism for cyberattacks. Prompt installation of security updates significantly reduces the risk of document-based compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55129 – Microsoft Office Remote Code Execution Vulnerability

“One malicious Office document can be all an attacker needs to turn everyday productivity into a serious security incident.”

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office file. An attacker can distribute the malicious document through email, file-sharing services, or other delivery methods and persuade a user to open or preview it. Once triggered, the attacker can execute code with the privileges of the current user, potentially leading to malware installation, data theft, or further compromise of the system.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office. A specially crafted Office document can trigger memory corruption, resulting in arbitrary code execution. Although the vulnerability is classified as Remote Code Execution, Microsoft explains that the attack itself is carried out locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector, increasing the potential exposure to malicious documents.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office remains one of the most frequently targeted applications in phishing and malware campaigns. Successful exploitation could allow attackers to execute malicious code, install ransomware, steal confidential information, or establish a foothold for additional attacks within the organization. Environments that regularly exchange Office documents with external parties are at increased risk.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although exploitation requires user interaction, Office documents continue to be one of the most common attack vectors used in phishing campaigns. Prompt deployment of the security updates significantly reduces the risk of document-based compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55140 – Microsoft Office Remote Code Execution Vulnerability

“A single Office document can become an attacker’s gateway into the business when critical security updates are delayed.”

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office document. An attacker can distribute the malicious file through email, collaboration platforms, or file-sharing services and persuade a user to open or preview it. Successful exploitation allows code execution with the privileges of the current user, potentially enabling malware installation, credential theft, or further compromise of the affected system.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office. A specially crafted Office document can trigger memory corruption, resulting in arbitrary code execution. Although the vulnerability is categorized as Remote Code Execution, Microsoft explains that the attack itself is carried out locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector. Where multiple update packages are available for affected products, Microsoft recommends installing all applicable updates, which may be applied in any order.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office is one of the most frequently targeted applications in phishing and document-based attacks. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal confidential information, or establish a foothold for additional attacks within the enterprise. Organizations that regularly exchange Office documents with external parties face increased exposure.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing all applicable security updates for affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, Office documents remain one of the most common delivery methods for malware and phishing campaigns. Prompt deployment of all applicable security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55056 – Microsoft Office Remote Code Execution Vulnerability

“One malicious Office document can turn an ordinary workday into a costly security incident if critical updates are delayed.”

A heap-based buffer overflow vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates are available for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:

This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office file. An attacker can distribute the malicious document through email, collaboration platforms, or file-sharing services and persuade a user to open or preview it. Successful exploitation allows code execution with the privileges of the current user, potentially enabling malware installation, credential theft, data compromise, or further attacks within the environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office. A specially crafted Office document can trigger memory corruption, resulting in arbitrary code execution. Although the vulnerability is categorized as Remote Code Execution, Microsoft explains that the attack itself is carried out locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector, increasing the exposure to malicious Office documents.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office remains one of the most frequently targeted applications in phishing and malware campaigns. Successful exploitation could allow attackers to execute malicious code, install ransomware, steal confidential information, or establish a foothold for lateral movement within the organization. Businesses that regularly exchange Office documents with external users are particularly exposed.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, Office documents remain one of the most common delivery methods for phishing and malware attacks. Prompt deployment of security updates significantly reduces the risk of document-based compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55018 – Microsoft Office Remote Code Execution Vulnerability

“A convincing Office document can become an attacker’s easiest route into an organization when critical vulnerabilities remain unpatched.”

A use-after-free vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document, and Microsoft confirms that the Preview Pane is also an attack vector. Security updates have been released for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Office by allowing arbitrary code execution through a specially crafted Office file. An attacker can deliver the malicious document through email, collaboration platforms, or file-sharing services and convince a user to open or preview it. Once exploited, the attacker can execute code with the privileges of the current user, potentially leading to malware installation, credential theft, or further compromise of the affected system.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free (CWE-416) memory management flaw in Microsoft Office. A specially crafted Office document can trigger memory corruption by accessing memory after it has been released, resulting in arbitrary code execution. Although the vulnerability is categorized as Remote Code Execution, Microsoft explains that the attack itself is carried out locally after user interaction. Microsoft also confirms that the Preview Pane is an attack vector, increasing the exposure to malicious Office documents.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening or previewing a specially crafted Office document.

BUSINESS IMPACT:
Microsoft Office continues to be one of the most frequently targeted applications in phishing and malware campaigns. Successful exploitation could allow attackers to execute malicious code, install ransomware, steal sensitive information, or establish a foothold for lateral movement within the organization. Businesses that routinely exchange Office documents with external parties face increased exposure.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, Office documents remain one of the most common delivery methods for phishing and malware attacks. Prompt deployment of security updates significantly reduces the risk of document-based compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-50467 – Microsoft Office Remote Code Execution Vulnerability

“A single malicious Office file can quietly become the starting point for a much larger security breach.”

A use-after-free vulnerability in Microsoft Office allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Office document. Microsoft has released security updates for affected Microsoft Office products across Windows and macOS.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code by persuading a user to open a specially crafted Office document. Malicious files can be delivered through phishing emails, collaboration platforms, or file-sharing services. If successful, the attacker can run code with the privileges of the current user, potentially leading to malware installation, credential theft, data compromise, or further attacks within the environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free (CWE-416) memory management flaw in Microsoft Office. A specially crafted Office document can trigger memory corruption by referencing memory after it has been released, allowing arbitrary code execution. Although categorized as a Remote Code Execution vulnerability, Microsoft explains that exploitation occurs locally after the victim opens the malicious document.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted Office document.

BUSINESS IMPACT:
Office documents remain one of the most common delivery methods for phishing and malware campaigns. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal sensitive business information, or establish persistence within the environment. Organizations that frequently exchange Office documents with external users face greater exposure.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. While user interaction is required, malicious Office documents continue to be a common attack vector. Prompt deployment of the available security updates helps reduce the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55041 – Microsoft Excel Remote Code Execution Vulnerability

“A single Excel spreadsheet can become the first step in a serious cyberattack when critical vulnerabilities remain unpatched.”

A heap-based buffer overflow vulnerability in Microsoft Excel allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted Excel file. Microsoft has released security updates for affected Excel and Office products.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code by convincing a user to open a specially crafted Excel workbook. Malicious spreadsheets can be distributed through phishing emails, file-sharing services, or collaboration platforms. If exploited, the attacker can execute code with the privileges of the current user, potentially resulting in malware installation, credential theft, or further compromise of the affected device.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Excel. A specially crafted Excel file can trigger memory corruption, allowing arbitrary code execution. Although categorized as a Remote Code Execution vulnerability, Microsoft explains that the attack itself is carried out locally after a user opens the malicious file.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Excel 2016 (32-bit and 64-bit), Microsoft Office 2019, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, and Office Online Server. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted Excel file.

BUSINESS IMPACT:
Excel files are commonly exchanged inside and outside organizations, making them a frequent target for phishing campaigns. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal sensitive business information, or establish a foothold for additional attacks across the network.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected Excel and Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, malicious spreadsheet attachments remain a common attack vector. Prompt deployment of the available security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55120 – Microsoft PowerPoint Remote Code Execution Vulnerability

“A single PowerPoint presentation can become the launch point for a serious cyberattack when critical security updates are delayed.”

A heap-based buffer overflow vulnerability in Microsoft PowerPoint allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted PowerPoint presentation. Microsoft has released security updates for affected PowerPoint and Microsoft Office products.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code by convincing a user to open a specially crafted PowerPoint presentation. Malicious presentation files can be delivered through phishing emails, file-sharing services, or collaboration platforms. If exploited, the attacker can execute code with the privileges of the current user, potentially leading to malware installation, credential theft, data compromise, or additional attacks within the environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft PowerPoint. A specially crafted presentation file can trigger memory corruption, allowing arbitrary code execution. Although categorized as a Remote Code Execution vulnerability, Microsoft explains that the attack itself is carried out locally after a user opens the malicious presentation.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft PowerPoint 2016 (32-bit and 64-bit), Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. For Microsoft Office LTSC 2021 and LTSC 2024, the affected software table lists the CVSS score set as N/A for those products. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted PowerPoint presentation.

BUSINESS IMPACT:
PowerPoint presentations are frequently exchanged for business communications, training, and external collaboration, making them an attractive delivery mechanism for phishing attacks. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal sensitive information, or establish persistence within the environment.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected PowerPoint and Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, malicious presentation files remain an effective delivery method for malware. Prompt deployment of the available security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55123 – Microsoft PowerPoint Remote Code Execution Vulnerability

“A single malicious presentation can give attackers an opening into the business if critical updates are delayed.”

A heap-based buffer overflow vulnerability in Microsoft PowerPoint allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted PowerPoint presentation. Microsoft has released security updates for affected PowerPoint and Microsoft Office products.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code by convincing a user to open a specially crafted PowerPoint presentation. Malicious presentation files can be distributed through phishing emails, file-sharing services, or collaboration platforms. If exploited, the attacker can execute code with the privileges of the current user, potentially resulting in malware installation, credential theft, data compromise, or additional attacks within the environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) and incorrect conversion between numeric types (CWE-681) in Microsoft PowerPoint. A specially crafted presentation can trigger memory corruption, allowing arbitrary code execution. Although categorized as a Remote Code Execution vulnerability, Microsoft explains that exploitation occurs locally after the victim opens the malicious presentation. Microsoft also confirms that the Preview Pane is not an attack vector for this vulnerability.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft PowerPoint 2016 (32-bit and 64-bit), Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. For Microsoft Office LTSC 2021 and LTSC 2024, the affected software table lists the CVSS score set as N/A for those products. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted PowerPoint presentation.

BUSINESS IMPACT:
PowerPoint presentations are commonly shared internally and externally, making them a practical vehicle for phishing campaigns. Successful exploitation could enable attackers to execute malicious code, deploy ransomware, steal sensitive information, or establish a foothold for additional attacks within the organization.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected PowerPoint and Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, presentation files remain a common method for delivering malicious content. Prompt deployment of the available security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-55043 – Microsoft PowerPoint Remote Code Execution Vulnerability

“One malicious presentation can quietly become the first step toward a much larger security breach.”

A heap-based buffer overflow vulnerability in Microsoft PowerPoint allows an unauthorized attacker to execute arbitrary code on a local system. Successful exploitation requires a user to open a specially crafted PowerPoint presentation. Microsoft has released security updates for affected PowerPoint and Microsoft Office products.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code by convincing a user to open a specially crafted PowerPoint presentation. Malicious presentation files can be delivered through phishing emails, collaboration platforms, or file-sharing services. If exploited, the attacker can execute code with the privileges of the current user, potentially leading to malware installation, credential theft, data compromise, or further attacks within the environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) and integer overflow or wraparound (CWE-190) in Microsoft PowerPoint. A specially crafted presentation file can trigger memory corruption through improper numeric value handling, allowing arbitrary code execution. Although categorized as a Remote Code Execution vulnerability, Microsoft explains that exploitation occurs locally after the victim opens the malicious presentation.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft PowerPoint 2016 (32-bit and 64-bit), Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. For Microsoft Office LTSC 2021 and LTSC 2024, the affected software table lists the CVSS score set as N/A for those products. Exploitation requires no attacker privileges but does require user interaction, specifically opening a specially crafted PowerPoint presentation.

BUSINESS IMPACT:
PowerPoint presentations are widely used for business communication and are frequently exchanged with external parties. Successful exploitation could allow attackers to execute malicious code, deploy ransomware, steal confidential information, or establish a foothold for additional attacks within the organization.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected PowerPoint and Microsoft Office products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical. Although user interaction is required, presentation files remain a common delivery method for phishing and malware campaigns. Prompt deployment of the available security updates significantly reduces the risk of compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-58644 – Microsoft SharePoint Remote Code Execution Vulnerability

“A vulnerable SharePoint server can quickly become the doorway to a much larger compromise across the organization.”

A deserialization of untrusted data vulnerability in Microsoft SharePoint allows an attacker to execute arbitrary code over the network. Microsoft states that the attack can be carried out remotely and requires no user interaction, making this a high-risk vulnerability for organizations that rely on SharePoint Server. Security updates are available for supported SharePoint versions.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability allows remote code execution on Microsoft SharePoint Server through insecure deserialization of untrusted data. An attacker who is authenticated as at least a Site Owner can write arbitrary code that is executed on the SharePoint server. Successful exploitation could result in complete server compromise, enabling attackers to deploy malware, steal sensitive information, alter content, or pivot deeper into the enterprise network.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the provided information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by deserialization of untrusted data (CWE-502) within Microsoft SharePoint. Improper validation of serialized data allows an attacker to inject and execute arbitrary code on the SharePoint server. Microsoft states that the vulnerability is remotely exploitable over the network with low attack complexity and does not require user interaction. The revision history also notes that the security update for this vulnerability had already been released but the CVE was inadvertently omitted from the June 2026 Patch Tuesday release.

EXPLOITABILITY:
Affected products include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Microsoft states that SharePoint Server 2016 uses the same update package as SharePoint Enterprise Server 2016. Exploitation is performed over the network, requires no user interaction, and Microsoft states that an attacker authenticated as at least a Site Owner can inject and execute arbitrary code on the server.

BUSINESS IMPACT:
SharePoint servers often store sensitive corporate documents and serve as collaboration hubs for the organization. Successful exploitation could allow attackers to compromise the SharePoint environment, access confidential business data, deploy malicious code, disrupt business operations, and use the compromised server as a platform for further attacks within the network.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for affected SharePoint Server deployments.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical and has a CVSS v3.1 Base Score of 9.8. The vulnerability is remotely exploitable over the network with low attack complexity and requires no user interaction. Microsoft also assesses exploitation as more likely, making timely remediation particularly important for internet-facing and business-critical SharePoint servers.

Critical or Zero Day – Immediate DeploymentCVE-2026-55040 – Microsoft SharePoint Server Security Feature Bypass Vulnerability

“When authentication can be bypassed, every protected resource becomes a potential target.”

A weak authentication vulnerability in Microsoft SharePoint Server allows an unauthenticated attacker to bypass authentication over the network. By making an anonymous connection, an attacker can impersonate a legitimate user and gain unauthorized access to SharePoint resources. Because the vulnerability is remotely exploitable, requires no user interaction, and carries a high CVSS score, it poses a significant risk to organizations running affected SharePoint servers.

CVSS Score: 9.1

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to bypass SharePoint authentication and impersonate a legitimate user. Successful exploitation could provide unauthorized access to sensitive information and allow unauthorized modification of SharePoint content without requiring valid credentials.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by weak authentication (CWE-1390) in Microsoft SharePoint Server. Microsoft states that an unauthenticated attacker can bypass the authentication mechanism by making an anonymous network connection, allowing impersonation of a legitimate user. The vulnerability is remotely exploitable over the network with low attack complexity and requires no user interaction. Successful exploitation can compromise the confidentiality and integrity of SharePoint content without affecting system availability.

EXPLOITABILITY:
Affected products include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Microsoft also confirms that the SharePoint Enterprise Server 2016 update applies to SharePoint Server 2016. Exploitation requires no authentication or user interaction and is performed remotely over the network by bypassing the authentication process.

BUSINESS IMPACT:
SharePoint commonly stores business-critical documents, collaboration data, and sensitive corporate information. An authentication bypass could allow unauthorized users to access confidential information, alter business records, compromise collaboration sites, and undermine trust in the organization’s document management platform.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected SharePoint Server deployments.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 Base Score of 9.1. It is remotely exploitable, requires no authentication or user interaction, and Microsoft assesses exploitation as more likely, making prompt remediation important to prevent unauthorized access to SharePoint environments.

Critical or Zero Day – Immediate DeploymentCVE-2026-50522 – Microsoft SharePoint Remote Code Execution Vulnerability

“A single vulnerable SharePoint server can become the doorway to an organization’s most valuable data.”

A deserialization of untrusted data vulnerability in Microsoft SharePoint allows an attacker to execute arbitrary code over the network. An attacker with at least Site Owner privileges can inject and execute malicious code on the SharePoint Server, potentially leading to complete server compromise. Because this vulnerability affects a widely used collaboration platform and carries a very high CVSS score, it represents a serious risk to organizations using affected SharePoint deployments.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability enables remote code execution on affected SharePoint servers. A successful attack could allow an attacker to execute arbitrary code, compromise sensitive business data, deploy additional malware, and potentially gain control of the SharePoint environment.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by deserialization of untrusted data (CWE-502) within Microsoft SharePoint. Microsoft states that an attacker authenticated as at least a Site Owner can write arbitrary code that is subsequently executed by the SharePoint Server. The vulnerability is remotely exploitable over the network with low attack complexity and no user interaction required. Successful exploitation can result in complete compromise of the confidentiality, integrity, and availability of the affected server.

EXPLOITABILITY:
Affected products include Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Microsoft also confirms that the SharePoint Enterprise Server 2016 update applies to SharePoint Server 2016. Exploitation requires an attacker to have at least Site Owner privileges before injecting malicious code for remote execution.

BUSINESS IMPACT:
A successful attack could provide an attacker with the ability to execute arbitrary code on SharePoint servers, exposing confidential business information, modifying corporate documents, disrupting collaboration services, and establishing a foothold for further attacks within the enterprise network.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing the appropriate security updates for all affected SharePoint Server deployments.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 Base Score of 9.8. Although exploitation requires Site Owner privileges, Microsoft assesses exploitation as more likely, and successful exploitation can result in full remote code execution on SharePoint servers.

Critical or Zero Day – Immediate DeploymentCVE-2026-55033 – Microsoft Word Remote Code Execution Vulnerability

“One malicious document can become the starting point for a much larger security incident.”

An integer overflow and heap-based buffer overflow vulnerability in Microsoft Word allows an unauthorized attacker to execute code locally. Although the attack is classified as local, exploitation requires an attacker to convince a user to open a specially crafted Word document or trigger the vulnerability through the Preview Pane. Successful exploitation could allow arbitrary code execution with the privileges of the affected user.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows arbitrary code execution through a specially crafted Microsoft Word document. A successful attack could enable an attacker to install malware, access sensitive information, modify files, or perform additional actions using the permissions of the compromised user.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by integer overflow or wraparound (CWE-190) and heap-based buffer overflow (CWE-122) in Microsoft Word. An attacker can craft a malicious Word document that triggers improper memory handling when opened or previewed. Microsoft confirms that the Preview Pane is an attack vector, meaning exploitation may occur when the file is previewed without being fully opened. Successful exploitation allows arbitrary code execution in the security context of the current user.

EXPLOITABILITY:
Affected products include Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021/2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Exploitation requires an attacker to deliver a specially crafted Office file and convince a user to open it or trigger processing through the Preview Pane.

BUSINESS IMPACT:
Successful exploitation could give attackers a foothold on corporate endpoints, enabling malware deployment, unauthorized access to sensitive information, and lateral movement within enterprise environments. Because Microsoft Word documents are routinely exchanged across organizations, this vulnerability presents a significant phishing and social engineering risk.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing all applicable security updates for affected Microsoft Word, Office, and SharePoint products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 Base Score of 7.8. Although exploitation requires user interaction, the Preview Pane is an attack vector, increasing the likelihood that malicious documents could trigger code execution during normal document handling.

Critical or Zero Day – Immediate DeploymentCVE-2026-55127 – Microsoft Word Remote Code Execution Vulnerability

“A document that appears harmless can become the launch point for a serious security breach.”

A heap-based buffer overflow vulnerability in Microsoft Word allows an unauthorized attacker to execute code locally. Although classified as a local attack, exploitation requires an attacker to deliver a specially crafted Word document and convince a user to open it. Microsoft also confirms that the Preview Pane is an attack vector, allowing malicious content to be processed during normal document handling. Successful exploitation enables arbitrary code execution in the context of the affected user.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows arbitrary code execution through a malicious Microsoft Word document. A successful attack could enable malware installation, unauthorized access to sensitive information, modification of files, or additional malicious activity using the privileges of the compromised user.

EXPLOITS:
At the time of publication, the vulnerability has not been publicly disclosed and Microsoft has not detected active exploitation. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Word. A specially crafted Office document can trigger improper memory handling, resulting in arbitrary code execution. Microsoft confirms that the Preview Pane is an attack vector, meaning the vulnerability may be triggered while previewing a malicious document. Successful exploitation allows code to run with the permissions of the current user.

EXPLOITABILITY:
Affected products include Microsoft Word 2016, Microsoft 365 Apps for Enterprise, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021/2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, and Microsoft SharePoint Server Subscription Edition. Exploitation requires an attacker to deliver a specially crafted Office file and convince a user to open it or trigger processing through the Preview Pane.

BUSINESS IMPACT:
This vulnerability can be exploited through phishing or other document-based attacks that target employees. Successful exploitation could provide attackers with an initial foothold, allowing malware deployment, unauthorized access to corporate information, and further compromise of enterprise systems.

WORKAROUND:
No mitigations or workarounds are available. Microsoft recommends installing all applicable security updates for affected Microsoft Word, Office, and SharePoint products.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical with a CVSS v3.1 Base Score of 7.8. Although user interaction is required, the Preview Pane is an attack vector, increasing the risk that malicious documents could trigger code execution during routine document handling.

Critical or Zero Day – Immediate DeploymentCVE-2026-55132 – Microsoft Word Remote Code Execution Vulnerability

“A single Word document can become a powerful attack tool when memory corruption flaws are left exposed.”

A double-free vulnerability in Microsoft Word allows an unauthorized attacker to execute arbitrary code on a local system. An attacker must deliver a specially crafted Office document and convince a user to open it. Microsoft also confirms that the Preview Pane is an attack vector, which increases the risk during routine document handling.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability allows an attacker to execute arbitrary code through a specially crafted Microsoft Word document. The malicious file could be delivered through phishing email, collaboration platforms, or file-sharing services. Successful exploitation could allow the attacker to run code with the privileges of the affected user.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of public proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a double-free memory management flaw (CWE-415) in Microsoft Word. A double-free condition occurs when the application attempts to release the same memory location more than once, which can corrupt memory and create conditions for arbitrary code execution. A specially crafted Office document can trigger this flaw when opened or processed through the Preview Pane. The attack is carried out locally after the malicious file is processed.

EXPLOITABILITY:
Affected products include Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Microsoft Office 365 for Mac, Microsoft Office LTSC 2021, Microsoft Office LTSC 2024, Microsoft Office LTSC for Mac 2021 and 2024, Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription Edition, and Microsoft Word 2016. Exploitation requires no attacker privileges but does require user interaction.

BUSINESS IMPACT:
Successful exploitation could allow attackers to install malware, steal sensitive information, modify files, or use the compromised system as a foothold for further attacks. Because Word documents are widely exchanged across organizations, this vulnerability presents a serious phishing and document-based attack risk.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be deployed urgently because it is rated Critical and can lead to arbitrary code execution. The Preview Pane is also an attack vector, increasing exposure during routine document handling even before a file is fully opened.

Critical or Zero Day – Immediate DeploymentCVE-2026-57090 – Microsoft Windows Media Foundation Remote Code Execution Vulnerability

“A single malicious media file or stream can become the doorway to full system compromise. Closing this vulnerability quickly helps prevent attackers from turning everyday content into a serious security incident.”

Microsoft has released a security update to address a heap-based buffer overflow vulnerability in Windows Media Foundation that could allow remote code execution. An attacker could exploit this flaw over a network by convincing a user to process specially crafted media content. Successful exploitation could enable arbitrary code execution with the privileges of the affected user, potentially resulting in complete system compromise. Although Microsoft has not reported active exploitation or public disclosure at the time of publication, the vulnerability carries a Critical severity rating due to its potential impact.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. By delivering specially crafted multimedia content, an attacker can trigger improper memory handling, leading to remote code execution. Because exploitation requires only user interaction with malicious media and no attacker privileges, this flaw presents a significant risk to endpoints that routinely process media files or network streams.

EXPLOITS:
Microsoft’s exploitability assessment indicates:
• Publicly Disclosed: No
• Exploited: No
• Exploitability Assessment: Exploitation Less Likely
At the time of publication, there are no confirmed reports of public exploit code, proof-of-concept (PoC) exploits, or zero-day exploitation.

TECHNICAL SUMMARY:
The vulnerability exists within Microsoft Windows Media Foundation due to a heap-based buffer overflow during the processing of specially crafted media content. Improper handling of memory can corrupt the heap, allowing an attacker to execute arbitrary code. The attack can be initiated remotely by delivering malicious multimedia content over a network, but successful exploitation requires user interaction, such as opening or processing the malicious content. If successful, the attacker could gain the ability to install malware, modify data, create accounts, or perform additional malicious actions with the privileges of the compromised user.

EXPLOITABILITY:
Affected products include:
• Windows 10 Version 1607, 1809, 21H2, and 22H2
• Windows 11 Version 24H2, 25H2, and 26H1
• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Corresponding Server Core installations where applicable
Exploitation requires a user to interact with specially crafted media content. No attacker privileges are required before exploitation.

BUSINESS IMPACT:
A successful attack could allow adversaries to execute arbitrary code on business systems, potentially leading to malware deployment, ransomware infections, credential theft, data compromise, and disruption of critical business operations. Since Windows Media Foundation is widely used across Windows platforms, organizations with large Windows environments face broad exposure until security updates are deployed.

WORKAROUND:
Microsoft has not provided any mitigations or workarounds for this vulnerability. Applying the security updates is the recommended remediation.

URGENCY:
This vulnerability is rated Critical and allows remote code execution with no privileges required before the attack. Although active exploitation has not been reported, the combination of network attack capability, high impact on confidentiality, integrity, and availability, and the widespread deployment of affected Windows platforms makes prompt deployment of the security update a high priority.

Critical or Zero Day – Immediate DeploymentCVE-2026-57094 – Microsoft Windows Media Foundation Remote Code Execution Vulnerability

“A malicious media file can turn a routine user action into complete system compromise.”

CVE-2026-57094 is a remote code execution vulnerability in Microsoft Windows Media Foundation caused by a heap-based buffer overflow and an out-of-bounds read. An unauthenticated attacker could exploit the flaw over a network by convincing a user to open a specially crafted file. Successful exploitation could allow the attacker to run arbitrary code with the privileges of the affected user, placing the confidentiality, integrity, and availability of the system at risk.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
The vulnerability presents a serious threat because it can be triggered remotely, requires no attacker privileges, and has low attack complexity. User interaction is required, but an attacker could deliver the malicious file through email, messaging platforms, downloads, shared storage, or other common delivery channels. Successful exploitation could result in unauthorized code execution, malware installation, data theft, system modification, or service disruption.

EXPLOITS:
The vulnerability was not publicly disclosed and was not reported as exploited at the time of publication. Microsoft assessed exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available data does not confirm public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY:
The flaw exists in Microsoft Windows Media Foundation and involves both a heap-based buffer overflow and an out-of-bounds read. When Windows Media Foundation processes a specially crafted media file, improper memory handling may cause data to be read or written outside the intended memory boundaries. This memory corruption condition could allow attacker-controlled content to influence program execution.
The attack vector is network-based, but exploitation requires a user to open the malicious file. No prior authentication or attacker privileges are required. If exploitation succeeds, the attacker could execute arbitrary code within the security context of the user, potentially allowing malware deployment, data access, account creation, configuration changes, or further movement through the environment.

EXPLOITABILITY:
Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations.
An attacker must convince a user to open a specially crafted file. Exploitation requires no prior privileges and has low attack complexity.

BUSINESS IMPACT:
Successful exploitation could give an attacker control over an affected user session and may lead to malware deployment, ransomware activity, credential theft, sensitive data exposure, unauthorized system changes, or operational disruption. Organizations with large Windows estates face broader risk because the vulnerable Media Foundation component is present across multiple supported desktop and server releases.
The need for user interaction may reduce automated exploitation, but it does not remove the threat. Attackers commonly use convincing file-based lures, and one successful interaction could provide a foothold inside the organization.

WORKAROUND:
No mitigations or workarounds are listed. Organizations that cannot apply the update immediately should restrict untrusted media files, strengthen email and web filtering, block suspicious attachments, limit unnecessary user privileges, and monitor endpoints for unusual activity involving media-processing applications.

URGENCY:
This patch should be prioritized because the vulnerability is rated Critical, can be reached over a network, requires no attacker privileges, and could result in remote code execution. Although active exploitation and public proof-of-concept code are not confirmed, malicious files are a common attack method, and delaying the update leaves affected systems exposed to a high-impact compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-56189 – Microsoft Windows Media Foundation Remote Code Execution Vulnerability

“A single malicious media file can become the doorway to a complete system compromise if vulnerable media components are left unpatched.”

A heap-based buffer overflow vulnerability in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally. Exploitation requires user interaction, such as opening specially crafted media content, but does not require attacker privileges. Successful exploitation could allow an attacker to gain the same rights as the current user and compromise the confidentiality, integrity, and availability of the affected system.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Windows Media Foundation and can allow arbitrary code execution when the vulnerable component processes specially crafted media content. A successful attack could enable malware installation, data theft, credential compromise, or further lateral movement within an environment.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. Improper memory handling while processing specially crafted media content can corrupt heap memory, allowing arbitrary code execution. The vulnerability has a local attack vector, requires low attack complexity, no privileges, and user interaction. Successful exploitation can result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires a user to open or otherwise interact with specially crafted malicious media content.

BUSINESS IMPACT:
Because Windows Media Foundation is widely used to process multimedia content across Windows devices and servers, successful exploitation could allow attackers to execute malicious code, steal sensitive business information, disrupt operations, and establish persistence within enterprise environments.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 7.8. Although user interaction is required, successful exploitation results in arbitrary code execution with high impact to confidentiality, integrity, and availability.

Critical or Zero Day – Immediate DeploymentCVE-2026-57087 – Microsoft Windows Media Foundation Remote Code Execution Vulnerability

“A single malicious media file can give attackers the opportunity to run harmful code and put an entire system at risk.”

Microsoft Windows Media Foundation contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code over a network. Although user interaction is required, such as opening a specially crafted media file, successful exploitation can enable attackers to run arbitrary code with the privileges of the current user. This could lead to full system compromise, data theft, or malware deployment.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Windows Media Foundation and can be exploited by delivering specially crafted media content to a target user. If the vulnerable component processes the malicious file, an attacker may execute arbitrary code, potentially gaining control of the affected system.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. Improper handling of specially crafted media content can corrupt heap memory and allow arbitrary code execution. The CVSS v3.1 metrics identify a network attack vector, low attack complexity, no privileges required, and user interaction required. Successful exploitation results in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires a user to open or otherwise process specially crafted malicious media content.

BUSINESS IMPACT:
A successful attack could allow threat actors to execute malicious code, steal sensitive information, deploy ransomware or malware, and use compromised systems as a foothold for further attacks within the enterprise. The broad range of affected Windows platforms increases the potential organizational impact.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 8.8. Its network attack vector, low attack complexity, and potential for arbitrary code execution make it a significant security risk despite requiring user interaction.

Critical or Zero Day – Immediate DeploymentCVE-2026-55010 – Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability

“An exposed game server can become an easy entry point when attackers can turn network traffic into remote code execution.”

A heap-based buffer overflow vulnerability in Minecraft Bedrock Dedicated Server allows an unauthorized attacker to execute code over a network. The flaw can be triggered by sending specially crafted network traffic to a vulnerable server, requiring no user interaction or prior privileges. Successful exploitation could allow attackers to compromise the server, disrupt gameplay, or gain control of the affected system.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability affects Minecraft Bedrock Dedicated Server and enables remote code execution through specially crafted network traffic. Because it requires no authentication or user interaction, internet-facing servers are at significant risk of compromise.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Minecraft Bedrock Dedicated Server. The server does not properly validate fragmented packet data, allowing specially crafted network traffic to corrupt memory. An attacker can exploit this flaw remotely without authentication, potentially achieving arbitrary code execution with high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
The vulnerability affects Minecraft Bedrock Dedicated Server. An attacker can exploit the flaw by sending specially crafted fragmented network packets to a vulnerable server. No privileges or user interaction are required.

BUSINESS IMPACT:
Organizations and service providers hosting Minecraft Bedrock Dedicated Servers could experience complete server compromise, service disruption, unauthorized access to hosted environments, and potential use of the compromised server as a launch point for additional attacks.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be treated as an immediate priority because it is rated Critical with a CVSS v3.1 Base Score of 9.8. The combination of network-based exploitation, no authentication, no user interaction, and the potential for full remote code execution presents a severe risk to exposed servers.

Critical or Zero Day – Immediate DeploymentCVE-2026-54982 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

“A vulnerability on the local network can quickly become a gateway to full system compromise if left unpatched.”

An integer underflow vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network. The flaw can be exploited from the same network segment without requiring user interaction or privileges. Successful exploitation could allow an attacker to execute arbitrary code, potentially leading to complete compromise of the affected system.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Reliable Multicast Transport Driver (RMCAST). An attacker connected to the same local or virtual network segment can exploit the flaw to execute arbitrary code on a vulnerable system without authentication or user interaction.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by an integer underflow (CWE-191) in the Windows Reliable Multicast Transport Driver (RMCAST). Improper handling of numeric values can result in memory corruption, allowing an attacker on the same network segment to execute arbitrary code. The CVSS v3.1 metrics identify an adjacent network attack vector, low attack complexity, no privileges required, and no user interaction required. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires the attacker to be on the same network segment as the target but does not require authentication or user interaction.

BUSINESS IMPACT:
Successful exploitation could allow attackers on trusted or internal networks to compromise vulnerable Windows systems, steal sensitive information, deploy malware, disrupt business operations, and establish a foothold for further attacks across the environment.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 8.8. Although exploitation is limited to adjacent networks, the lack of required privileges or user interaction significantly increases the risk to enterprise environments.

Critical or Zero Day – Immediate DeploymentCVE-2026-54995 – Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

“A remote flaw in a low-level Windows driver can turn network access into complete system compromise.”

A use-after-free vulnerability in the Windows Reliable Multicast Transport Driver allows an unauthorized attacker to execute code over a network. The attack requires no privileges or user interaction, but successful exploitation depends on additional conditions because the attack complexity is high. If exploited, the flaw could allow arbitrary code execution with serious impact to confidentiality, integrity, and availability.

CVSS Score: 8.1

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Reliable Multicast Transport Driver and could allow an attacker to execute arbitrary code remotely. Because no authentication or user interaction is required, a successful attack could compromise a vulnerable Windows system without action from the target user.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows Reliable Multicast Transport Driver. The flaw can occur when the driver accesses memory after it has already been released, creating memory corruption conditions that may allow arbitrary code execution. The attack is network-based, requires no privileges or user interaction, and has high attack complexity. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation can occur over a network and requires no user interaction or prior privileges, but additional conditions are needed because the attack complexity is high.

BUSINESS IMPACT:
Successful exploitation could allow attackers to run malicious code, steal sensitive information, modify systems, disrupt services, or use the compromised device as a foothold for broader attacks. The wide range of affected Windows desktop and server platforms increases the potential operational impact.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be treated as a high priority because it is rated Critical with a CVSS v3.1 Base Score of 8.1. Although exploitation is considered unlikely and requires complex conditions, the lack of required privileges or user interaction means a successful attack could have severe consequences.

Critical or Zero Day – Immediate DeploymentCVE-2026-50474 – Remote Desktop Client Remote Code Execution Vulnerability

“A trusted remote connection can become an attacker’s entry point when the client processes malicious data.”

A use-after-free vulnerability in the Remote Desktop Client allows an unauthorized attacker to execute code over a network. Exploitation requires user interaction but does not require attacker privileges. Successful exploitation could allow arbitrary code execution with serious consequences for the confidentiality, integrity, and availability of the affected system.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Remote Desktop Client and could allow an attacker to execute malicious code when a user interacts with attacker-controlled remote content. A successful attack could compromise the endpoint, expose sensitive information, install malware, or provide a foothold for additional attacks.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition (CWE-416) in the Remote Desktop Client. The flaw occurs when the client accesses memory after it has already been released, creating memory corruption conditions that may allow arbitrary code execution. The CVSS v3.1 metrics identify a network attack vector, low attack complexity, no privileges required, and user interaction required. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. The exact user action or attack sequence required for exploitation is not confirmed in the available data.

BUSINESS IMPACT:
Successful exploitation could allow attackers to run malicious code on employee workstations or administrative systems using Remote Desktop Client. This could lead to credential theft, malware deployment, unauthorized access to business data, service disruption, and further movement through the enterprise network.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be treated as a high priority because it is rated Critical with a CVSS v3.1 Base Score of 8.8. The flaw is network-based, has low attack complexity, requires no attacker privileges, and can result in arbitrary code execution once the required user interaction occurs.

Critical or Zero Day – Immediate DeploymentCVE-2026-54118 – Microsoft SQL Server Remote Code Execution Vulnerability

“A compromised SQL Server can put an organization’s most valuable data and critical operations directly in an attacker’s hands.”

A deserialization of untrusted data vulnerability in Microsoft SQL Server allows an authenticated attacker to execute code over a network. An attacker with explicit permissions can log in to the SQL Server and elevate privileges to sysadmin, potentially gaining broad control over the database environment and the underlying system.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft SQL Server and allows an attacker with low privileges to execute code remotely after authenticating to the server. Successful exploitation could allow the attacker to elevate privileges to sysadmin, access sensitive databases, modify or delete records, disrupt services, or use the SQL Server as a foothold for broader attacks.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by deserialization of untrusted data (CWE-502) in Microsoft SQL Server. An authenticated attacker with explicit permissions can submit malicious serialized data to the vulnerable component. Improper processing of that data can allow code execution and privilege elevation to sysadmin. The CVSS v3.1 metrics identify a network attack vector, low attack complexity, low privileges required, and no user interaction. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Microsoft SQL Server 2016 Service Pack 3, SQL Server 2016 Azure Connect Feature Pack, SQL Server 2017, SQL Server 2019, SQL Server 2022, and SQL Server 2025 across applicable GDR and CU servicing branches. Exploitation requires an authenticated attacker with explicit permissions to access the SQL Server. The attacker can then attempt to elevate privileges to sysadmin.

BUSINESS IMPACT:
SQL Server often stores financial records, customer information, operational data, and other sensitive business assets. Successful exploitation could result in unauthorized database access, data theft, record manipulation, service disruption, regulatory exposure, and compromise of connected applications or systems.

WORKAROUND:
No mitigations or workarounds are available. Organizations should use the update package that matches their current SQL Server servicing path. GDR installations should remain on the GDR path, while systems already using cumulative updates should use the applicable CU security update. Once an installation moves from GDR to CU, it cannot return to the GDR path.

URGENCY:
This vulnerability should be treated as a high priority because it is rated Critical with a CVSS v3.1 Base Score of 8.8. The flaw is remotely exploitable, has low attack complexity, requires no user interaction, and can allow an authenticated attacker to gain sysadmin privileges and execute code on affected SQL Server systems.

Critical or Zero Day – Immediate DeploymentCVE-2026-54117 – Microsoft SQL Server Remote Code Execution Vulnerability

“One compromised database account can become the key to controlling the entire SQL Server.”

A deserialization of untrusted data vulnerability in Microsoft SQL Server allows an authenticated attacker to execute code over a network. An attacker with explicit permissions can log in to the SQL Server and elevate privileges to sysadmin, potentially gaining full administrative control over the database environment.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft SQL Server 2025 and allows an authenticated attacker with low privileges to execute code remotely. Successful exploitation can result in privilege escalation to sysadmin, enabling unauthorized access to databases, modification or deletion of critical information, deployment of malware, or further compromise of connected systems.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by deserialization of untrusted data (CWE-502) in Microsoft SQL Server. An authenticated attacker with explicit permissions can submit specially crafted serialized data that is improperly processed by the SQL Server. This can allow arbitrary code execution and privilege escalation to sysadmin. The CVSS v3.1 metrics identify a network attack vector, low attack complexity, low privileges required, and no user interaction. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Microsoft SQL Server 2025 for x64-based Systems (CU6) and Microsoft SQL Server 2025 for x64-based Systems (GDR). Exploitation requires an authenticated attacker with explicit permissions to access the SQL Server, after which they may elevate privileges to sysadmin and execute arbitrary code.

BUSINESS IMPACT:
SQL Server environments often host business-critical applications and sensitive enterprise data. Successful exploitation could result in unauthorized access to confidential information, manipulation or destruction of business records, service outages, regulatory consequences, and broader compromise of enterprise infrastructure.

WORKAROUND:
No mitigations or workarounds are available. Organizations should install the appropriate SQL Server 2025 security update that matches their current servicing branch (GDR or CU).

URGENCY:
This vulnerability should be treated as a high priority because it is rated Critical with a CVSS v3.1 Base Score of 8.8. The flaw is remotely exploitable, requires no user interaction, and can allow an authenticated attacker to gain sysadmin privileges and execute arbitrary code on affected SQL Server systems.

Critical or Zero Day – Immediate DeploymentCVE-2026-54128 – Windows DHCP Client Remote Code Execution Vulnerability

“A flaw in a core networking service can turn an everyday connection into the starting point for a serious system compromise.”

A use-after-free vulnerability in the Windows DHCP Client allows an unauthorized attacker to execute code locally. Successful exploitation could allow arbitrary code execution, potentially giving an attacker control over the affected system and enabling compromise of sensitive data, system integrity, and service availability.

CVSS Score: 8.4

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DHCP Client, a core networking component responsible for obtaining network configuration information. A successful attack could allow arbitrary code execution, enabling an attacker to install malware, steal sensitive information, alter system settings, or use the compromised device as a foothold for further attacks.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows DHCP Client. The flaw occurs when the component accesses memory after it has already been released, creating memory corruption conditions that may allow arbitrary code execution. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, no privileges required, and no user interaction. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include supported editions of Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. The available information does not describe the exact exploitation sequence beyond confirming local code execution.

BUSINESS IMPACT:
Because the DHCP Client is a fundamental Windows networking service, successful exploitation could result in endpoint compromise, unauthorized access to business data, malware deployment, service disruption, and lateral movement within enterprise environments.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 8.4. Microsoft assesses exploitation as more likely, and successful exploitation can result in arbitrary code execution with high impact on confidentiality, integrity, and availability.

Critical or Zero Day – Immediate DeploymentCVE-2026-56159 – DHCP Server Service Remote Code Execution Vulnerability

“A critical flaw in a network service can give attackers control before defenders even know they are under attack.”

A heap-based buffer overflow vulnerability in the Windows DHCP Server Service allows an unauthorized attacker to execute arbitrary code over the network. By sending specially crafted DHCP packets to a vulnerable DHCP server configured to provide Option 43 data, an attacker could compromise the server without authentication. Because DHCP servers are critical infrastructure services, a successful attack could have widespread consequences across an enterprise network.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DHCP Server Service, a core infrastructure component responsible for assigning IP addresses and network configuration to client systems. Successful exploitation could allow an attacker to remotely execute arbitrary code, potentially leading to complete server compromise, disruption of network services, and further attacks against connected systems.

EXPLOITS:
The vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Microsoft rates exploitation as Exploitation Unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in the Windows DHCP Server Service. An unauthenticated attacker can exploit the flaw by sending specially crafted DHCP packets to a vulnerable DHCP server configured to provide Option 43 data. Improper handling of the malicious packet can result in memory corruption, allowing arbitrary code execution. According to the CVSS v3.1 metrics, exploitation is network-based, requires low attack complexity, no privileges, and no user interaction, while potentially impacting confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations. Exploitation requires a vulnerable DHCP Server configured to provide Option 43 data and can be performed remotely without authentication.

BUSINESS IMPACT:
DHCP servers are essential infrastructure systems that support enterprise networking. A successful compromise could allow attackers to gain control of a critical server, interrupt network operations, deploy malware, move laterally through the environment, and compromise sensitive business systems.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be treated as a high deployment priority because it carries a Critical severity rating with a CVSS v3.1 Base Score of 9.8. It is remotely exploitable without authentication or user interaction and targets a core enterprise infrastructure service. Prompt deployment of the security update significantly reduces the risk of server compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-50370 – DHCP Server Service Remote Code Execution Vulnerability

“A vulnerability in a core network service can turn a trusted server into an attacker’s strongest foothold.”

A heap-based buffer overflow combined with improper input validation in the Windows DHCP Server Service allows an unauthorized attacker to execute arbitrary code over an adjacent network. By sending specially crafted network traffic to a vulnerable DHCP server, an attacker may trigger memory corruption that results in remote code execution. Because DHCP servers are fundamental to enterprise networking, compromising one could have significant operational and security consequences.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DHCP Server Service, a critical network infrastructure component that provides IP address assignment and network configuration to clients. Successful exploitation could allow an attacker to execute arbitrary code on the DHCP server, potentially leading to full system compromise, disruption of network services, and further attacks against connected systems.

EXPLOITS:
The vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Microsoft rates exploitation as Exploitation More Likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) and improper input validation (CWE-20) in the Windows DHCP Server Service. According to Microsoft’s advisory, an attacker can exploit the flaw by sending specially crafted network traffic to a server configured as a DHCP Server, causing memory corruption that could lead to arbitrary code execution. The CVSS v3.1 metrics indicate the attack is performed from an adjacent network (AV:A), requires low attack complexity, no privileges, and no user interaction, with potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations. Exploitation requires network access from the same network segment as the vulnerable DHCP server.

BUSINESS IMPACT:
A successful attack against a DHCP server could compromise a critical infrastructure service that supports enterprise networking. Attackers could gain control of the server, disrupt network operations, establish persistence, or use the compromised system as a launching point for lateral movement throughout the environment.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability requires prompt deployment because it carries a Critical severity rating with a CVSS v3.1 Base Score of 8.8. Although exploitation is limited to an adjacent network, it requires no privileges or user interaction and targets a critical enterprise infrastructure service. Applying the security update reduces the risk of server compromise and network-wide impact.

Critical or Zero Day – Immediate DeploymentCVE-2026-50518 – Windows DHCP Server Remote Code Execution Vulnerability

“When a critical network service accepts malicious traffic, one packet can become the gateway to a full server compromise.”

A heap-based buffer overflow vulnerability in the Windows DHCP Server allows an unauthorized attacker to execute arbitrary code over the network. By sending specially crafted network requests containing malicious domain name data, an attacker can trigger memory corruption due to improper validation of incoming data. Because DHCP servers are core infrastructure services that support enterprise networking, successful exploitation could have a significant impact across the environment.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DHCP Server, a critical infrastructure service responsible for providing IP address assignment and network configuration to client systems. Successful exploitation could allow an unauthenticated attacker to remotely execute arbitrary code, potentially leading to complete server compromise, disruption of network services, and further attacks against connected systems.

EXPLOITS:
The vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Microsoft rates exploitation as Exploitation More Likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept (PoC) exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in the Windows DHCP Server. According to Microsoft’s advisory, an attacker can exploit the flaw by sending specially crafted network requests containing malicious domain name data to a vulnerable server. Because the affected function does not correctly validate the size of incoming data, malformed input can corrupt memory, potentially allowing arbitrary code execution. The CVSS v3.1 metrics indicate that exploitation is network-based, requires low attack complexity, no privileges, and no user interaction, with the potential to impact confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations. An attacker can exploit the vulnerability remotely by sending specially crafted network requests to a vulnerable DHCP server.

BUSINESS IMPACT:
Compromising a DHCP server can have enterprise-wide consequences because it is a foundational network service. A successful attack could allow attackers to gain control of a critical server, disrupt client connectivity, establish persistence, move laterally through the environment, or deploy additional malicious payloads across the network.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability requires immediate attention because it carries a Critical severity rating with a CVSS v3.1 Base Score of 9.8. It is remotely exploitable over the network without authentication or user interaction and affects a critical infrastructure service. Prompt deployment of the security update is essential to reduce the risk of server compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-48564 – DHCP Server Service Remote Code Execution Vulnerability

“A single crafted RPC request can turn a trusted DHCP server into a powerful foothold for an attacker.”

A heap-based buffer overflow vulnerability in the Windows DHCP Server allows an authenticated attacker to execute code over a network. An attacker with low privileges can send a specially crafted RPC call to the DHCP service and potentially trigger memory corruption. Successful exploitation could allow arbitrary code execution with serious consequences for the confidentiality, integrity, and availability of the affected server.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DHCP Server Service, a core infrastructure component used to provide network configuration to clients. A successful attack could allow an authenticated attacker to execute code remotely, compromise the DHCP server, disrupt network operations, or use the system as a foothold for further attacks.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in the Windows DHCP Server. An authenticated attacker can send a specially crafted RPC call to the DHCP service, causing improper memory handling and potential memory corruption. The CVSS v3.1 metrics indicate a network attack vector, low attack complexity, low privileges required, and no user interaction. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations. Exploitation requires an authenticated attacker with low privileges who can send a crafted RPC request to the DHCP service.

BUSINESS IMPACT:
DHCP servers are essential to enterprise networking. Successful exploitation could allow attackers to gain control of a critical infrastructure server, disrupt IP address assignment and network connectivity, deploy malware, access sensitive systems, or move laterally through the environment.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be treated as a high priority because it is rated Critical with a CVSS v3.1 Base Score of 8.8. The flaw is remotely exploitable, requires only low privileges, needs no user interaction, and affects a core enterprise network service.

Critical or Zero Day – Immediate DeploymentCVE-2026-50382 – DirectX Graphics Kernel Remote Code Execution Vulnerability

“A compromised virtual machine should never become a bridge to the host, but vulnerabilities like this can make that possible.”

An untrusted pointer dereference vulnerability in the Windows DirectX Graphics Kernel allows an authorized attacker to execute code locally. According to Microsoft, an attacker who gains access to a local guest virtual machine (VM) could exploit the flaw to attack the host operating system. Because this vulnerability crosses a virtualization boundary, successful exploitation could allow a compromise to extend beyond the guest environment.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows DirectX Graphics Kernel. An attacker with low privileges on a guest virtual machine could exploit the flaw to execute code on the host operating system. A successful attack could result in unauthorized access to host resources, system compromise, and the potential impact of other workloads running on the same host.

EXPLOITS:
The vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Microsoft rates exploitation as Exploitation Less Likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept (PoC) exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by an untrusted pointer dereference (CWE-822) in the Windows DirectX Graphics Kernel. According to Microsoft’s advisory, an attacker can exploit the flaw after obtaining access to a local guest virtual machine, allowing them to attack the host operating system. The CVSS v3.1 metrics indicate a local attack vector, low attack complexity, low privileges required, no user interaction, and Scope: Changed, reflecting the potential to impact resources beyond the vulnerable component. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations where applicable. Exploitation requires an attacker to have low-privileged access to a local guest virtual machine before targeting the host operating system.

BUSINESS IMPACT:
Organizations using virtualization technologies face an elevated risk because successful exploitation could allow an attacker to escape the guest environment and compromise the host. This could expose multiple virtual machines, sensitive workloads, and shared infrastructure, increasing the potential impact across the environment.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it carries a Critical severity rating with a CVSS v3.1 Base Score of 8.8. Although exploitation requires low privileges on a guest virtual machine, the potential to compromise the host operating system makes this a significant risk for virtualized environments.

Critical or Zero Day – Immediate DeploymentCVE-2026-50380 – Windows GDI+ Remote Code Execution Vulnerability

“One malicious image can become the doorway to a full system compromise when trusted graphics components fail.”

A heap-based buffer overflow vulnerability in Windows GDI+ allows an unauthorized attacker to execute arbitrary code when a user opens or processes a specially crafted EMF+ file. The vulnerability is triggered during the rendering of a malicious image record, resulting in memory corruption. Because Windows GDI+ is widely used to process graphics across Windows applications, successful exploitation could lead to complete system compromise.

CVSS Score: 9.6

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows GDI+ graphics component responsible for rendering image content. A successful attack could allow an attacker to execute arbitrary code on a target system after convincing a user to open or process a malicious EMF+ file. Successful exploitation could provide control over the affected system and enable further malicious activity.

EXPLOITS:
The vulnerability was not publicly disclosed and was not known to be exploited at the time of publication. Microsoft rates exploitation as Exploitation Less Likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and there is no confirmation of publicly available proof-of-concept (PoC) exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows GDI+. According to Microsoft’s advisory, an attacker can craft a malicious EMF+ file containing a specially designed image record. When the file is opened or otherwise rendered, Windows GDI+ may write beyond the bounds of allocated memory, causing memory corruption that can lead to arbitrary code execution. The CVSS v3.1 metrics indicate a network attack vector, low attack complexity, no privileges required, user interaction required, and Scope: Changed, reflecting the potential to impact resources beyond the vulnerable component.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including affected Server Core installations where listed. Exploitation requires a user to open or otherwise process a specially crafted EMF+ file.

BUSINESS IMPACT:
Successful exploitation could allow attackers to compromise user workstations or servers through malicious image files delivered by email, websites, or shared documents. A compromised system could expose sensitive information, enable malware deployment, facilitate lateral movement, and disrupt business operations.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it carries a Critical severity rating with a CVSS v3.1 Base Score of 9.6. Although user interaction is required, exploitation requires no privileges, targets a widely used graphics component, and can result in complete system compromise once a malicious file is processed.

Critical or Zero Day – Immediate DeploymentCVE-2026-49796 – Windows GDI+ Remote Code Execution Vulnerability

“A malicious image can become a direct path to code execution when trusted graphics components process unsafe data.”

A heap-based buffer overflow vulnerability in Windows GDI+ allows an unauthorized attacker to execute code locally. Exploitation requires user interaction, such as opening or processing specially crafted content. Successful exploitation could allow arbitrary code execution with high impact to the confidentiality, integrity, and availability of the affected system.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Windows GDI+, a graphics component used by Windows applications to render image content. An attacker could deliver specially crafted content through email, websites, documents, or file-sharing platforms and convince a user to open or process it. Successful exploitation could allow the attacker to run malicious code with the privileges of the current user.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows GDI+. Improper memory handling while processing crafted graphics content can write data beyond allocated memory boundaries, causing memory corruption and potentially enabling arbitrary code execution. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, no privileges required, and user interaction required. Although the vulnerability is classified as Remote Code Execution, the attack itself is carried out locally after malicious content is processed on the target system.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires the target user or system to process specially crafted graphics content.

BUSINESS IMPACT:
Successful exploitation could allow attackers to install malware, steal sensitive information, modify files, disrupt services, or use the compromised system as a foothold for broader attacks. Because graphics content is commonly embedded in documents, websites, and email, this vulnerability creates a practical path for social engineering and content-based attacks.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 7.8. Although exploitation requires user interaction, Windows GDI+ is widely used to process image content across many applications, increasing the number of possible attack paths.

Critical or Zero Day – Immediate DeploymentCVE-2026-54127 – Windows Hyper-V Elevation of Privilege Vulnerability

“A flaw inside the virtualization layer can turn local access into control over critical systems.”

A use-after-free vulnerability in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally. Exploitation requires no existing privileges or user interaction, but the attack complexity is high. Successful exploitation could give an attacker greater control over the affected system and significantly impact confidentiality, integrity, and availability.

CVSS Score: 7.4

SEVERITY: Critical

THREAT:
This vulnerability affects Windows Hyper-V and could allow an attacker to elevate privileges on a vulnerable system. A successful attack may enable unauthorized access to protected resources, modification of system settings, compromise of hosted workloads, or further attacks against the virtualization environment.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Hyper-V. The flaw occurs when the component accesses memory after it has already been released, creating memory corruption conditions that may allow privilege elevation. The CVSS v3.1 metrics identify a local attack vector, high attack complexity, no privileges required, and no user interaction. Successful exploitation could have high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 11 versions 24H2, 25H2, and 26H1, Windows Server 2022, and Windows Server 2025, including the affected Server Core installation. Exploitation is local and requires complex conditions, but it does not require existing privileges or user interaction.

BUSINESS IMPACT:
Hyper-V environments often host business-critical servers, applications, and sensitive workloads. Successful exploitation could allow an attacker to gain elevated access, interfere with virtualized workloads, expose confidential information, disrupt hosted services, or use the affected system as a platform for further attacks.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and affects the Windows virtualization layer. Although exploitation requires complex conditions, no privileges or user interaction are required, and a successful attack could seriously compromise affected hosts and workloads.

Critical or Zero Day – Immediate DeploymentCVE-2026-50680 – Windows Hyper-V Elevation of Privilege Vulnerability

“When an attacker reaches SYSTEM privileges, a single compromised account can become complete control of the host.”

A heap-based buffer overflow vulnerability in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Successful exploitation can enable an attacker with high privileges to gain SYSTEM privileges, providing complete control over the affected operating system. The vulnerability affects Hyper-V hosts and could significantly impact the confidentiality, integrity, and availability of business-critical workloads.

CVSS Score: 8.2

SEVERITY: Critical

THREAT:
This vulnerability affects Windows Hyper-V and can be exploited by an attacker who already has high privileges on the affected system. By exploiting the heap-based buffer overflow, the attacker can elevate privileges to SYSTEM, enabling unrestricted access to the operating system and potentially compromising hosted virtual machines and sensitive enterprise resources.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as less likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Hyper-V. Improper handling of memory can allow an attacker to corrupt memory and execute code in a more privileged context. According to Microsoft’s advisory, a successful exploit could elevate an attacker to SYSTEM privileges. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, high privileges required, no user interaction, and a changed scope, indicating that exploitation can impact resources beyond the initially compromised security boundary.

EXPLOITABILITY:
Affected products include Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires local access with high privileges but no user interaction.

BUSINESS IMPACT:
Compromising a Hyper-V host can have far-reaching consequences because multiple virtual machines and business services may rely on the same platform. Gaining SYSTEM privileges could allow an attacker to disable security controls, manipulate hosted workloads, access sensitive information, interrupt critical services, and establish persistent access within the environment.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical with a CVSS v3.1 Base Score of 8.2. Although exploitation requires high privileges, successful exploitation grants SYSTEM privileges on Hyper-V hosts, making it a significant risk for virtualized enterprise environments.

Critical or Zero Day – Immediate DeploymentCVE-2026-58542 – Windows Media Remote Code Execution Vulnerability

“A single malicious media file can become the doorway to a much larger security incident.”

A heap-based buffer overflow vulnerability in Windows Media allows an unauthorized attacker to execute code locally. Exploitation requires user interaction, such as opening or processing specially crafted media content. Successful exploitation could allow arbitrary code execution, potentially leading to system compromise and unauthorized access to sensitive information.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Media component responsible for processing media content. An attacker could distribute a specially crafted media file through email, websites, messaging platforms, or file-sharing services and persuade a user to open it. If the malicious file is processed by the vulnerable component, arbitrary code could be executed on the affected system.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Media. Improper handling of specially crafted media content can corrupt memory, allowing an attacker to execute arbitrary code. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, no privileges required, and user interaction required. A successful exploit could allow the attacker to execute code with the privileges of the user who opened the malicious media file.

EXPLOITABILITY:
Affected products include Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2025, including the affected Server Core installation. Exploitation requires a user to open or otherwise process specially crafted media content.

BUSINESS IMPACT:
Media files are frequently exchanged through email, collaboration tools, and websites, making them an effective vehicle for social engineering attacks. Successful exploitation could allow attackers to install malware, steal sensitive information, disrupt business operations, or establish persistent access to affected systems.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical. Although exploitation requires user interaction, malicious media files are a common attack vector, and successful exploitation could result in arbitrary code execution and compromise of affected systems.

Critical or Zero Day – Immediate DeploymentCVE-2026-50655 – Microsoft Windows Media Foundation Remote Code Execution Vulnerability

“One malicious media file is all it takes to turn everyday content into a pathway for system compromise.”

A heap-based buffer overflow vulnerability in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally. Although classified as a Remote Code Execution vulnerability, exploitation requires user interaction, such as opening a specially crafted media file. Successful exploitation could allow arbitrary code execution with the privileges of the current user, resulting in loss of confidentiality, integrity, and availability.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Microsoft Windows Media Foundation, the multimedia framework used by Windows to process audio and video content. An attacker could deliver a specially crafted media file through email, messaging platforms, websites, or file-sharing services and convince a user to open it. Once processed, the malicious file could trigger memory corruption and execute attacker-controlled code on the affected system.

EXPLOITS:
The vulnerability was not publicly disclosed at the time of publication. Microsoft assesses exploitation as more likely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven, and the available information does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Microsoft Windows Media Foundation. Improper handling of specially crafted media content can corrupt memory, allowing arbitrary code execution. The CVSS v3.1 metrics identify a local attack vector, low attack complexity, no privileges required, and user interaction required. Microsoft notes that although the vulnerability is categorized as Remote Code Execution, the attack is performed locally after a user is persuaded to open malicious content, making social engineering a key part of the attack chain.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires a user to open or process a specially crafted media file.

BUSINESS IMPACT:
Media files are commonly exchanged through email, collaboration platforms, and websites, making them an attractive delivery mechanism for attackers. Successful exploitation could enable malware installation, data theft, disruption of business operations, or provide an entry point for additional attacks within the organization.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical. Microsoft also assesses exploitation as more likely, increasing the importance of deploying security updates promptly. User interaction is required, but malicious media files remain a common and effective attack vector.

Critical or Zero Day – Immediate DeploymentCVE-2026-50327 – Windows Media Remote Code Execution Vulnerability

“A single weakness in media processing can turn a trusted system into an attacker’s foothold.”

A heap-based buffer overflow vulnerability in Windows Media allows an authorized attacker to execute code locally. Successful exploitation could enable arbitrary code execution with the privileges of the authenticated user, potentially allowing attackers to compromise sensitive data, disrupt operations, or establish persistence on affected systems.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Media component and can be exploited by an attacker who already has low-level privileges on the target system. By leveraging the heap-based buffer overflow, the attacker may execute arbitrary code locally, potentially leading to further compromise of the affected device.

EXPLOITS:
The vulnerability was not publicly disclosed and was not being actively exploited at the time of publication. Microsoft rates exploitation as more likely. The CVSS v3.1 temporal metrics identify exploit code maturity as Unproven, and there is no confirmed public proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Media. Improper handling of memory can allow an authenticated attacker with low privileges to corrupt memory and execute arbitrary code locally. According to the CVSS v3.1 metrics, the attack requires a local attack vector, low attack complexity, low privileges, no user interaction, and has a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 11 versions 24H2, 25H2, and 26H1, along with Windows Server 2025, including Server Core installations. Exploitation requires local access and low privileges on the affected system. No user interaction is required.

BUSINESS IMPACT:
An attacker who gains low-level access to a vulnerable system could use this vulnerability to execute malicious code, install malware, steal sensitive information, or establish a stronger foothold within the environment. Systems used in high-value or multi-user environments face increased risk if local access is obtained through other attack vectors.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and Microsoft assesses exploitation as more likely. Although local access and low privileges are required, successful exploitation enables code execution that could be used to facilitate broader compromise within an enterprise environment.

Critical or Zero Day – Immediate DeploymentCVE-2026-58608 – Windows Print Spooler Remote Code Execution Vulnerability

“A trusted service that handles everyday printing should never become a gateway for attackers to execute malicious code.”

A race condition and use-after-free vulnerability in the Windows Print Spooler allows an authorized attacker to execute arbitrary code over a network. By exploiting improper synchronization in the Print Spooler service, an attacker with low privileges can corrupt memory and execute malicious code on affected systems. If left unpatched, this vulnerability could provide attackers with an opportunity to compromise critical Windows systems and expand their presence within an enterprise environment.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability affects the Windows Print Spooler service and results from improper synchronization combined with a use-after-free condition. An attacker with low privileges can remotely interact with the Print Spooler service over a network to trigger memory corruption and execute arbitrary code. Because the Print Spooler is commonly enabled across enterprise environments, successful exploitation could provide an effective entry point for further attacks.

EXPLOITS:
At the time of publication, the vulnerability was not publicly disclosed and no active exploitation had been observed. Microsoft rates exploitation as Less Likely. The CVSS v3.1 temporal metrics indicate Exploit Code Maturity: Unproven, and no confirmed public proof-of-concept exploit code is available.

TECHNICAL SUMMARY:
The vulnerability is caused by a combination of a race condition (CWE-362) and a use-after-free vulnerability (CWE-416) within the Windows Print Spooler service. An attacker can create and close a printer handle while leaving a related notification handle in an invalid state, allowing the service to reference memory that has already been released. This memory corruption can be leveraged to execute arbitrary code. According to the CVSS v3.1 metrics, exploitation requires a network attack vector, low attack complexity, low privileges, no user interaction, and can result in complete compromise of confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations where listed. Exploitation requires network access and low privileges but does not require user interaction.

BUSINESS IMPACT:
A successful attack could allow adversaries to execute malicious code on systems running the Print Spooler service, potentially leading to malware deployment, data theft, service disruption, lateral movement, and broader compromise of enterprise networks. Organizations that rely on print services across workstations and servers should prioritize remediation to reduce exposure.

WORKAROUND:
No mitigations or workarounds are available. Apply the appropriate security update to affected systems as soon as possible.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and enables remote code execution over a network. Although exploitation requires low privileges, the network attack vector, high impact on confidentiality, integrity, and availability, and the widespread deployment of the Print Spooler service make prompt patching essential.

Critical or Zero Day – Immediate DeploymentCVE-2026-50392 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability

“When attackers turn a local foothold into SYSTEM-level control, the entire security boundary is at risk.”

A use-after-free vulnerability in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. By exploiting improper memory management, an attacker with low privileges could gain SYSTEM-level privileges, enabling complete control over the affected device. Although successful exploitation requires winning a race condition, the impact of a successful attack is severe and could lead to full system compromise.

CVSS Score: 7.0

SEVERITY: Critical

THREAT:
This vulnerability affects Windows Secure Kernel Mode and is caused by a use-after-free memory handling flaw. An attacker with low privileges who has local access to a vulnerable system could exploit the vulnerability to elevate privileges to SYSTEM. Once elevated, an attacker can bypass security boundaries, disable security controls, install malware, and access sensitive data.

EXPLOITS:
At the time of publication, the vulnerability was not publicly disclosed and was not being actively exploited. Microsoft assesses exploitation as Less Likely. The CVSS v3.1 temporal metrics indicate Exploit Code Maturity: Unproven, and there is no confirmed public proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free (CWE-416) condition in Windows Secure Kernel Mode. Improper memory management allows an authenticated attacker with low privileges to manipulate freed memory and elevate privileges. Microsoft notes that successful exploitation requires the attacker to win a race condition, which is reflected in the High Attack Complexity rating. According to the CVSS v3.1 metrics, exploitation requires a local attack vector, high attack complexity, low privileges, and no user interaction. A successful exploit could result in complete compromise of confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected products include Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025, including Server Core installations. Exploitation requires local access and low privileges. No user interaction is required. A successful exploit could allow an attacker to obtain SYSTEM privileges.

BUSINESS IMPACT:
Privilege escalation vulnerabilities are frequently used after an attacker gains initial access to a system. Obtaining SYSTEM privileges allows attackers to disable security protections, execute malware with maximum privileges, steal sensitive information, establish persistence, and move laterally throughout an enterprise. Even though exploitation is considered less likely, the consequences of a successful attack are significant.

WORKAROUND:
No mitigations or workarounds are available. Apply the appropriate security update to affected systems.

URGENCY:
This update should be prioritized because it addresses a Critical elevation of privilege vulnerability that can grant SYSTEM privileges. While exploitation requires winning a race condition and Microsoft assesses exploitation as less likely, successful exploitation can completely compromise an affected system and enable further attacks across the environment.

Critical or Zero Day – Immediate DeploymentCVE-2026-42982 – Windows Secure Kernel Mode Elevation of Privilege Vulnerability

“A low-privileged account should never become the starting point for complete system control.”

An improper input validation vulnerability in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. By exploiting insufficient validation of input consistency, an attacker with low privileges can gain SYSTEM privileges, enabling full control of the affected device. Although the attack requires local access, successful exploitation can significantly increase the impact of an initial compromise and provide attackers with unrestricted access to system resources.

CVSS Score: 7.8

SEVERITY: Critical

THREAT:
This vulnerability affects Windows Secure Kernel Mode and is caused by improper validation of consistency within input. An attacker with low privileges who gains local access to a vulnerable system can exploit the flaw to elevate privileges to SYSTEM, allowing them to bypass security controls, execute malicious code with maximum privileges, and take complete control of the operating system.

EXPLOITS:
At the time of publication, the vulnerability was not publicly disclosed and was not being actively exploited. Microsoft assesses exploitation as Less Likely. The CVSS v3.1 temporal metrics indicate Exploit Code Maturity: Unproven, and no confirmed public proof-of-concept exploit code is available.

TECHNICAL SUMMARY:
The vulnerability is caused by improper validation of consistency within input (CWE-1288) in Windows Secure Kernel Mode. Insufficient validation of input allows an authenticated attacker with low privileges to manipulate the kernel into performing unintended operations, resulting in privilege escalation. According to the CVSS v3.1 metrics, exploitation requires a local attack vector, low attack complexity, low privileges, no user interaction, and can result in complete compromise of confidentiality, integrity, and availability. Microsoft states that successful exploitation can grant SYSTEM privileges.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 26H1, and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations where listed. Exploitation requires local access and low privileges. No user interaction is required.

BUSINESS IMPACT:
Privilege escalation vulnerabilities are commonly used after attackers obtain an initial foothold on a system. Gaining SYSTEM privileges enables attackers to disable security tools, deploy ransomware, access sensitive information, establish persistence, and move laterally across the network. Even without public exploitation, the potential impact on enterprise environments is significant.

WORKAROUND:
No mitigations or workarounds are available. Organizations should apply the appropriate security updates to affected systems.

URGENCY:
This vulnerability should be addressed promptly because it is rated Critical and allows an attacker with low privileges to obtain SYSTEM privileges. Although Microsoft currently assesses exploitation as less likely, successful exploitation can completely compromise an affected system and facilitate broader attacks across the environment.

Critical or Zero Day – Immediate DeploymentCVE-2026-50694 – Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

“A single malicious VPN packet can become a direct path to server compromise when protocol handling fails.”

A use-after-free vulnerability in Windows Secure Socket Tunneling Protocol allows an unauthorized attacker to execute arbitrary code over a network. An attacker can target a vulnerable SSTP server by sending a specially crafted malicious packet. No privileges or user interaction are required, but exploitation has high attack complexity.

CVSS Score: 8.1

SEVERITY: Critical

THREAT:
This vulnerability affects Windows SSTP, a protocol used to carry VPN traffic over HTTPS. A successful attack could allow remote code execution on the server, potentially enabling malware deployment, unauthorized access to sensitive information, service disruption, or further compromise of the surrounding network.

EXPLOITS:
Microsoft assesses exploitation as unlikely. The CVSS v3.1 temporal metrics list exploit code maturity as Unproven. The data does not confirm public disclosure, active exploitation, or publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Secure Socket Tunneling Protocol. The flaw occurs when the SSTP component accesses memory after it has already been released. An attacker can send a specially crafted SSTP packet to a vulnerable server, potentially causing memory corruption and arbitrary code execution. The CVSS v3.1 metrics identify a network attack vector, high attack complexity, no privileges required, and no user interaction.

EXPLOITABILITY:
Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 24H2, 25H2, and 26H1, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including affected Server Core installations. Exploitation requires specially crafted SSTP traffic to reach a vulnerable server, but no authentication or user interaction is required.

BUSINESS IMPACT:
SSTP may be exposed on systems that provide remote-access VPN services. Successful exploitation could compromise an internet-facing server, expose sensitive data, disrupt remote connectivity, and provide attackers with a foothold for broader attacks against enterprise systems.

WORKAROUND:
No mitigations or workarounds are available.

URGENCY:
This vulnerability should be prioritized because it is rated Critical and can lead to remote code execution without authentication or user interaction. Although exploitation requires complex conditions and Microsoft assesses it as unlikely, successful exploitation could result in full compromise of an SSTP server.

Critical or Zero Day – Immediate DeploymentCVE-2026-56188 – Windows Server Network driver Remote Code Execution Vulnerability

“A single malicious network packet can become the doorway to full system compromise. Closing this vulnerability quickly helps keep attackers outside your network.”

A race condition in the Windows Server Network driver allows an unauthorized attacker to execute arbitrary code remotely by sending specially crafted network traffic to a vulnerable system. Because the vulnerability can be exploited over the network without requiring user interaction or authentication, it presents a significant risk to exposed Windows servers and workstations. Successful exploitation could allow attackers to gain complete control over affected systems and use them as a foothold for further attacks within an organization.

CVSS Score: 9.8

SEVERITY: Critical

THREAT:
This vulnerability enables remote code execution through a race condition in the Windows Server Network driver. An attacker does not require authentication or user interaction to trigger the flaw, making it particularly dangerous for internet-facing or internally exposed systems. If successfully exploited, attackers could execute arbitrary code with the privileges of the vulnerable component, potentially leading to complete system compromise.

EXPLOITS:
At the time of publication, Microsoft’s exploitability assessment indicates that exploitation is more likely, but there is no public disclosure and no evidence of active exploitation. No public proof-of-concept (PoC) exploit has been confirmed in the provided data.

TECHNICAL SUMMARY:
The vulnerability is caused by CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition) within the Windows Server Network driver. Improper synchronization during concurrent access to shared resources creates a condition where specially crafted network traffic can manipulate execution timing and trigger unintended behavior. An attacker can exploit this condition remotely by sending malicious network packets to a vulnerable server, resulting in arbitrary code execution. Because the flaw is reachable over the network and requires no authentication or user interaction, it significantly increases the attack surface of affected Windows systems.

EXPLOITABILITY:
Affected products include supported versions of Windows 10, Windows 11, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including applicable Server Core installations listed in the advisory. Exploitation involves sending specially crafted malicious network traffic to a vulnerable server.

BUSINESS IMPACT:
This vulnerability poses a serious risk because it enables attackers to compromise systems remotely without credentials or user interaction. A successful attack could result in unauthorized access, malware deployment, ransomware infections, data theft, service disruption, and lateral movement throughout the environment. Organizations operating internet-facing servers or critical infrastructure should treat this vulnerability as a high-priority remediation item to reduce the risk of widespread compromise.

WORKAROUND:
No mitigations or workarounds are available. Applying the Microsoft security update is the recommended remediation.

URGENCY:
This vulnerability carries a Critical severity rating with a CVSS v3.1 Base Score of 9.8 and can be exploited remotely without authentication or user interaction. Microsoft also assesses exploitation as more likely. Systems exposed to untrusted networks should be prioritized for patch deployment to reduce the risk of remote compromise.

Critical or Zero Day – Immediate DeploymentCVE-2026-50444 – Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

“A small foothold is all an attacker needs when critical functions lack proper authentication. Fixing this vulnerability helps stop limited access from becoming full control.”

A missing authentication check in Windows Server Update Service (WSUS) allows an authorized attacker with low privileges to elevate their permissions over the network. Although an attacker must already have limited access to the environment, successful exploitation can lead to significantly higher privileges, enabling unauthorized control over affected systems and increasing the potential for further compromise across the network.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
This vulnerability is caused by CWE-306: Missing Authentication for Critical Function, allowing an authorized attacker with low privileges to elevate their permissions over a network. By bypassing authentication for a critical function, an attacker may gain access to resources and capabilities that should be restricted, increasing the likelihood of complete system compromise and lateral movement within an enterprise environment.

EXPLOITS:
At the time of publication, Microsoft assesses exploitation as less likely. There is no public disclosure, no evidence of active exploitation, and no confirmed public proof-of-concept (PoC) exploit in the provided data.

TECHNICAL SUMMARY:
The vulnerability exists because Windows Server Update Service (WSUS) fails to properly enforce authentication for a critical function. This missing authentication mechanism allows an attacker with low privileges to invoke functionality that should require stronger authorization. Successful exploitation enables privilege escalation, allowing the attacker to perform actions beyond their intended permissions. Since the vulnerability is exploitable over the network without user interaction, it presents a significant security concern in environments where attackers have already obtained limited access.

EXPLOITABILITY:
Affected products include supported versions of Windows 10, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including applicable Server Core installations listed in the advisory. Exploitation requires an attacker to have low privileges and network access to the vulnerable system. No user interaction is required.

BUSINESS IMPACT:
Privilege escalation vulnerabilities can allow attackers to expand their control after gaining an initial foothold. Once elevated privileges are obtained, attackers may disable security controls, access sensitive information, deploy malicious software, modify system configurations, and move laterally to other systems. In enterprise environments, this can significantly increase the impact of an initial compromise and lead to broader operational disruption.

WORKAROUND:
No mitigations or workarounds are available. Applying the Microsoft security update is the recommended remediation.

URGENCY:
This vulnerability is rated Critical with a CVSS v3.1 Base Score of 8.8. While Microsoft currently assesses exploitation as less likely, the absence of available mitigations and the potential for attackers to elevate privileges over the network make timely deployment of the security update an important priority, particularly for systems running WSUS.

Critical or Zero Day – Immediate DeploymentCVE-2026-54999 – Windows TCP/IP Remote Code Execution Vulnerability

“An attacker on the same network can turn a timing flaw into full system compromise without needing credentials or user action.”

A race condition in Windows TCP/IP allows an unauthorized attacker on an adjacent network to execute arbitrary code on an affected system. The flaw requires no privileges and no user interaction, which increases the risk in shared, local, wireless, and segmented network environments. Successful exploitation could compromise the confidentiality, integrity, and availability of the targeted device.

CVSS Score: 8.8

SEVERITY: Critical

THREAT:
The vulnerability creates a remote code execution risk for systems reachable from an adjacent network. An attacker does not need authentication or user interaction, but must be positioned on the same local or logically adjacent network as the target. Successful exploitation could allow the attacker to run malicious code, take control of the system, disrupt services, or use the compromised device to attack other systems.

EXPLOITS:
At the time of publication, exploitation was assessed as less likely. The vulnerability was not publicly disclosed and was not known to be actively exploited. No public exploit or proof-of-concept code is confirmed in the available data.

TECHNICAL SUMMARY:
The vulnerability is caused by CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, commonly known as a race condition. Windows TCP/IP does not properly synchronize access to a shared resource during concurrent processing. An attacker on an adjacent network could trigger the race condition by sending specially crafted network traffic to a vulnerable system.
Because the attack complexity is low, the attacker does not need to overcome difficult technical conditions beyond gaining adjacent network access. Successful exploitation could result in arbitrary code execution with significant impact to confidentiality, integrity, and availability. The vulnerability requires no privileges and no action from the user.

EXPLOITABILITY:
Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including applicable Server Core installations.
An attacker must have access to an adjacent network and send specially crafted traffic to the vulnerable system. No credentials or user interaction are required.

BUSINESS IMPACT:
Successful exploitation could give an attacker control of a vulnerable endpoint or server, leading to malware installation, data theft, system outages, security control bypass, or lateral movement. Devices on shared office networks, wireless networks, hosting environments, and poorly segmented internal networks may face greater exposure.
Because the vulnerability affects the Windows networking stack, exploitation could impact critical servers and workstations without requiring users to open a file or click a link. A compromised system could become an entry point for a broader attack across the organization.

WORKAROUND:
No mitigations or workarounds are available. Apply the applicable Microsoft security update. Network segmentation and restricting untrusted access to local network segments may help reduce exposure until patching is complete.

URGENCY:
This vulnerability is rated Critical and allows remote code execution without authentication or user interaction. Although exploitation is currently assessed as less likely and no active exploitation is confirmed, the low attack complexity and broad range of affected Windows systems make timely patching important. Prioritize systems connected to shared, wireless, exposed, or insufficiently segmented networks.

Critical or Zero Day – Immediate DeploymentCVE-2026-57092 – Microsoft Windows VMSwitch Elevation of Privilege Vulnerability

“A compromised guest virtual machine should not become a doorway to the host, but this flaw can break that boundary.”

A use-after-free vulnerability in Microsoft Windows VMSwitch allows an authorized attacker with low privileges inside a guest virtual machine to potentially gain elevated privileges on the host system. An attacker can exploit the flaw by sending a specially crafted network-related request through the Hyper-V Virtual Switch. Under certain conditions, the host may access memory that is no longer valid, potentially causing a denial of service or allowing the attacker to escape the guest boundary and compromise the host.

CVSS Score: 9.9

SEVERITY: Critical

THREAT:
This vulnerability threatens the security boundary between Hyper-V guest virtual machines and the host system. An attacker who can run code inside a guest virtual machine could send malicious network-related requests through VMSwitch and potentially gain privileges beyond the guest environment. Successful exploitation could expose the host and other workloads running on the same virtualization platform.

EXPLOITS:
At the time of publication, Microsoft assessed exploitation as less likely. The vulnerability was not publicly disclosed and was not known to be actively exploited. No public exploit or proof-of-concept code is confirmed in the available information.

TECHNICAL SUMMARY:
The vulnerability is caused by CWE-416: Use After Free in Microsoft Windows VMSwitch. A use-after-free condition occurs when software continues to reference memory after that memory has already been released.
An attacker with low privileges in a guest virtual machine could run code and send a specially crafted network-related request to the host through the Hyper-V Virtual Switch. Under certain timing and memory conditions, VMSwitch may cause the host to access invalid memory. This could result in a denial of service or, in more serious cases, elevation of privilege on the host system.
The CVSS v3.1 metrics show a network attack vector, low attack complexity, low privileges required, no user interaction, and a changed scope. The changed scope reflects the possibility that exploitation inside a guest virtual machine could affect the separate security authority of the host.

EXPLOITABILITY:
Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including applicable Server Core installations.
Exploitation requires the attacker to run code in a guest virtual machine and send a specially crafted network-related request through the Hyper-V Virtual Switch. No user interaction is required.

BUSINESS IMPACT:
Successful exploitation could allow an attacker to cross the isolation boundary between a guest virtual machine and its host. This could lead to host compromise, disruption of virtualized services, exposure of sensitive workloads, and possible access to other guest systems hosted on the same platform.
The vulnerability is especially serious for organizations using shared virtualization infrastructure, private clouds, hosting platforms, development environments, or multi-tenant systems. A single compromised guest could create risk for the underlying host and other business-critical workloads.

WORKAROUND:
No mitigations or workarounds are available. Apply the applicable Microsoft security update.

URGENCY:
This vulnerability is rated Critical with a CVSS v3.1 Base Score of 9.9. It could allow an attacker with access to a guest virtual machine to cross into the host system without user interaction. Although exploitation is currently assessed as less likely and no active exploitation is confirmed, the potential failure of the guest-to-host security boundary makes this patch a high priority for Hyper-V and virtualization hosts.

Critical or Zero Day – Immediate DeploymentCheckpoint Quantum Security Gateway

“When authentication fails silently, the VPN becomes the attacker’s front door.”

Check Point patched CVE-2026-50751 in Quantum Security Gateway. This logic flow weakness in Remote Access and Mobile Access certificate validation within the deprecated IKEv1 key exchange process allows an unauthenticated remote attacker to bypass user authentication and establish a VPN connection without a valid user password. The CVSS score is 9.3, which is Critical severity.

The vulnerability directly impacts remote access controls and can provide unauthorized access to protected network resources. The issue requires no valid credentials and no user interaction. Active exploitation has been reported.

Critical or Zero Day – Immediate DeploymentFortiSandbox

“A sandbox should contain threats, not become the path for command execution.”

Fortinet patched CVE-2026-25089 in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. This OS command injection vulnerability could allow an unauthenticated attacker to execute unauthorized commands through specially crafted HTTP requests. The CVSS score is 9.1, which is Critical severity.

The issue enables remote code execution and affects multiple FortiSandbox release branches. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentAdobe Campaign Classic

“These bugs put Adobe Campaign Classic at direct risk of full-impact compromise without user interaction.”

Adobe patched two Critical vulnerabilities in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier. CVE-2026-48303 is an incorrect authorization vulnerability that could allow arbitrary code execution in the context of the current user. CVE-2026-47938 is a server-side request forgery vulnerability that could result in privilege escalation. CVE-2026-48303 has a CVSS score of 10.0, which is Critical severity. CVE-2026-47938 has a CVSS score of 10.0, which is Critical severity.

Exploitation does not require user interaction, which raises business risk for exposed or poorly controlled deployments. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentSplunk Enterprise

“A service without authentication can turn a trusted platform into an easy target.”

Splunk patched CVE-2026-20253 in Splunk Enterprise and Splunk Cloud Platform. This vulnerability exists in a PostgreSQL sidecar service endpoint that lacks authentication controls, allowing any network-reachable attacker to create or truncate arbitrary files without providing credentials. The CVSS score is 9.8, which is Critical severity.

The issue can allow unauthorized modification of files and may impact the confidentiality, integrity, and availability of affected systems. Because the vulnerable endpoint is accessible without authentication, organizations should prioritize remediation of exposed deployments. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentFortiSandbox

“Security tools lose their value when attackers can turn them into command execution platforms.”

Fortinet patched CVE-2026-25089 in FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS. This OS command injection vulnerability (CWE-78) could allow an unauthenticated attacker to execute unauthorized commands through specially crafted HTTP requests. The CVSS score is 9.1, which is Critical severity.

The vulnerability affects FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, all FortiSandbox 4.2 versions, FortiSandbox Cloud 5.0.4 through 5.0.5, and FortiSandbox PaaS 5.0.4 through 5.0.5. Successful exploitation could allow remote code execution without requiring authentication or user interaction. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentIvanti Sentry

“These vulnerabilities put Ivanti Sentry at risk of root-level compromise and full admin takeover.”

Ivanti patched two Critical vulnerabilities in Sentry before versions R10.5.2, R10.6.2, and R10.7.1. CVE-2026-10520 is an OS command injection vulnerability that allows a remote unauthenticated attacker to achieve root-level remote code execution. CVE-2026-10520 has a CVSS score of 10.0, which is Critical severity. CVE-2026-10523 is an authentication bypass vulnerability that allows a remote unauthenticated attacker to create arbitrary administrative accounts and gain full administrative access. CVE-2026-10523 has a CVSS score of 9.9, which is Critical severity.

Active exploitation has been reported for CVE-2026-10520. No verified exploitation has been confirmed for CVE-2026-10523.

Critical or Zero Day – Immediate DeploymentSAP NetWeaver / Spring Security

“These critical patches close serious paths to data exposure, service disruption, and platform compromise.”

SAP and VMware patched four Critical vulnerabilities across SAP NetWeaver, ABAP Platform, SAP NetWeaver Application Server Java, and Spring Security. CVE-2026-44748 has a CVSS score of 9.9, which is Critical severity. CVE-2026-27671 has a CVSS score of 9.8, which is Critical severity. CVE-2026-22732 has a CVSS score of 9.1, which is Critical severity. CVE-2026-40128 has a CVSS score of 9.0, which is Critical severity.

The SAP vulnerabilities cover signed XML tampering, improper RFC protocol validation, and path traversal through malicious HTTP logon requests. These issues can lead to unauthorized access, memory corruption, data exposure, and service disruption. The Spring Security issue can prevent expected HTTP security headers from being written. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentPeopleSoft Enterprise PeopleTools

“A vulnerable management interface can turn a business platform into an attacker-controlled system.”

Oracle patched CVE-2026-35273 in PeopleSoft Enterprise PeopleTools. This vulnerability affects the Updates Environment Management component in supported versions 8.61 and 8.62. An unauthenticated attacker with network access over HTTP can exploit the vulnerability to compromise PeopleSoft Enterprise PeopleTools. The CVSS score is 9.8, which is Critical severity.

Successful exploitation can result in complete takeover of the affected PeopleSoft Enterprise PeopleTools environment, with high impact to confidentiality, integrity, and availability. The vulnerability requires no authentication and no user interaction. Active exploitation has been reported.

Critical or Zero Day – Immediate DeploymentChrome

“Active Chrome exploitation turns browser patching into an immediate security priority.”

Chrome has been updated to address multiple vulnerabilities across browser components including V8, Blink, Autofill, GPU, Navigation, DevTools, FileSystem, Bluetooth, Skia, CSS, Dawn, Passwords, and Web Authentication. Several vulnerabilities are High severity, including active exploitation cases tied to code execution, memory corruption, and sandboxed execution paths. CVE-2026-13022 has no listed CVSS base score.

This update also includes Medium severity issues involving same-origin policy bypass, site isolation bypass, and information disclosure. Active exploitation is reported for CVE-2026-11645, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281, making this a high-priority browser update.

Critical or Zero Day – Immediate DeploymentQuantum Security Gateway

“A VPN login bypass turns the front door into an open path for attackers.”

Check Point patched CVE-2026-50751 in Quantum Security Gateway. This logic flow weakness affects Remote Access and Mobile Access certificate validation in the deprecated IKEv1 key exchange process. It allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password. The CVSS score is 9.3, which is Critical severity.

This vulnerability impacts VPN authentication and can allow unauthorized remote access into protected environments. Active exploitation has been reported.

Critical or Zero Day – Immediate DeploymentAdobe Campaign Classic (ACC)

“Critical weaknesses in campaign infrastructure can quickly become pathways to broader enterprise compromise.”

Adobe patched two Critical vulnerabilities in Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier. CVE-2026-47938 is a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. CVE-2026-48303 is an incorrect authorization vulnerability that could allow arbitrary code execution in the context of the current user. Both vulnerabilities have a CVSS score of 10.0, which is Critical severity.

Neither vulnerability requires user interaction, increasing the risk to exposed deployments. Successful exploitation could allow attackers to escalate privileges, bypass authorization controls, or execute code within the affected environment. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentCisco Catalyst SD-WAN

“When management systems can be manipulated, attackers can turn routine administration into a path to root access.”

Cisco patched two vulnerabilities affecting Catalyst SD-WAN components. CVE-2026-20262 has a CVSS score of 6.5, which is Medium severity. CVE-2026-20245 has a CVSS score of 7.8, which is High severity.

CVE-2026-20262 affects Cisco Catalyst SD-WAN Manager and allows an authenticated attacker to create or overwrite arbitrary files through improper validation during file uploads. The vulnerability could be leveraged to elevate privileges and obtain root access. CVE-2026-20245 affects Catalyst SD-WAN Controller, Manager, and Validator components and allows a privileged attacker to execute arbitrary commands as root through a crafted file upload. Successful exploitation can lead to command execution and full control of the affected system.

Active exploitation has been reported for both vulnerabilities. Cisco has observed limited exploitation of CVE-2026-20245 resulting in configuration changes being pushed to edge devices.

High with EoP or RCE – Expedited DeploymentMicrosoft 365 Apps for Mac

“Office document risks can quickly become code execution and privilege exposure risks.”

This patch addresses eight vulnerabilities in Microsoft 365 Apps for Mac. The update covers memory handling, race condition, type confusion, out-of-bounds read, heap overflow, numeric truncation, and use-after-free issues. Several of these vulnerabilities may allow remote code execution through crafted content, while others create privilege or stability risks.

CVE-2026-44817 has a CVSS score of 7.8, which is High severity. CVE-2026-44818 has a CVSS score of 7.0, which is High severity. CVE-2026-44819 has a CVSS score of 7.8, which is High severity. CVE-2026-44820 has a CVSS score of 7.8, which is High severity. CVE-2026-44821 has a CVSS score of 5.5, which is Medium severity. CVE-2026-44822 has a CVSS score of 8.2, which is High severity. CVE-2026-44823 has a CVSS score of 7.8, which is High severity. CVE-2026-44824 has a CVSS score of 7.8, which is High severity.

No verified exploitation has been reported.

Critical or Zero Day – Immediate DeploymentOracle Identity Manager & Identity Manager Connector

“Identity systems sit at the center of trust, making critical vulnerabilities impossible to ignore.”

This patch addresses multiple vulnerabilities in Oracle Identity Manager and Oracle Identity Manager Connector components. The update includes five vulnerabilities affecting Oracle Identity Manager and four vulnerabilities affecting Oracle Identity Manager Connector. These products manage authentication, provisioning, and identity lifecycle operations across enterprise environments, making them high-value targets for attackers.

CVE-2026-46807 has a CVSS score of 9.8, which is Critical severity. CVE-2026-35268 has a CVSS score of 9.9, which is Critical severity. CVE-2026-35265 has a CVSS score of 8.8, which is High severity. CVE-2026-35267 has a CVSS score of 8.8, which is High severity. CVE-2026-35269 has a CVSS score of 7.5, which is High severity.

For Oracle Identity Manager Connector, CVE-2026-35294 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46792 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46793 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46794 has a CVSS score of 9.9, which is Critical severity.

No verified exploitation has been reported for these vulnerabilities. However, the presence of multiple Critical severity vulnerabilities within identity and access management infrastructure significantly increases organizational risk and warrants prompt remediation.

Critical or Zero Day – Immediate DeploymentJD Edwards EnterpriseOne Accounts Payable & General Ledger

“Critical ERP vulnerabilities can put core financial operations directly at risk.”

This patch addresses three vulnerabilities in Oracle JD Edwards EnterpriseOne financial applications. CVE-2026-46908 and CVE-2026-46891 affect Accounts Payable, while CVE-2026-46893 affects General Ledger. These systems support sensitive financial workflows, making successful compromise especially serious for enterprise operations.

CVE-2026-46908 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46891 has a CVSS score of 8.1, which is High severity. CVE-2026-46893 has a CVSS score of 9.9, which is Critical severity.

No verified exploitation has been reported. The presence of two Critical severity vulnerabilities in financial application components raises the urgency of applying the patch across affected JD Edwards environments.

Critical or Zero Day – Immediate DeploymentMySQL Server, MySQL NDB Cluster, MySQL Router & MySQL Shell

“When critical database infrastructure vulnerabilities stack up, the risk extends far beyond the database itself.”

This patch addresses multiple vulnerabilities across Oracle MySQL Server, MySQL NDB Cluster, MySQL Router, and MySQL Shell. These components form the foundation of many enterprise database environments, supporting data storage, routing, clustering, administration, and management functions. The update includes both Critical and High severity vulnerabilities affecting key parts of the MySQL ecosystem.

CVE-2026-46863 has a CVSS score of 7.5, which is High severity. CVE-2026-46861 has a CVSS score of 9.6, which is Critical severity. CVE-2026-46860 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46862 has a CVSS score of 7.5, which is High severity. CVE-2026-46850 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46870 has a CVSS score of 8.5, which is High severity.

The most severe vulnerabilities affect MySQL Shell, MySQL Router, and MySQL NDB Cluster, with CVSS scores ranging from 9.6 to 9.9. No verified exploitation has been reported. However, the concentration of Critical severity vulnerabilities across core database infrastructure makes this a high-priority update for organizations operating MySQL environments.

Critical or Zero Day – Immediate DeploymentOracle Access Manager

“Access management weaknesses can put the front door of the enterprise at risk.”

This patch addresses two vulnerabilities in Oracle Access Manager. The update covers CVE-2026-35313 and CVE-2026-35314, affecting a core identity and access control platform used to manage authentication and application access across enterprise environments.

CVE-2026-35313 has a CVSS score of 9.9, which is Critical severity. CVE-2026-35314 has a CVSS score of 7.3, which is High severity.

No verified exploitation has been reported. The Critical severity rating makes this a high-priority update for organizations using Oracle Access Manager, especially where the platform protects business-critical applications and identity workflows.

Critical or Zero Day – Immediate DeploymentRed Hat Enterprise Linux 10

“Media and system utility bugs can become serious attack paths when they reach trusted Linux workloads.”

Red Hat Enterprise Linux 10 has been updated to address eleven High severity vulnerabilities affecting GStreamer, cifs-utils, and libaom components. CVE-2026-52720 has a CVSS score of 8.8, which is High severity. CVE-2026-12505 has a CVSS score of 7.8, which is High severity. CVE-2026-52719, CVE-2026-52722, CVE-2026-53703, CVE-2026-53704, CVE-2026-56209, CVE-2026-56210, and CVE-2026-56211 each have a CVSS score of 7.1, which is High severity. CVE-2026-53705 and CVE-2026-56208 each have a CVSS score of 7.6, which is High severity.

The patch covers memory corruption, out-of-bounds read and write issues, SQL-adjacent media parsing risks, local privilege escalation through cifs-utils, and codec vulnerabilities that could lead to crashes, information disclosure, privilege escalation, or code execution in exposed processing paths.

Critical or Zero Day – Immediate DeploymentLinux Kernel

“Fixing dozens of kernel bugs at once closes far more doors than attackers can open.”

This security update addresses multiple Critical vulnerabilities in the Linux kernel, including CVE-2026-52914, CVE-2026-52924, CVE-2026-52931, CVE-2026-52955, CVE-2026-52982, CVE-2026-52986, CVE-2026-52989, CVE-2026-52993, CVE-2026-53002, CVE-2026-53006, CVE-2026-53010, CVE-2026-53045, CVE-2026-53046, CVE-2026-53049, CVE-2026-53055, CVE-2026-53086, CVE-2026-53088, CVE-2026-53151, CVE-2026-53175, CVE-2026-53176, CVE-2026-53215, CVE-2026-53216, CVE-2026-53221, CVE-2026-53228, CVE-2026-53246, CVE-2026-53247, CVE-2026-53260, and CVE-2026-53309. Each vulnerability has a CVSS score of 9.8, which is Critical severity.

The vulnerabilities affect multiple Linux kernel subsystems, including networking, memory management, storage, file systems, SCTP, Netfilter, SMB, Ceph, device drivers, XDP, virtualization, and protocol handling. The issues include use-after-free conditions, out-of-bounds memory access, double-free conditions, buffer validation failures, memory corruption, race conditions, integer overflows, and denial-of-service scenarios. Together, these flaws can impact kernel stability, availability, and the integrity of affected systems.

The update strengthens memory safety, improves bounds checking, corrects reference counting, fixes race conditions, validates protocol data, and hardens multiple kernel components against malformed input and unsafe memory operations. There is no verified evidence of active real-world exploitation or a public proof-of-concept for any of these vulnerabilities.

Critical or Zero Day – Immediate DeploymentApple iOS and iPadOS

“Protecting the kernel protects everything that runs on top of it.”

This update addresses three vulnerabilities affecting Apple iOS and iPadOS. CVE-2026-43724 has a CVSS score of 9.8, which is Critical severity, and could allow an application to write to kernel memory or cause an unexpected system termination. CVE-2026-39868 has a CVSS score of 9.1, which is Critical severity, and could allow an application to corrupt kernel memory or unexpectedly terminate the system. CVE-2026-43722 has a CVSS score of 5.5, which is Medium severity, and could allow an application to leak sensitive kernel state.

The update improves input validation and input sanitization to strengthen kernel protections, prevent memory corruption, and reduce the risk of system instability. These vulnerabilities are fixed in iOS 26.5.2, iPadOS 26.5.2, and macOS Tahoe 26.5.2. There is no verified evidence of active real-world exploitation or a public proof-of-concept for any of these vulnerabilities.

Critical or Zero Day – Immediate DeploymentOracle Payments

“A critical vulnerability under active attack leaves little room for delay.”

This update addresses CVE-2026-46817, a critical vulnerability affecting Oracle Payments. The CVSS score is 9.8, which is Critical severity. Oracle has released a fix for this vulnerability as part of its security updates.

Oracle has not publicly disclosed technical details describing the vulnerability. Active exploitation has been confirmed, making timely deployment of the available update essential to reduce exposure. The update mitigates the identified security risk in affected Oracle Payments deployments.

Critical or Zero Day – Immediate DeploymentCisco Identity Services Engine Software

“Identity platforms become high-value targets when attackers can reach the operating system or expose sensitive authentication data.”

Cisco patched two vulnerabilities affecting Cisco Identity Services Engine (ISE) and ISE-PIC. CVE-2026-20181 has a CVSS score of 9.1, which is Critical severity. CVE-2026-20190 has a CVSS score of 7.5, which is High severity.

CVE-2026-20181 is an input validation vulnerability that allows an authenticated administrator to execute arbitrary commands on the underlying operating system through crafted HTTP requests. Successful exploitation can provide user-level OS access and subsequent privilege escalation to root. In single-node deployments, exploitation could also cause a denial-of-service condition that prevents new endpoints from authenticating to the network. CVE-2026-20190 is an authorization weakness that allows an unauthenticated remote attacker to access sensitive information, including hashed credentials that could be leveraged in future attacks.

No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentSolarWinds Serv-U

“A simple network request should never be able to take down a critical file transfer service.”

SolarWinds patched CVE-2026-28318 in Serv-U. This vulnerability allows an unauthenticated attacker to send specially crafted POST requests using Content-Encoding: deflate that can crash the Serv-U service, resulting in a denial-of-service condition. The CVSS score is 7.5, which is High severity.

This issue does not require authentication or user interaction to exploit. Active exploitation has been reported. SolarWinds has provided mitigation guidance for customers who cannot immediately deploy the update.

Critical or Zero Day – Immediate DeploymentLiteLLM

“An AI gateway becomes a system gateway when users can execute commands on the host.”

BerriAI patched CVE-2026-42271 in LiteLLM. Versions 1.74.2 through 1.83.6 allowed authenticated users to abuse MCP server testing endpoints to execute arbitrary commands on the host running the LiteLLM proxy. The vulnerable endpoints accepted full server configurations and could spawn attacker-supplied commands as subprocesses with the privileges of the proxy process. The CVSS score is 8.7, which is High severity.

The issue stems from insufficient authorization controls on MCP preview functionality. Any authenticated user with a valid proxy API key, including low-privilege internal users, could execute commands on the underlying system. This vulnerability enables remote code execution and has been patched in version 1.83.7. Active exploitation has been reported.

High with EoP or RCE – Expedited DeploymentAcrobat Reader

“A single malicious PDF can turn a routine document review into a security event.”

Adobe released updates for Acrobat Reader to address multiple vulnerabilities affecting versions 24.001.30365, 26.001.21651, and earlier. The update resolves several memory corruption issues, including out-of-bounds write and Use After Free vulnerabilities that could result in arbitrary code execution in the context of the current user when a victim opens a malicious file. The patch also addresses information disclosure vulnerabilities and an uncontrolled search path issue that could lead to code execution.

CVE-2026-47911, CVE-2026-47912, CVE-2026-47913, CVE-2026-47915, and CVE-2026-47916 each have a CVSS score of 7.8, which is High severity. CVE-2026-47937 has a CVSS score of 7.4, which is High severity. CVE-2026-47923 and CVE-2026-47924 each have a CVSS score of 5.5, which is Medium severity.

The highest risk vulnerabilities could allow arbitrary code execution after a user opens a specially crafted PDF file. The remaining vulnerabilities could expose sensitive memory contents or enable privilege-related abuse. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed for these vulnerabilities.

High with EoP or RCE – Expedited DeploymentCortex XSIAM CommvaultSecurityIQ Marketplace

“When credentials are not validated correctly, protected resources stop being protected.”

Palo Alto Networks patched CVE-2026-0274 in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM. This improper credential validation vulnerability could allow an unauthenticated attacker to access and modify protected resources without authorization. The CVSS score is 8.1, which is High severity.

The vulnerability impacts authentication controls and can lead to unauthorized access to sensitive resources. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentLangflow

“A file upload feature becomes dangerous when attackers can choose where files land.”

Langflow patched CVE-2026-5027 in the POST /api/v2/files endpoint. The endpoint did not properly sanitize the filename parameter in multipart form data, allowing attackers to use path traversal sequences to write files to arbitrary locations on the filesystem. The CVSS score is 8.8, which is High severity.

This vulnerability can lead to unauthorized file writes and privilege-related abuse on affected systems. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentVeeam Backup and Replication

“Backup systems are trusted assets, which makes remote code execution vulnerabilities especially dangerous.”

Veeam patched CVE-2026-44963 in Backup and Replication. This deserialization vulnerability (CWE-502) allows remote code execution on the Backup Server by an authenticated domain user. The CVSS score is 9.4, which is Critical severity.

Successful exploitation could allow an attacker to execute arbitrary code on the Backup Server, potentially compromising backup operations and the broader environment. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentOpenSSL

“A signed message should verify trust, not create an opportunity for memory corruption.”

OpenSSL patched CVE-2026-45447, a use-after-free vulnerability affecting PKCS#7 and S/MIME signature verification. A specially crafted signed message can trigger incorrect handling of a caller-owned BIO during PKCS7_verify(), leading to a use-after-free condition. The CVSS score is 8.8, which is High severity.

Successful exploitation may result in application crashes, heap corruption, or potentially remote code execution depending on application behavior and memory allocation conditions. Applications using OpenSSL PKCS#7 APIs are affected, while applications using CMS APIs are not. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentTrane Tracer SC

“Building control systems become business risks when attackers can bypass trust and reach sensitive functions.”

Trane patched four vulnerabilities affecting Tracer SC, Tracer SC+, and Tracer Concierge. CVE-2026-28252 has a CVSS score of 9.2, which is Critical severity. CVE-2026-28253 has a CVSS score of 8.7, which is High severity. CVE-2026-28254 has a CVSS score of 6.9, which is Medium severity. CVE-2026-28255 has a CVSS score of 8.2, which is High severity.

The issues include risky cryptography that could allow authentication bypass and root-level access, excessive memory allocation that could cause denial of service, missing authorization that could expose sensitive information through unprotected APIs, and hard-coded credentials that could enable account takeover. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentCortex XSIAM CommvaultSecurityIQ Marketplace

“Authentication controls only work when credentials are validated correctly.”

Palo Alto Networks patched CVE-2026-0274 in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM. This improper credential validation vulnerability allows an unauthenticated attacker to access and modify protected resources without authorization. The CVSS score is 8.1, which is High severity.

Successful exploitation could allow attackers to bypass expected access controls and make unauthorized changes to protected resources. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentLangGraph / LangGraphJS

“AI workflow platforms become high-value targets when trust boundaries around data and queries break down.”

LangChain patched multiple vulnerabilities affecting LangGraph and LangGraphJS checkpoint implementations. CVE-2025-67644 has a CVSS score of 7.3, which is High severity. CVE-2026-28277 has a CVSS score of 6.8, which is Medium severity. CVE-2026-27022 has a CVSS score of 6.5, which is Medium severity.

The vulnerabilities include SQL injection in LangGraph SQLite Checkpoint, unsafe deserialization of checkpoint data, and query injection in the Redis checkpoint implementation. Successful exploitation could allow manipulation of database queries, bypass of intended access controls, or execution of malicious payloads when crafted checkpoint data is loaded. CVE-2025-67644 is fixed in version 3.0.1, and CVE-2026-27022 is fixed in version 1.0.2. No public patch is available for CVE-2026-28277.

Proof-of-concept code has been reported for CVE-2026-27022. No verified active exploitation has been confirmed for the other vulnerabilities.

Critical or Zero Day – Immediate DeploymentAdobe Experience Manager Forms JEE

“A form field should collect data, not become a path to account compromise.”

Adobe patched two Cross-Site Scripting vulnerabilities in Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0, and earlier. CVE-2026-34691 is a stored XSS vulnerability with a CVSS score of 9.3, which is Critical severity. CVE-2026-34693 is a reflected XSS vulnerability with a CVSS score of 8.0, which is High severity.

Successful exploitation could allow malicious JavaScript to run in a victim’s browser, potentially giving an attacker elevated access or control over the victim’s account or session. CVE-2026-34693 requires user interaction through a crafted URL or compromised web page. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentColdFusion

“ColdFusion vulnerabilities can turn trusted application workflows into paths for code execution and data exposure.”

Adobe patched multiple vulnerabilities in ColdFusion versions 2023.19, 2025.8, and earlier. CVE-2026-47928 has a CVSS score of 9.6, which is Critical severity. CVE-2026-47929 has a CVSS score of 8.4, which is High severity. CVE-2026-47930 has a CVSS score of 8.1, which is High severity. CVE-2026-47931 has a CVSS score of 8.4, which is High severity. CVE-2026-47932 has a CVSS score of 8.8, which is High severity. CVE-2026-47960 has a CVSS score of 7.4, which is High severity.

The update addresses improper input validation, incorrect authorization, path traversal, and XXE vulnerabilities. Successful exploitation could allow arbitrary code execution, security feature bypass, unauthorized file or directory access, or arbitrary file system reads. Some issues require user interaction through a malicious file, while others do not. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentDreamweaver Desktop

“Opening a malicious project file should never become a path to code execution or data exposure.”

Adobe patched multiple vulnerabilities in Dreamweaver Desktop version 21.7 and earlier. CVE-2026-47906 has a CVSS score of 8.6, which is High severity. CVE-2026-47907 has a CVSS score of 8.2, which is High severity. CVE-2026-47908 has a CVSS score of 7.8, which is High severity.

The vulnerabilities include a dependency on a vulnerable third-party component, improper access control, and an uninitialized pointer issue. Successful exploitation could result in arbitrary code execution or unauthorized access to sensitive files and directories. All three vulnerabilities require user interaction, as a victim must open a malicious file. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentAdobe InCopy

“A malicious file can turn a publishing workflow into a code execution risk.”

Adobe patched three High severity vulnerabilities in InCopy versions 21.3, 20.5.3, and earlier. CVE-2026-34706, CVE-2026-34707, and CVE-2026-34708 each have a CVSS score of 7.8, which is High severity.

The vulnerabilities include out-of-bounds write, heap-based buffer overflow, and stack-based buffer overflow issues. Successful exploitation could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentAdobe InDesign Desktop

“A malicious document can turn a creative workflow into a code execution opportunity.”

Adobe patched multiple vulnerabilities in InDesign Desktop versions 21.3, 20.5.3, and earlier. CVE-2026-34695, CVE-2026-34696, CVE-2026-34697, CVE-2026-34698, CVE-2026-34699, CVE-2026-34700, CVE-2026-34701, and CVE-2026-34702 each have a CVSS score of 7.8, which is High severity. CVE-2026-34703 has a CVSS score of 5.5, which is Medium severity.

The update addresses stack-based buffer overflows, heap-based buffer overflows, use-after-free conditions, out-of-bounds writes, and a NULL pointer dereference vulnerability. Successful exploitation could allow arbitrary code execution in the context of the current user or cause application denial of service. All vulnerabilities require user interaction, as a victim must open a malicious file. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentAdobe Substance3D – Sampler

“A crafted 3D asset can turn a creative workflow into a code execution risk.”

Adobe patched four High severity vulnerabilities in Substance3D – Sampler versions 6.0.0 and earlier. CVE-2026-34709, CVE-2026-34710, CVE-2026-48305, and CVE-2026-48306 each have a CVSS score of 7.8, which is High severity.

The vulnerabilities are out-of-bounds write issues that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High or Medium – Important DeploymentGitLab

“Collaboration platforms become security risks when trust boundaries between users and administrators break down.”

GitLab patched four High severity vulnerabilities affecting GitLab CE and EE. CVE-2026-10087 and CVE-2026-6552 each have a CVSS score of 8.7, which is High severity. CVE-2026-7250 has a CVSS score of 7.5, which is High severity. CVE-2026-8589 has a CVSS score of 7.3, which is High severity.

The vulnerabilities include cross-site scripting in the Analytics Dashboard, improper authorization in Group SAML identity management, denial-of-service through API request parsing, and improper input sanitization that could allow unauthorized email address additions to user accounts. Successful exploitation could lead to account takeover, execution of unauthorized client-side code, service disruption, or unauthorized account modifications. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentCVE-2026-50656 – Microsoft Defender Elevation of Privilege Vulnerability

“A locally exploited privilege escalation flaw can turn a limited foothold into full system control, allowing attackers to move from access to impact with alarming speed.”

Microsoft Defender contains an elevation of privilege vulnerability in the Microsoft Malware Protection Engine, publicly referred to as “RoguePlanet.” The vulnerability arises from improper link resolution before file access, which can allow an attacker with low privileges on a system to elevate their permissions and gain significantly greater control over the affected device. Microsoft has acknowledged the issue and is working on a security update.

CVSS Score: 7.8

SEVERITY: Important

THREAT:
An attacker who already has local access to a vulnerable system could exploit this flaw to obtain elevated privileges. Successful exploitation could provide access to sensitive data, allow modification of system settings, and enable further malicious activity on the compromised device.

EXPLOITS:
The vulnerability has been publicly disclosed. Microsoft reports that the vulnerability is not currently being exploited. No confirmed zero-day exploitation has been reported. Microsoft assesses exploitation as more likely, and the CVSS metrics indicate Functional exploit code maturity.

TECHNICAL SUMMARY:
The vulnerability is associated with CWE-59: Improper Link Resolution Before File Access (‘Link Following’). This class of flaw occurs when software follows symbolic links, junctions, or other filesystem redirections without properly validating the target resource. An attacker with low privileges may be able to manipulate file operations performed by the Microsoft Malware Protection Engine, causing privileged processes to access or modify unintended files. Because the vulnerability affects a security-sensitive component operating with elevated privileges, successful exploitation can result in high-impact consequences affecting confidentiality, integrity, and availability.

EXPLOITABILITY:
Affected systems include Microsoft Defender environments that use the vulnerable Microsoft Malware Protection Engine. Exploitation requires local access and low privileges but does not require user interaction. An attacker could leverage crafted filesystem links or redirections to influence privileged file operations and elevate permissions on the system.

BUSINESS IMPACT:
Privilege escalation vulnerabilities are frequently used as a second-stage attack after an initial compromise. A successful attacker could gain greater control over endpoints, disable security controls, access sensitive business information, alter critical files, or establish persistence. Even when remote access is not possible through the vulnerability itself, it can significantly increase the impact of other attacks and accelerate lateral movement within an environment.

WORKAROUND:
If a security update is not yet available or cannot be immediately deployed:

• Restrict local access to systems wherever possible.
• Enforce least-privilege access controls.
• Monitor for suspicious filesystem link creation and abnormal Defender-related activity.
• Ensure endpoint protection and detection capabilities are actively monitoring for privilege escalation attempts.

URGENCY:
Although the vulnerability is not currently reported as exploited, it has been publicly disclosed and Microsoft assesses exploitation as more likely. The flaw affects a security component and can enable elevation of privilege with low attack complexity, low required privileges, and no user interaction. Organizations should closely monitor for the availability of Microsoft’s security update and prioritize deployment once released.

Critical or Zero Day – Immediate DeploymentJoomla Content Editor (JCE)

“A content editor should manage content, not provide attackers a path to run code on the server.”

The Joomla Content Editor (JCE) extension for Joomla patched CVE-2026-48907, a Critical vulnerability that allows unauthenticated users to create new editor profiles and ultimately upload and execute PHP code. The CVSS score is 10.0, which is Critical severity.

Successful exploitation can lead to arbitrary code execution on the affected Joomla server, resulting in full compromise of the web application and potentially the underlying host. The vulnerability requires no authentication, significantly increasing the risk to exposed systems. Active exploitation has been reported.

Critical or Zero Day – Immediate DeploymentcPanel Plugin

“A shared hosting boundary is only effective when one user cannot influence another user’s files.”

LiteSpeed patched CVE-2026-54420 in the cPanel Plugin before version 2.4.8 and LiteSpeed WHM PlugIn before version 5.3.2.0. The vulnerability involves improper handling of user-provided symbolic links on shared hosting servers running CloudLinux/CageFS. The CVSS score is 8.5, which is High severity.

Successful exploitation could allow a user with FTP or web shell access on a shared hosting server to bypass intended isolation controls and access resources outside their authorized scope. This may lead to unauthorized access to data belonging to other users hosted on the same system. Active exploitation has been reported.

Critical or Zero Day – Immediate DeploymentSplunk AI Toolkit

“AI integrations create new opportunities for productivity, but also new paths to system compromise when controls fail.”

Splunk patched two vulnerabilities in Splunk AI Toolkit versions below 5.7.4. CVE-2026-20266 has a CVSS score of 9.1, which is Critical severity. CVE-2026-20265 has a CVSS score of 4.3, which is Medium severity.

The update addresses an OS command injection vulnerability caused by unsafe shell execution in the btool configuration helper and an outbound request control weakness caused by an insecure default domain allowlist. Successful exploitation of CVE-2026-20266 could allow an administrator to execute arbitrary operating system commands on the host running Splunk Enterprise. CVE-2026-20265 could allow a low-privileged user to trigger outbound HTTP requests to attacker-controlled infrastructure, creating a potential data exfiltration path.

No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate Deploymentaxios

“HTTP client weaknesses can turn trusted outbound requests into attacker-controlled traffic paths.”

Axios patched three vulnerabilities affecting proxy handling, header injection behavior, and prototype pollution gadget exposure. CVE-2026-42043 has a CVSS score of 7.2, which is High severity. CVE-2026-40175 has a CVSS score of 4.8, which is Medium severity. CVE-2026-42264 has a CVSS score of 7.4, which is High severity.

The vulnerabilities could allow NO_PROXY bypass, unsafe outbound request manipulation, header injection, or polluted configuration values being applied to HTTP requests. Proof-of-concept code has been reported for all three vulnerabilities.

Critical or Zero Day – Immediate DeploymentApache Tomcat

“Critical web server weaknesses can turn authentication and access controls into points of failure.”

Apache patched multiple Critical vulnerabilities in Apache Tomcat. CVE-2026-41293 has a CVSS score of 9.8, which is Critical severity. CVE-2026-43512 has a CVSS score of 9.8, which is Critical severity. CVE-2026-43515 has a CVSS score of 9.1, which is Critical severity.

The update addresses improper input validation, digest authentication bypass, and improper authorization when multiple method constraints define an HTTP method for the same extension. Successful exploitation could allow attackers to bypass authentication or authorization controls and gain access beyond intended restrictions. No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

High with EoP or RCE – Expedited DeploymentNGINX Open Source / NGINX Gateway Fabric

“Configuration and memory handling weaknesses can turn core infrastructure services into attack surfaces.”

F5 patched four High severity vulnerabilities affecting NGINX Open Source, NGINX Plus, and NGINX Gateway Fabric. CVE-2026-42530, CVE-2026-42055, CVE-2026-11311, and CVE-2026-50107 each have a CVSS score of 8.1, which is High severity.

The vulnerabilities include a use-after-free condition in the HTTP/3 QUIC module, a heap-based buffer overflow affecting HTTP/2 proxying, and two configuration injection vulnerabilities in NGINX Gateway Fabric. Successful exploitation could lead to worker process crashes, arbitrary code execution under specific conditions, or unauthorized injection of NGINX configuration directives through manipulated custom resource definitions.

No verified exploitation, zero-day activity, or public proof-of-concept activity has been confirmed.

Critical or Zero Day – Immediate DeploymentSimpleHelp

“When identity checks fail, attackers can become trusted users instantly.”

This patch addresses CVE-2026-48558 in SimpleHelp. The vulnerability affects SimpleHelp versions 5.5.15 and earlier, as well as 6.0 pre-release versions. An authentication bypass weakness in the OpenID Connect (OIDC) authentication flow allows identity tokens to be accepted without validating their cryptographic signatures. As a result, a remote, unauthenticated attacker can forge identity claims and obtain a fully authenticated technician session.

CVE-2026-48558 has a CVSS score of 10.0, which is Critical severity. The vulnerability is classified as CWE-347, Improper Verification of Cryptographic Signature. In affected deployments, attackers may gain technician-level access without valid credentials and potentially bypass multi-factor authentication controls. No user interaction is required.

Critical or Zero Day – Immediate Deploymentrclone

“One exposed setting can quietly remove every security check behind it.”

This patch addresses CVE-2026-41176 in rclone. The vulnerability affects versions 1.45.0 through 1.73.4 and stems from an authorization weakness in the RC endpoint options/set. The endpoint allows modification of global runtime configuration without requiring authentication. An unauthenticated attacker can disable RC authorization controls by setting rc.NoAuth=true, exposing administrative functionality that should normally be restricted.

CVE-2026-41176 has a CVSS score of 9.2, which is Critical severity. The vulnerability is classified as CWE-306, Missing Authentication for Critical Function. Successful exploitation can allow unauthorized access to sensitive configuration and operational management functions on affected RC servers. A public proof-of-concept (PoC) has been reported. Version 1.73.5 patches the issue.

High or Medium – Important DeploymentFirefox

“Memory corruption bugs may stay hidden until they become a path to code execution.”

This patch addresses three memory safety vulnerabilities in Mozilla Firefox and Thunderbird. CVE-2026-12326, CVE-2026-12327, and CVE-2026-12328 affect multiple Firefox, Firefox ESR, and Thunderbird releases. Mozilla reported that these issues involve memory safety defects that showed evidence of memory corruption. Such conditions can potentially be leveraged to execute arbitrary code under certain circumstances.

CVE-2026-12326 has a CVSS score of 8.1, which is High severity. CVE-2026-12327 has a CVSS score of 8.1, which is High severity. CVE-2026-12328 has a CVSS score of 8.1, which is High severity.

The vulnerabilities were corrected in Firefox 152, Thunderbird 152, Firefox ESR 140.12, Thunderbird ESR 140.12, and Firefox ESR 115.37, depending on the affected product branch. While no verified exploitation has been reported, the presence of memory corruption behavior increases the security risk and warrants prompt patching.

Critical or Zero Day – Immediate DeploymentCore Privileged Access Manager (BoKS)

“A privileged service with command injection risk can turn network access into system control.”

This patch addresses CVE-2026-9862 in Fortra Core Privileged Access Manager (BoKS). The vulnerability affects the boks_autoregisterd service and allows OS command injection during autoregistration processing. A remote attacker with network access to the service may execute commands using the privileges of the vulnerable service.

CVE-2026-9862 has a CVSS score of 9.8, which is Critical severity. The issue is classified as CWE-78, OS Command Injection. Remote Code Execution is possible, but no verified exploitation has been reported.

High with EoP or RCE – Expedited DeploymentMicrosoft Excel for Android

“One spreadsheet should never be enough to gain code execution or elevated access.”

This patch addresses three vulnerabilities in Microsoft Excel for Android. The update resolves an improper access control issue as well as two integer overflow vulnerabilities that could expose users to elevated privileges or code execution through specially crafted content.

CVE-2026-45649 has a CVSS score of 7.1, which is High severity. The vulnerability is classified as CWE-284 and may allow Elevation of Privilege.

CVE-2026-44803 has a CVSS score of 7.8, which is High severity. The vulnerability is classified as CWE-190 and may allow Remote Code Execution.

CVE-2026-44812 has a CVSS score of 7.8, which is High severity. The vulnerability is classified as CWE-190 and may allow Remote Code Execution.

No verified exploitation has been reported for these vulnerabilities. Organizations using Microsoft Excel for Android should apply the update to reduce the risk of malicious spreadsheet-based attacks and unauthorized privilege gains.

Critical or Zero Day – Immediate DeploymentJD Edwards EnterpriseOne Human Resources Management

“When HR systems face critical vulnerabilities, sensitive employee data and business operations are both at stake.”

This patch addresses CVE-2026-46892 in Oracle JD Edwards EnterpriseOne Human Resources Management. The vulnerability affects a core HR application used to manage employee information, workforce processes, and human resources operations within enterprise environments.

CVE-2026-46892 has a CVSS score of 9.1, which is Critical severity.

No verified exploitation has been reported. However, the Critical severity rating indicates a significant risk to affected environments and highlights the importance of applying the update to protect HR-related systems and sensitive workforce data.

Critical or Zero Day – Immediate DeploymentJD Edwards EnterpriseOne Order Promising

“A critical weakness in supply chain planning can quickly become a business continuity problem.”

This patch addresses CVE-2026-46907 in Oracle JD Edwards EnterpriseOne Order Promising. The vulnerability affects the Order Promising component, which plays a key role in inventory availability, fulfillment planning, and order management processes across enterprise environments.

CVE-2026-46907 has a CVSS score of 9.9, which is Critical severity.

No verified exploitation has been reported. However, the Critical severity rating indicates a significant risk to affected systems. Because Order Promising supports essential supply chain and fulfillment operations, organizations should prioritize remediation to reduce exposure and maintain operational integrity.

Critical or Zero Day – Immediate DeploymentJD Edwards EnterpriseOne Project Costing

“Critical risks in project costing systems can threaten financial control and delivery confidence.”

This patch addresses CVE-2026-46911 in Oracle JD Edwards EnterpriseOne Project Costing. The vulnerability affects a business-critical ERP component used to manage project budgets, costs, accounting, and financial tracking across enterprise operations.

CVE-2026-46911 has a CVSS score of 9.6, which is Critical severity.

No verified exploitation has been reported. The Critical severity rating makes this a high-priority update for organizations using JD Edwards Project Costing, especially where project financials support regulated, contractual, or revenue-impacting work.

Critical or Zero Day – Immediate DeploymentJD Edwards EnterpriseOne Tools

“A broad set of critical ERP tool vulnerabilities can put the business platform itself at risk.”

This patch addresses fourteen vulnerabilities in Oracle JD Edwards EnterpriseOne Tools. The update includes thirteen Critical severity vulnerabilities and one High severity vulnerability affecting a core ERP platform component that supports enterprise application operations, administration, and business workflows.

CVE-2026-46878, CVE-2026-46879, CVE-2026-46880, CVE-2026-46881, CVE-2026-46882, CVE-2026-46883, CVE-2026-46904, CVE-2026-46905, and CVE-2026-46909 each have a CVSS score of 9.8, which is Critical severity. CVE-2026-46906 has a CVSS score of 9.6, which is Critical severity. CVE-2026-46910 has a CVSS score of 9.1, which is Critical severity. CVE-2026-46912 and CVE-2026-46913 each have a CVSS score of 9.3, which is Critical severity. CVE-2026-46903 has a CVSS score of 8.8, which is High severity.

No verified exploitation has been reported. The volume and severity of these vulnerabilities make this a high-priority update for JD Edwards environments.

Critical or Zero Day – Immediate DeploymentOracle Agile PLM

“A critical vulnerability in product lifecycle management can expose the systems that drive product development and operations.”

This patch addresses CVE-2026-46859 in Oracle Agile PLM. The vulnerability affects Oracle’s Product Lifecycle Management platform, which is widely used to manage product data, engineering processes, manufacturing workflows, and compliance requirements across enterprise environments.

CVE-2026-46859 has a CVSS score of 9.8, which is Critical severity.

No verified exploitation has been reported. However, the Critical severity rating indicates a significant risk to affected environments. Because Agile PLM often serves as a central repository for product and engineering information, organizations should prioritize this update to reduce exposure and protect critical business operations.

Critical or Zero Day – Immediate DeploymentOracle Advanced Outbound Telephony

“Critical telephony platform risks can disrupt customer outreach and expose business operations.”

This patch addresses three vulnerabilities in Oracle Advanced Outbound Telephony. The update covers CVE-2026-46949, CVE-2026-46947, and CVE-2026-46950, affecting an enterprise communication platform used to support outbound customer engagement and telephony workflows.

CVE-2026-46949 has a CVSS score of 9.1, which is Critical severity. CVE-2026-46947 has a CVSS score of 8.8, which is High severity. CVE-2026-46950 has a CVSS score of 8.8, which is High severity.

No verified exploitation has been reported. The Critical severity rating makes this a high-priority update for organizations using Oracle Advanced Outbound Telephony in customer service, sales, or contact center operations.

Critical or Zero Day – Immediate DeploymentOracle Enterprise Command Center Framework

“Critical dashboard framework risks can expose the business systems leaders depend on every day.”

This patch addresses eight vulnerabilities in Oracle Enterprise Command Center Framework. The update includes seven Critical severity vulnerabilities and one High severity vulnerability affecting a framework used to deliver enterprise dashboards, analytics, and command center views across Oracle business applications.

CVE-2026-46895 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46896 has a CVSS score of 9.1, which is Critical severity. CVE-2026-46897 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46899 has a CVSS score of 9.6, which is Critical severity. CVE-2026-46900 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46901 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46902 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46898 has a CVSS score of 8.1, which is High severity.

No verified exploitation has been reported. The number and severity of these vulnerabilities make this a priority update for Oracle enterprise application environments.

Critical or Zero Day – Immediate DeploymentOracle Enterprise Manager Base Platform

“When the platform used to manage enterprise systems is exposed, the impact can reach every managed asset.”

This patch addresses multiple vulnerabilities in Oracle Enterprise Manager Base Platform. The update includes nine Critical severity vulnerabilities and three High severity vulnerabilities affecting Oracle’s centralized management platform used to monitor, administer, and control enterprise infrastructure and applications.

CVE-2026-46832 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46852 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46853 has a CVSS score of 9.6, which is Critical severity. CVE-2026-46854 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46855 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46856 has a CVSS score of 9.6, which is Critical severity. CVE-2026-46857 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46872 has a CVSS score of 9.0, which is Critical severity. CVE-2026-46875 has a CVSS score of 9.1, which is Critical severity.

CVE-2026-46864 has a CVSS score of 8.8, which is High severity. CVE-2026-46865 has a CVSS score of 8.2, which is High severity. CVE-2026-46866 has a CVSS score of 8.2, which is High severity.

No verified exploitation has been reported. The concentration of Critical severity vulnerabilities within a centralized management platform significantly increases organizational risk and makes this update a high priority for affected environments.

Critical or Zero Day – Immediate DeploymentOracle iSupport

“When customer support platforms face critical vulnerabilities, both service operations and customer trust are at risk.”

This patch addresses three vulnerabilities in Oracle iSupport. The update covers CVE-2026-46944, CVE-2026-46945, and CVE-2026-46946, affecting Oracle’s self-service customer support platform used for case management, service requests, knowledge access, and customer engagement.

CVE-2026-46944 has a CVSS score of 9.1, which is Critical severity. CVE-2026-46945 has a CVSS score of 9.1, which is Critical severity. CVE-2026-46946 has a CVSS score of 9.1, which is Critical severity.

No verified exploitation has been reported. The presence of multiple Critical severity vulnerabilities within a customer-facing support platform makes this a high-priority update for organizations relying on Oracle iSupport to deliver customer service operations.

Critical or Zero Day – Immediate DeploymentOracle Process Manufacturing Process Planning & Product Development

“Critical manufacturing system risks can disrupt planning, product development, and operational control.”

This patch addresses three vulnerabilities in Oracle Process Manufacturing components. CVE-2026-46942 affects Process Planning, while CVE-2026-46918 and CVE-2026-46916 affect Product Development. These systems support manufacturing workflows, formulation, planning, and product lifecycle operations.

CVE-2026-46942 has a CVSS score of 8.8, which is High severity. CVE-2026-46918 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46916 has a CVSS score of 8.8, which is High severity.

No verified exploitation has been reported. The Critical severity rating makes this a priority update for Oracle manufacturing environments.

Critical or Zero Day – Immediate DeploymentOracle Solaris

“A critical operating system vulnerability can place the foundation of enterprise infrastructure at risk.”

This patch addresses two vulnerabilities in Oracle Solaris. The update includes one Critical severity vulnerability and one High severity vulnerability affecting Oracle’s enterprise operating system platform, which supports critical servers, applications, and infrastructure services.

CVE-2026-46978 has a CVSS score of 10.0, which is Critical severity. CVE-2026-46914 has a CVSS score of 7.1, which is High severity.

No verified exploitation has been reported. The presence of a maximum-severity CVSS score of 10.0 makes this a high-priority update for organizations operating Oracle Solaris environments. Prompt remediation is recommended to reduce exposure across affected systems.

Critical or Zero Day – Immediate DeploymentOracle Unified Directory

“Critical directory service risks can weaken the identity backbone of the enterprise.”

This patch addresses three vulnerabilities in Oracle Unified Directory. The update includes two Critical severity vulnerabilities and one High severity vulnerability affecting Oracle’s directory services platform, which supports identity data, authentication flows, and enterprise access management.

CVE-2026-46773 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46774 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46776 has a CVSS score of 8.6, which is High severity.

No verified exploitation has been reported. The Critical severity ratings make this a high-priority update for organizations relying on Oracle Unified Directory for identity and access services.

Critical or Zero Day – Immediate DeploymentOracle Universal Work Queue

“Critical workflow vulnerabilities can disrupt the systems that keep business operations moving.”

This patch addresses four vulnerabilities in Oracle Universal Work Queue. The update includes two Critical severity vulnerabilities and two High severity vulnerabilities affecting a platform used to route, prioritize, and manage work items across enterprise business processes and service operations.

CVE-2026-46963 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46964 has a CVSS score of 9.9, which is Critical severity. CVE-2026-46965 has a CVSS score of 8.8, which is High severity. CVE-2026-46966 has a CVSS score of 7.5, which is High severity.

No verified exploitation has been reported. The presence of multiple Critical severity vulnerabilities within a workflow management platform makes this a high-priority update for organizations that depend on Oracle Universal Work Queue to support business-critical operations.

Critical or Zero Day – Immediate DeploymentOracle Virtual Directory

“A critical directory vulnerability can undermine the systems that connect users, applications, and data.”

This patch addresses CVE-2026-35312 in Oracle Virtual Directory. The vulnerability affects Oracle’s directory virtualization platform, which is commonly used to aggregate, manage, and present identity information from multiple directory sources across enterprise environments.

CVE-2026-35312 has a CVSS score of 9.8, which is Critical severity.

No verified exploitation has been reported. The Critical severity rating makes this a high-priority update for organizations that rely on Oracle Virtual Directory to support authentication, identity management, and directory integration services.

Critical or Zero Day – Immediate DeploymentOracle WebCenter Content

“This patch closes a large cluster of serious WebCenter Content risks before they can turn into business disruption.”

Oracle WebCenter Content has been updated to address 26 vulnerabilities across critical and high severity levels. The critical vulnerabilities are CVE-2026-35270, CVE-2026-35286, CVE-2026-35316, CVE-2026-35319, CVE-2026-35320, CVE-2026-35321, CVE-2026-35323, CVE-2026-46766, CVE-2026-46777, CVE-2026-46785, CVE-2026-46786, CVE-2026-46789, CVE-2026-46795, CVE-2026-46805, and CVE-2026-46813. Their CVSS scores are 9.1, 9.8, 9.9, 9.8, 9.0, 9.9, 9.9, 9.8, 9.1, 9.3, 9.6, 9.6, 9.3, 9.3, and 9.8, which are Critical severity.

The high severity vulnerabilities are CVE-2026-35315, CVE-2026-35317, CVE-2026-35322, CVE-2026-35324, CVE-2026-35325, CVE-2026-46787, CVE-2026-46788, CVE-2026-46804, CVE-2026-46806, CVE-2026-46808, and CVE-2026-35326. Their CVSS scores are 8.8, 8.8, 8.8, 8.8, 8.8, 8.0, 8.4, 8.7, 8.2, 8.7, and 7.2, which are High severity.

Critical or Zero Day – Immediate DeploymentOracle WebCenter Enterprise Capture

“When every vulnerability is critical, patching becomes a business priority, not just an IT task.”

Oracle WebCenter Enterprise Capture has been updated to address ten critical vulnerabilities affecting the platform. The update includes CVE-2026-46778 and CVE-2026-46781, each with a CVSS score of 10.0, which is Critical severity. CVE-2026-35280, CVE-2026-35281, CVE-2026-35282, CVE-2026-35283, CVE-2026-35284, CVE-2026-35285, CVE-2026-46779, and CVE-2026-46782 each have a CVSS score of 9.9, which is Critical severity.

This patch addresses a concentrated set of high-impact security weaknesses within Oracle WebCenter Enterprise Capture. All included vulnerabilities are rated Critical, creating a significant risk profile for affected deployments. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentOracle WebCenter Portal

“A portal with this many critical risks can expose the business fast.”

Oracle WebCenter Portal has been updated to address ten critical vulnerabilities affecting the platform. CVE-2026-46803 and CVE-2026-46846 each have a CVSS score of 10.0, which is Critical severity. CVE-2026-46765, CVE-2026-46767, CVE-2026-46802, CVE-2026-46814, CVE-2026-46838, CVE-2026-46844, and CVE-2026-46847 each have a CVSS score of 9.9, which is Critical severity. CVE-2026-46845 has a CVSS score of 9.8, which is Critical severity.

This patch addresses a concentrated set of severe security weaknesses in Oracle WebCenter Portal. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentOracle WebCenter Sites

“A public-facing content platform only needs one critical weakness to create a major business problem.”

Oracle WebCenter Sites has been updated to address eleven vulnerabilities spanning critical and high severity levels. CVE-2026-46798 and CVE-2026-46800 each have a CVSS score of 10.0, which is Critical severity. CVE-2026-35293, CVE-2026-35296, CVE-2026-46797, CVE-2026-46799, and CVE-2026-46801 each have a CVSS score of 9.8, which is Critical severity. CVE-2026-46809 has a CVSS score of 9.1, which is Critical severity.

The update also addresses several High severity vulnerabilities. CVE-2026-35318 has a CVSS score of 8.8, which is High severity. CVE-2026-46796 has a CVSS score of 8.0, which is High severity. CVE-2026-35295 has a CVSS score of 7.5, which is High severity. No verified exploitation information was provided for any of the vulnerabilities included in this update.

Critical or Zero Day – Immediate DeploymentPeopleSoft Enterprise PT PeopleTools

“A critical PeopleTools issue can put core business systems directly in the risk zone.”

PeopleSoft Enterprise PT PeopleTools has been updated to address eight vulnerabilities, including one Critical severity issue and seven High severity issues. CVE-2026-35278 has a CVSS score of 9.8, which is Critical severity. CVE-2026-35271 has a CVSS score of 8.7, which is High severity. CVE-2026-35272 has a CVSS score of 8.4, which is High severity. CVE-2026-35274 has a CVSS score of 8.2, which is High severity.

The update also covers CVE-2026-35276, CVE-2026-35279, and CVE-2026-35289, each with a CVSS score of 8.1, which is High severity. CVE-2026-35288 has a CVSS score of 8.2, which is High severity. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentPeopleSoft Enterprise PT PeopleTools

“A critical PeopleTools issue can put core business systems directly in the risk zone.”

PeopleSoft Enterprise PT PeopleTools has been updated to address eight vulnerabilities, including one Critical severity issue and seven High severity issues. CVE-2026-35278 has a CVSS score of 9.8, which is Critical severity. CVE-2026-35271 has a CVSS score of 8.7, which is High severity. CVE-2026-35272 has a CVSS score of 8.4, which is High severity. CVE-2026-35274 has a CVSS score of 8.2, which is High severity.

The update also covers CVE-2026-35276, CVE-2026-35279, and CVE-2026-35289, each with a CVSS score of 8.1, which is High severity. CVE-2026-35288 has a CVSS score of 8.2, which is High severity. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentSiebel Apps – Marketing

“A marketing system takeover risk can quickly become a customer data and business continuity problem.”

Siebel Apps – Marketing has been updated to address five vulnerabilities, including four Critical severity issues and one High severity issue. CVE-2026-46884, CVE-2026-46887, CVE-2026-46889, and CVE-2026-46890 each have a CVSS score of 9.8, which is Critical severity. CVE-2026-46886 has a CVSS score of 8.8, which is High severity.

This patch reduces serious exposure in the Siebel marketing environment and addresses vulnerabilities that could impact application control, data protection, and business operations.

Critical or Zero Day – Immediate DeploymentSiebel CRM Cloud Applications

“A single critical CRM vulnerability can put customer-facing operations at risk.”

Siebel CRM Cloud Applications has been updated to address five vulnerabilities, including one Critical severity issue and four High severity issues. CVE-2026-46919 has a CVSS score of 9.8, which is Critical severity. CVE-2026-46920 has a CVSS score of 8.1, which is High severity. CVE-2026-46921 has a CVSS score of 8.8, which is High severity. CVE-2026-46925 has a CVSS score of 8.3, which is High severity. CVE-2026-46926 has a CVSS score of 8.8, which is High severity.

This update addresses significant security weaknesses within the Siebel CRM Cloud Applications environment. The presence of a Critical severity vulnerability, combined with multiple High severity vulnerabilities, increases the potential impact to customer relationship management functions and associated business processes. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentWebLogic Server

“A critical WebLogic weakness can put core applications and business services in the blast zone.”

WebLogic Server has been updated to address twelve vulnerabilities, including five Critical severity issues and seven High severity issues. CVE-2026-35292 and CVE-2026-35301 each have a CVSS score of 10.0, which is Critical severity. CVE-2026-35263 has a CVSS score of 9.9, which is Critical severity. CVE-2026-35298 has a CVSS score of 9.1, which is Critical severity. CVE-2026-35300 has a CVSS score of 9.8, which is Critical severity.

The update also covers CVE-2026-35258 with a CVSS score of 8.7, CVE-2026-35259 with a CVSS score of 8.8, CVE-2026-35299 with a CVSS score of 8.8, CVE-2026-35302 with a CVSS score of 8.3, CVE-2026-35303 with a CVSS score of 8.8, CVE-2026-35311 with a CVSS score of 8.8, and CVE-2026-46848 with a CVSS score of 7.9, all of which are High severity.

Critical or Zero Day – Immediate DeploymentpgAdmin 4

“When an administration tool becomes the attack path, the database is no longer the only asset at risk.”

pgAdmin 4 has been updated to address four significant vulnerabilities, including three Critical severity issues and one High severity issue. CVE-2026-12045 has a CVSS score of 9.0, which is Critical severity. This vulnerability allows prompt injection against the AI Assistant to bypass read-only transaction protections and execute unauthorized SQL. In environments where the connected database role has elevated privileges, the issue can extend to remote code execution on the database server host. CVE-2026-12046 has a CVSS score of 9.0, which is Critical severity and affects unauthenticated access to state-changing endpoints that can contribute to remote code execution when combined with additional compromise conditions. CVE-2026-12048 has a CVSS score of 9.3, which is Critical severity and addresses stored cross-site scripting that could allow attackers to inject malicious content into the pgAdmin interface.

The update also addresses CVE-2026-12044, which has a CVSS score of 8.8, which is High severity. This vulnerability involves SQL injection in multiple administrative templates and dialogs. The patch introduces stronger validation, authentication enforcement, output sanitization, and query handling controls across the platform. No verified exploitation information was provided for these vulnerabilities.

Critical or Zero Day – Immediate DeploymentCisco Unified Communications Manager

“An exposed communications platform can become the first step toward full system compromise.”

Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition have been updated to address CVE-2026-20230. This vulnerability has a CVSS score of 8.6, which is High severity. The issue is caused by improper input validation that can allow an unauthenticated remote attacker to perform server-side request forgery (SSRF) attacks against an affected system.

A successful attack could allow an attacker to write files to the underlying operating system, creating a path for later privilege escalation to root. Public proof-of-concept code has been reported for this vulnerability. Cisco assigned the issue a Critical Security Impact Rating because successful exploitation can ultimately lead to root-level compromise. The vulnerability is only exploitable when the WebDialer service is enabled, which is disabled by default.

Critical or Zero Day – Immediate DeploymentLantronix EDS5000 / UniFi OS Server

“When critical vulnerabilities are actively exploited, every unpatched system becomes a potential target.”

Security updates address four critical vulnerabilities affecting Lantronix EDS5000 and UniFi OS Server. CVE-2025-67038 has a CVSS score of 9.8, which is Critical severity. It allows command injection through the HTTP RPC authentication process, enabling arbitrary operating system commands to execute with root privileges. CVE-2026-34908 has a CVSS score of 10.0, which is Critical severity and addresses an improper access control vulnerability that could allow unauthorized changes to UniFi OS systems. CVE-2026-34909 has a CVSS score of 10.0, which is Critical severity and addresses a path traversal vulnerability that could expose and manipulate sensitive system files. CVE-2026-34910 has a CVSS score of 10.0, which is Critical severity and addresses an improper input validation vulnerability that can result in command injection.

These vulnerabilities are reported as being under active exploitation, significantly increasing the operational risk to exposed devices. Organizations should prioritize deployment of the available security updates to reduce the risk of system compromise and unauthorized administrative access.

Critical or Zero Day – Immediate DeploymentPTC Windchill PDMLink

“A deserialization bug in a product lifecycle platform can quickly become a full enterprise compromise.”

PTC Windchill PDMLink has been updated to address CVE-2026-12569. This vulnerability has a CVSS score of 9.3, which is Critical severity. The issue stems from the deserialization of untrusted data and can allow remote code execution on affected systems. The vulnerability impacts Windchill PDMLink, PTC FlexPLM, all CPS versions, and Windchill and FlexPLM releases prior to version 11.0 M030.

This vulnerability is reported as being under active exploitation, making it a high-priority security issue. Organizations should prioritize deployment of the available security update to reduce the risk of remote system compromise and unauthorized code execution.

Critical or Zero Day – Immediate DeploymentCVE-2026-45585 – Windows BitLocker Security Feature Bypass Vulnerability

“When a security feature designed to protect data can be bypassed, stolen devices can become exposed devices. Strong encryption only works when its protections remain intact.”

Microsoft has published CVE-2026-45585, a Windows BitLocker Security Feature Bypass Vulnerability publicly referred to as YellowKey. Microsoft states that a proof-of-concept (PoC) for this vulnerability has been publicly disclosed before a security update became available. The company issued this CVE to provide mitigation guidance until security updates are installed. Systems using TPM+PIN are not vulnerable to exploitation according to Microsoft.

CVSS Score: 6.8

SEVERITY: MEDIUM

THREAT:

This vulnerability allows an attacker to bypass a Windows security feature designed to protect encrypted data. Successful exploitation could weaken BitLocker protections on vulnerable systems, particularly if a device is lost or stolen, potentially exposing sensitive information that organizations expect to remain encrypted.

EXPLOITS:

A public proof-of-concept (PoC) exploit exists. Microsoft specifically notes that the vulnerability became publicly known through the release of PoC code before coordinated disclosure was completed. The available data does not confirm active in-the-wild exploitation or a zero-day attack campaign.

TECHNICAL SUMMARY:

The vulnerability affects Microsoft BitLocker and is publicly known as YellowKey. Microsoft classifies it as a Security Feature Bypass vulnerability. The CVE record identifies the associated weakness as CWE-77: Improper Neutralization of Special Elements used in a Command (“Command Injection”). Microsoft has released mitigation guidance that can be implemented until the security update is applied. The advisory also confirms that devices configured to use TPM+PIN authentication are not exploitable by this vulnerability.

EXPLOITABILITY:

Affected products include:

• Windows 11 Version 24h3 (x64) – versions 10.0.26100.0 through 10.0.26100.8654
• Windows 11 Version 25h3 (x64) – versions 10.0.26200.0 through 10.0.26200.8654
• Windows 11 Version 26H1 (x64) – versions 10.0.28000.0 through 10.0.28000.2268
• Windows Server 2025 – versions 10.0.26100.0 through 10.0.26100.32994
• Windows Server 2025 (Server Core installation) – versions 10.0.26100.0 through 10.0.26100.32994

Microsoft states that systems using TPM+PIN are not susceptible to exploitation.

BUSINESS IMPACT:

Organizations relying on BitLocker to protect sensitive information on laptops and other portable devices could face increased risk if vulnerable systems are lost or stolen. A successful security feature bypass may reduce confidence in device encryption protections and increase the potential for unauthorized access to sensitive business information.

WORKAROUND:

If the security update cannot be applied immediately, Microsoft recommends implementing its published temporary mitigations. These mitigations do not impact service availability or management operations, and they do not need to be removed after the security update is installed. Organizations using TPM+PIN are not affected by this vulnerability.

URGENCY:

Although the CVSS severity is MEDIUM, the vulnerability has a publicly available proof-of-concept, increasing the likelihood of attempted exploitation. Organizations with portable Windows devices protected by BitLocker should prioritize applying Microsoft’s mitigations and security updates to reduce the risk of unauthorized access to encrypted data.

Critical or Zero Day – Immediate DeploymentManageEngine (CVE-2026-11374) 9.0

ManageEngine Authentication Security Update

“A predictable authentication token can turn a trusted login into an easy target.”

This security update addresses CVE-2026-11374, a critical authentication vulnerability affecting ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus. The issue allows an unauthenticated attacker to predict SSO tickets generated during authentication, potentially leading to account takeover.

The CVSS score is 9.0, which is Critical severity. No verified real-world exploitation or public proof-of-concept has been confirmed. The update strengthens the generation of SSO authentication tickets to prevent prediction and reduce the risk of unauthorized access.

Critical or Zero Day – Immediate Deploymentlibssh3 Security Update 

“One unchecked packet is all it takes to turn a secure connection into a security risk.”

This security update addresses CVE-2026-55200, a high-severity memory corruption vulnerability in libssh3. The issue exists in ssh3_transport_read(), where insufficient validation of the packet_length field can lead to an out-of-bounds heap write. A remote attacker can send a specially crafted SSH packet to corrupt memory, potentially resulting in remote code execution. The CVSS score is 8.1, which is High severity.

The update corrects the packet length validation logic to enforce proper bounds checking and prevent heap corruption. A public proof-of-concept has been confirmed for this vulnerability. There is no verified evidence of active real-world exploitation.

Critical or Zero Day – Immediate DeploymentIBM Langflow OSS 

“When authentication fails and code isolation breaks, attackers can take complete control.”

This security update addresses CVE-2026-10561 and CVE-2026-7664, two critical vulnerabilities affecting IBM Langflow OSS. CVE-2026-10561 combines an authentication bypass with improper isolation of Python execution, allowing an unauthenticated attacker to execute arbitrary code on the host system and potentially achieve complete system compromise. The CVSS score is 10.0, which is Critical severity.

CVE-2026-7664 is an authorization vulnerability that allows unauthenticated attackers to access protected MCP project resources and perform MCP operations through the Streamable MCP transport endpoint. The CVSS score is 9.8, which is Critical severity.

The update strengthens authentication, enforces proper authorization on MCP endpoints, and improves isolation of Python execution to prevent unauthorized access and arbitrary code execution. There is no verified evidence of active real-world exploitation or a public proof-of-concept for either vulnerability.

Critical or Zero Day – Immediate DeploymentDell Wyse Management Suite 

“One vulnerable management platform can become the gateway to an entire device fleet.”

This security update addresses five vulnerabilities affecting Dell Wyse Management Suite (WMS). CVE-2026-41120 is a Critical vulnerability that could allow a low-privileged remote attacker to achieve remote code execution through improper handling of untrusted data. The CVSS score is 9.8, which is Critical severity.

The update also addresses four High severity vulnerabilities. CVE-2026-49506 (CVSS 7.2) is a path traversal vulnerability that could allow a high-privileged remote attacker to achieve remote code execution. CVE-2026-44271 (CVSS 8.1) and CVE-2026-44272 (CVSS 8.8) are SQL injection vulnerabilities that could allow unauthorized access. CVE-2026-44274 (CVSS 7.8) is an improper link resolution vulnerability that could allow unauthorized access through local exploitation.

The update strengthens input validation, enforces secure file path handling, mitigates SQL injection risks, and improves file access protections across affected components. There is no verified evidence of active real-world exploitation or a public proof-of-concept for any of these vulnerabilities.

Critical or Zero Day – Immediate DeploymentAutodesk Fusion 

“A trusted desktop application should never become a bridge for malicious websites.”

This security update addresses CVE-2026-10789, a critical vulnerability affecting Autodesk Fusion. A maliciously crafted webpage visited while Autodesk Fusion Desktop is running with the MCP extension enabled can trigger arbitrary code execution. Successful exploitation allows code to run with the privileges of the current user. The CVSS score is 9.6, which is Critical severity.

The update strengthens the security of the MCP extension to prevent malicious webpages from triggering arbitrary code execution. There is no verified evidence of active real-world exploitation or a public proof-of-concept for this vulnerability.

Critical or Zero Day – Immediate DeploymentProgress Software LoadMaster 

“An exposed management API should never become an attacker’s command line.”

This security update addresses CVE-2026-8037, a critical OS command injection vulnerability affecting Progress Software LoadMaster. The vulnerability exists in the product’s API, where insufficient input sanitization in multiple command endpoints allows an unauthenticated attacker to execute arbitrary operating system commands on a vulnerable LoadMaster appliance. The CVSS score is 9.6, which is Critical severity.

The update strengthens input validation and sanitization across the affected API endpoints to prevent command injection and unauthorized remote code execution. A public proof-of-concept has been confirmed for this vulnerability. There is no verified evidence of active real-world exploitation.

High or Medium – Important DeploymentApple Safari

“A single webpage should never be able to bring down a trusted browser.”

This update addresses 30 vulnerabilities affecting Apple Safari. CVE-2026-43715 has a CVSS score of 8.8, which is High severity, and resolves a use-after-free vulnerability that could lead to memory corruption when processing maliciously crafted web content. CVE-2026-43707 has a CVSS score of 7.5, which is High severity, and addresses a memory corruption issue that could result in an unexpected process crash.

The update also resolves CVE-2026-43716 and CVE-2026-43745, each with a CVSS score of 6.5, which is Medium severity. These vulnerabilities address memory handling and out-of-bounds write issues that could cause unexpected Safari crashes when processing malicious web content. The fixes improve memory management and input validation to strengthen browser stability and resilience against crafted content. There is no verified evidence of active real-world exploitation or a public proof-of-concept for any of these vulnerabilities.

High or Medium – Important DeploymentNetScaler ADC

“A secure gateway depends on every exposed service handling untrusted traffic safely.”

This update addresses six vulnerabilities affecting NetScaler ADC and NetScaler Gateway. CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, and CVE-2026-13474 are High severity vulnerabilities with CVSS scores of 8.8, 8.8, 8.8, 7.1, and 8.7, respectively. CVE-2026-10817 has a CVSS score of 6.9, which is Medium severity.

The vulnerabilities include insufficient input validation, memory overread, memory overflow, arbitrary file read, and denial-of-service conditions. Depending on the deployment, affected systems configured as SAML Identity Providers, SSL VPN or AAA gateways, Oracle load balancers, DNS proxy or recursive resolvers, HTTP/2-enabled virtual servers, or management interfaces with enabled access may be vulnerable. The update strengthens input validation, memory handling, file access controls, and protocol processing to prevent unauthorized access, service disruption, and information disclosure. There is no verified evidence of active real-world exploitation or a public proof-of-concept for any of these vulnerabilities.

Critical or Zero Day – Immediate DeploymentLangflow

“An exposed API endpoint should never become an open door to your entire system.”

This update addresses CVE-2025-3248, a critical code injection vulnerability affecting Langflow versions prior to 1.3.0. The vulnerability exists in the /api/v1/validate/code endpoint, where a remote, unauthenticated attacker can send crafted HTTP requests to execute arbitrary code on the affected system. The CVSS score is 9.8, which is Critical severity.

The update removes the code injection weakness in the affected API endpoint, preventing unauthenticated attackers from executing arbitrary code. Active exploitation has been confirmed for this vulnerability. Organizations running affected Langflow versions should update to version 1.3.0 or later to mitigate the risk.

Webinar Recording: July 2026 Vulnerability Digest from Action1