Patch Tuesday November 2026

This BeyondTrust Remote Support update fixes an authentication bypass flaw in the product's internal components. The components fail to properly check where incoming messages come from. Under the right conditions, an attacker can exploit this to perform file operations on the appliance and gain elevated privileges. CVE-2026-102764 has a CVSS score of 9.3, Critical severity.

Attackers are actively exploiting CVE-2026-102764. Remote Support appliances have privileged access to the endpoints they manage, so a compromised appliance puts the wider environment at risk. Treat this update as an immediate priority.

This Cisco Secure Email update closes a critical flaw in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway. CVE-2026-76519 has a CVSS score of 9.8, Critical severity. The flaw comes from improper handling of email attachments when the file reputation service is enabled. An unauthenticated, remote attacker can send an email with a crafted attachment through an affected device. The attacker can then write arbitrary files and execute commands with root privileges on the underlying operating system.

Attackers are actively exploiting CVE-2026-76519. The exploit needs no credentials and no user interaction beyond delivering an email, so every exposed gateway is a direct target. Patch now.

This Discourse update closes three vulnerabilities across the open-source discussion platform, and attackers are actively exploiting CVE-2017-20290. That flaw, with a CVSS score of 6.1, Medium severity, is a reflected cross-site scripting bug in the email unsubscribe page that lets unauthenticated attackers run JavaScript in victims' browsers through a crafted link. It affects Discourse 1.9.0.beta2 before 1.9.0.beta13.

The two High severity flaws expose restricted content. CVE-2026-91156 has a CVSS score of 7.5, High severity, and lets authenticated users without Chat permission receive live and recent messages from read-restricted category chat channels. CVE-2026-91157 has a CVSS score of 7.5, High severity, and leaves media and attachments in newly restricted categories reachable by anonymous users through short upload URLs, including uploads tied to deleted topics. Versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9 fix both issues.

Gitea has patched nine vulnerabilities in its self-hosted Git service, four rated Critical and five rated High. Attackers are actively exploiting CVE-2026-59774, which has a CVSS score of 9.8, Critical severity: the Org-mode markup renderer follows INCLUDE directives into server-side files, so an unauthenticated attacker with a public repository can read any file the Gitea service account can reach, including the app.ini configuration and its internal token, then chain that access to modify a Git hook and execute commands as the service account. CVE-2026-120263 (CVSS 9.8, Critical) lets anyone with an account on a configured OAuth2 provider link their identity to another user's Gitea account, including an administrator, and sign in without its password when automatic account linking is enabled. CVE-2026-116289 and CVE-2026-117685 (both CVSS 9.1, Critical) let public-only access tokens register an organization runner that receives private repositories' workflow jobs, secrets, and variables, and mount private package blobs into public packages where anyone can download them.

The update also closes five High-severity flaws. CVE-2026-71184 and CVE-2026-73800 (both CVSS 8.8, High) let fork-controlled workflow code run on the base repository's runners with repository and organization secrets, bypassing the maintainer approval gate. CVE-2026-73804 (CVSS 8.1, High) turns a user-scoped token into unscoped API authentication by registering an attacker-controlled SSH key, and proof-of-concept code exists. CVE-2026-119441 (CVSS 7.5, High) lets a public-only token permanently delete an organization's private repositories, and CVE-2026-119533 (CVSS 7.5, High) exposes private pull request paths, titles, and states on project boards, even to anonymous visitors. Patch every Gitea instance immediately.

• Proof-of-concept code exists for the token-scope bypass that converts a user-scoped token into unscoped API access.
• Every internet-facing Gitea instance should be patched immediately because the exploited flaw requires no authentication.

Ivanti Connect Secure has three vulnerabilities that attackers are actively exploiting: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. CVE-2026-104935 has a CVSS score of 8.6, High severity; it is an authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands. CVE-2026-111357 has a CVSS score of 7.0, High severity; the dsinvoked broker trusts DSCache configuration data improperly, which leads to privilege escalation to root. CVE-2026-118527 has a CVSS score of 4.3, Medium severity; predictable filenames let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk.

Together, these flaws give attackers a path from no credentials to arbitrary commands and root-level control of the remote access gateway. This update fixes all three vulnerabilities and should be deployed immediately.

This Linux update fixes eleven Critical flaws in the kernel's networking, virtualization, storage, and file system code. Attackers are actively exploiting CVE-2026-99999, a flaw in IPv4 checksum handling where a packet with malformed checksum metadata can corrupt the network header. CVE-2026-99999 has a CVSS score of 9.3, Critical severity. The other fixes close use-after-free bugs in IPv4 TCP option handling (CVE-2026-98432, CVSS 9.8, Critical), RISC-V KVM vCPU teardown (CVE-2026-98464, CVSS 9.3, Critical), Open vSwitch connection-tracking helpers (CVE-2026-98490, CVSS 9.8, Critical), and SCTP stale-cookie processing, which any malicious SCTP peer can trigger with no privileges (CVE-2026-98548, CVSS 9.8, Critical).

The update also stops TCP from merging retransmitted segments across an encryption boundary, a flaw that can send PSP-protected data in cleartext or stall TLS-offloaded connections (CVE-2026-98549, CVSS 9.1, Critical). It repairs btrfs metadata corruption and lost extended attributes after a value is replaced (CVE-2026-98959, CVSS 9.8, Critical). It fixes stale AF_XDP buffer releases in the mlx5e driver that free buffers still in use (CVE-2026-99078 and CVE-2026-99079, each CVSS 9.8, Critical). Finally, it adds strict validation of task indexes that iSCSI targets supply, which prevents crashes, out-of-bounds reads, and SCSI reads falsely reported as complete (CVE-2026-99153 and CVE-2026-99154, each CVSS 9.8, Critical).

This PHP update fixes two critical memory-handling flaws that lead to remote code execution. CVE-2026-109618 has a CVSS score of 9.2, Critical severity. When PHP aborts a request after an out-of-memory error, some code paths leave request memory uninitialized, and the cleanup routine then reads that memory. CVE-2026-109619 has a CVSS score of 9.2, Critical severity. PHP global state can keep pointing at request memory after it is freed, so later requests act on stale data. Attackers can trigger either condition reliably to run code and gain elevated privileges.

Attackers are actively exploiting CVE-2026-109618 and CVE-2026-109619. PHP runs a large share of web applications, so every unpatched server is directly exposed. Treat this as an immediate patch priority.

Retool 3.88.0 fixes a cross-site scripting vulnerability in the /api/imageProxy endpoint. CVE-2024-58394 has a CVSS score of 6.1, Medium severity. An unauthenticated attacker can pass a link to an SVG file they host in the url parameter. Retool then serves that file from its own origin with no Content Security Policy, so the attacker's JavaScript runs inside the victim's session.

Attackers are actively exploiting CVE-2024-58394. Retool often connects directly to internal databases, APIs and business workflows, so a hijacked session gives attackers a trusted path into sensitive operations. Upgrade every Retool deployment to version 3.88.0 or later now.

This Weaver E-cology update fixes two High severity flaws that unauthenticated attackers can reach directly over the network. CVE-2021-48013 has a CVSS score of 7.5, High severity. It is a path traversal flaw in the /weaver/ln.FileDownload endpoint of E-cology 8.0, where crafted requests let attackers read arbitrary server files, including sensitive configuration such as WEB-INF/web.xml. CVE-2025-71434 has a CVSS score of 8.2, High severity. It is an SQL injection flaw in the /api/doc/out/more/list endpoint that affects E-cology 8.0, 9.0, and 10.0 before 10.76, and it lets attackers pull information straight from the backend database.

Attackers are actively exploiting CVE-2021-48013 and CVE-2025-71434. Together, these flaws expose server configuration and database contents to anyone who can reach the application. Patch immediately.

The Adobe Commerce update fixes seven vulnerabilities, five of them Critical, that put storefront code, admin sessions, and customer accounts at risk. The most severe, CVE-2026-103849, has a CVSS score of 10.0, Critical severity. It is a template engine injection flaw that allows arbitrary code execution without user interaction, and proof-of-concept code is available. CVE-2026-92909 has a CVSS score of 9.8, Critical severity, and CVE-2026-92464 has a CVSS score of 9.1, Critical severity. Both allow arbitrary code execution, CVE-2026-92909 through incorrect authorization and CVE-2026-92464 through improper input validation by an attacker with high privileges.

The update also closes two stored cross-site scripting flaws, CVE-2026-100133 and CVE-2026-91013, each with a CVSS score of 9.3, Critical severity. They let attackers inject scripts into form fields to take over victim sessions and accounts. Two authorization bypass flaws complete the fix: CVE-2026-92908 has a CVSS score of 8.3, High severity, and CVE-2026-92910 has a CVSS score of 7.2, High severity. Both give attackers unauthorized read and write access.

This update for Adobe Experience Manager 6.5 fixes an Improper Input Validation flaw, CVE-2026-105895, which has a CVSS score of 9.9, Critical severity. An attacker can use the flaw to run arbitrary code as the current user and possibly gain elevated access to, or control over, the victim's account or session.

The attack needs no user interaction, and its scope is changed, so the damage can reach beyond the vulnerable component. Organizations running Adobe Experience Manager 6.5 should treat this as a same-day priority and apply the update right away.

This Adobe Experience Manager 6.5 LTS update fixes five vulnerabilities, four of them Critical, that put the content platform and its users at risk. The most severe is an OS command injection flaw that lets a low-privileged attacker run arbitrary code with no user interaction. An incorrect authorization flaw can also lead to arbitrary code execution and elevated control over a victim's account or session. Two stored cross-site scripting flaws let attackers plant malicious scripts in form fields that run in the browsers of visitors, which can lead to account or session takeover. A path traversal flaw lets a low-privileged attacker write files to unauthorized locations on the file system. Every flaw has changed scope, so an attack can reach beyond the vulnerable component.

CVE-2026-103848 has a CVSS score of 9.9, Critical severity. CVE-2026-75732 has a CVSS score of 9.9, Critical severity. CVE-2026-106629 has a CVSS score of 9.3, Critical severity. CVE-2026-106630 has a CVSS score of 9.3, Critical severity. CVE-2026-106634 has a CVSS score of 7.7, High severity.

This Adobe ColdFusion 2025 update fixes 21 vulnerabilities, 10 Critical and 11 High. Most of them allow arbitrary code execution, and nearly all need no user interaction. They include code injection, unrestricted upload of dangerous files, server-side request forgery, path traversal through RDS, and a large set of incorrect authorization flaws. Low-privileged attackers can use these flaws to run code, bypass security controls, gain unauthorized write access, escalate privileges, or read sensitive files and memory.

Critical: CVE-2026-105899, CVE-2026-106622, and CVE-2026-106624 each have a CVSS score of 10.0, Critical severity. CVE-2026-105903 and CVE-2026-106612 each have a CVSS score of 9.9, Critical severity. CVE-2026-106620 and CVE-2026-75994 each have a CVSS score of 9.6, Critical severity. CVE-2026-90530 has a CVSS score of 9.3, Critical severity. CVE-2026-106621 has a CVSS score of 9.1, Critical severity. CVE-2026-106619 has a CVSS score of 9.0, Critical severity. High: CVE-2026-105901, CVE-2026-106089, CVE-2026-106090, CVE-2026-106615, CVE-2026-106617, and CVE-2026-106618 each have a CVSS score of 8.8, High severity. CVE-2026-71385 has a CVSS score of 8.4, High severity. CVE-2026-105898 has a CVSS score of 8.2, High severity. CVE-2026-106614 has a CVSS score of 7.8, High severity. CVE-2026-105994 has a CVSS score of 7.7, High severity. CVE-2026-106623 has a CVSS score of 7.5, High severity.

AnyDesk 8.0.3 fixes a heap-based buffer overflow in the session protocol's stream packet handler. CVE-2026-109390 has a CVSS score of 9.8, Critical severity. In mode 5, the handler does not validate a payload length value. An unauthenticated remote attacker can use this to execute arbitrary code, and on Linux this has been shown to give command execution as root without the victim ever approving desktop control.

Proof-of-concept code exists for CVE-2026-109390. Every AnyDesk installation before version 8.0.3 is exposed, so organizations should move all endpoints to 8.0.3 or later.

Apache Tomcat versions 11.0.27, 10.1.61, and 9.0.123 fix four vulnerabilities: three Critical and one High. The most serious flaw lets attackers log in without the correct password when the JNDI realm uses a non-GSSAPI SASL authentication mechanism. CVE-2026-101296 has a CVSS score of 9.1, Critical severity. Two more Critical flaws can leak data between users: an object recycling error in HTTP/2 processing of asynchronous servlets can mix up requests and responses between users, and a buffer under-read in large non-blocking writes can spill one response into the next request on the same connection. CVE-2026-101356 has a CVSS score of 9.1, Critical severity. CVE-2026-103119 has a CVSS score of 9.1, Critical severity.

The update also closes a race condition in the APR/Native connector that lets an unauthorized local user access the unix domain socket and gain elevated privileges. CVE-2026-80353 has a CVSS score of 8.1, High severity, and affects the 9.0 branch only. The authentication bypass also affects end-of-life 8.5 and 7.0 releases, which receive no fix; organizations still running them should move to a supported branch.

Argo CD versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 fix five vulnerabilities in the GitOps delivery tool's repo-server and application-controller. Four of them are Critical and one is High. CVE-2026-113672 has a CVSS score of 9.9, Critical severity: the Jsonnet importer can read any file the repo-server can access, including service-account tokens, private keys, and repository credentials. CVE-2026-113708 has a CVSS score of 9.9, Critical severity: a Kustomize argument injection lets an attacker run commands inside argocd-repo-server. CVE-2026-113709 has a CVSS score of 9.9, Critical severity: on deployments that enable Helm for Kustomize builds, a Helm plugin stored in a repository runs inside argocd-repo-server. CVE-2026-77459 has a CVSS score of 9.9, Critical severity: PostDelete hooks skip AppProject authorization checks, so the controller can create forbidden resources, including cluster-scoped ones, with its own cluster credentials.

CVE-2026-55797 has a CVSS score of 8.8, High severity: a shell command injection through an SSH proxy setting lets a user who can manage repositories run commands in the repo-server and take its Git, Helm, and OCI credentials. Several of these flaws need only Application get permission or write access to a Git repository, so an attacker with little access can reach the credentials behind the whole deployment pipeline.

Cisco Emergency Responder has received software hardening releases that fix five vulnerabilities found in an internal Cisco security review. The update closes an injection weakness, an authentication flaw, a cross-site scripting issue, an access control gap, and a path traversal weakness. Three of these flaws allow privilege escalation, so an attacker who gets a foothold could gain higher control over the platform.

CVE-2026-76473 has a CVSS score of 9.8, Critical severity. CVE-2026-76474 has a CVSS score of 9.8, Critical severity. CVE-2026-76475 has a CVSS score of 9.3, Critical severity. CVE-2026-76478 has a CVSS score of 8.8, High severity. CVE-2026-76479 has a CVSS score of 7.8, High severity. Emergency Responder supports emergency call routing and location tracking, so these servers should be patched the same day.

Cisco has released software hardening updates for Cisco TelePresence Video Communication Server (VCS) Expressway, covering Expressway-C and Expressway-E devices. The update fixes six vulnerabilities, led by a Critical flaw in the database service. Persistent cookies and missing client certificate validation in clustering let an unauthenticated remote attacker run operating system commands as root. CVE-2026-76466 has a CVSS score of 9.8, Critical severity.

The remaining five High severity flaws came out of an internal Cisco security review. They cover out-of-bounds writes, null pointer issues, code injection, incorrect permission assignments, and improper link resolution, which open paths to remote code execution and privilege escalation. CVE-2026-76490 has a CVSS score of 8.6, High severity. CVE-2026-76492 has a CVSS score of 7.5, High severity. CVE-2026-76494 has a CVSS score of 7.8, High severity. CVE-2026-76495 has a CVSS score of 7.8, High severity. CVE-2026-76496 has a CVSS score of 7.0, High severity.

Commvault Cloud has a critical input validation flaw in CVFS that affects command execution. CVE-2026-77099 has a CVSS score of 9.3, Critical severity. Commvault has fixed the issue in a maintenance release. Upgrade to the resolved maintenance release and update CVFS to close this exposure.

Eptura Archibus has two vulnerabilities that attackers can chain into unauthenticated code execution on the server. CVE-2026-107186 has a CVSS score of 8.6, High severity. It is an authentication bypass that lets an unauthenticated user send a crafted DWR request and run workflow rules without logging in. CVE-2026-107188 has a CVSS score of 9.6, Critical severity. It is an unrestricted file upload flaw that lets a user upload JSP code as a JSPX export report and then run commands by browsing to the file.

Used together, these flaws give an attacker with no credentials remote code execution on the Archibus server. That puts facility, real estate, and workplace data and connected business systems at risk. Patch both CVEs on the same day.

Esri Portal for ArcGIS has a critical authentication flaw that lets unauthenticated attackers reach certain Portal Administrator API endpoints under specific conditions. CVE-2026-69227 has a CVSS score of 9.8, Critical severity. The flaw stems from missing authentication for a critical function (CWE-306). It gives an outside attacker administrative functionality without credentials, which is an elevation of privilege.

This update closes the gap and restores authentication on the affected administrator endpoints. Portal for ArcGIS often holds an organization's geospatial data, user accounts, and sharing controls, so an attacker with admin-level access could change settings, alter content, or manage users. Apply this patch on a same-day basis.

Fortinet FortiSIEM 7.5.0 has a path traversal flaw that lets an attacker execute unauthorized code or commands with specially crafted packets. The flaw is classified as an elevation of privilege risk. CVE-2026-106173 has a CVSS score of 9.4, Critical severity.

Proof-of-concept code is public for CVE-2026-106173, which lowers the bar for attackers to weaponize it. FortiSIEM collects security data from across the network, so a compromised instance gives an attacker a foothold in the system meant to detect them. Patch it the same day.

This FreeBSD update fixes eight vulnerabilities across jail isolation, the TCP RACK stack, the bhyve hypervisor, and kernel IPC and kqueue handling. The most serious is CVE-2026-101306, which has a CVSS score of 9.8, Critical severity. It lets a jailed process clear a directory descriptor's restriction by passing it to itself over a Unix domain socket and escape the jail's filesystem root. CVE-2026-101307 has a CVSS score of 8.2, High severity. A remote attacker with a TCP connection to a system using the RACK stack can trigger a roughly 512 KB out-of-bounds write in the kernel heap, which may crash the kernel.

Three bhyve flaws in the xHCI, HDA audio, and framebuffer device models let a malicious guest crash the bhyve process or potentially run code in host userspace, within bhyve's Capsicum sandbox. CVE-2026-101309, CVE-2026-101310, and CVE-2026-101311 each have a CVSS score of 7.0, High severity. Three local kernel flaws let unprivileged users escalate privileges. CVE-2026-58098, a semaphore sequence-number wraparound in semop(2), has a CVSS score of 8.4, High severity. CVE-2026-58099 and CVE-2026-58100, race conditions in kqueue fork handling, each have a CVSS score of 7.0, High severity.

GitLab has released security updates for GitLab CE/EE that fix four vulnerabilities, including two Critical flaws that let unauthenticated attackers execute arbitrary code on the GitLab server. Attackers are actively exploiting CVE-2026-97229, which abuses a specially crafted regular expression in a CI/CD configuration to gain code execution. CVE-2026-97229 has a CVSS score of 10.0, Critical severity. CVE-2026-110264 has a CVSS score of 10.0, Critical severity, and achieves the same unauthenticated code execution through an integer overflow when GitLab compiles a crafted regular expression.

The update also closes two High severity authorization flaws in CI/CD pipelines. CVE-2026-16301 has a CVSS score of 8.5, High severity, and lets an authenticated user with the Developer role run pipelines on protected branches without authorization. CVE-2026-81839 has a CVSS score of 7.7, High severity, and lets an authenticated user in GitLab EE run arbitrary pipelines in a transferred project with the new group's privileges. With active exploitation underway and the server at the center of the build and release process, this update demands immediate deployment.

GitLab has released security updates for GitLab CE/EE that fix four vulnerabilities, including two Critical flaws that let unauthenticated attackers execute arbitrary code on the GitLab server. Attackers are actively exploiting CVE-2026-97229, which abuses a specially crafted regular expression in a CI/CD configuration to gain code execution. CVE-2026-97229 has a CVSS score of 10.0, Critical severity. CVE-2026-110264 has a CVSS score of 10.0, Critical severity, and achieves the same unauthenticated code execution through an integer overflow when GitLab compiles a crafted regular expression.

The update also closes two High severity authorization flaws in CI/CD pipelines. CVE-2026-16301 has a CVSS score of 8.5, High severity, and lets an authenticated user with the Developer role run pipelines on protected branches without authorization. CVE-2026-81839 has a CVSS score of 7.7, High severity, and lets an authenticated user in GitLab EE run arbitrary pipelines in a transferred project with the new group's privileges. With active exploitation underway and the server at the center of the build and release process, this update demands immediate deployment.

GitLab has released security updates for GitLab CE/EE that fix four vulnerabilities, including two Critical flaws that let unauthenticated attackers execute arbitrary code on the GitLab server. Attackers are actively exploiting CVE-2026-97229, which abuses a specially crafted regular expression in a CI/CD configuration to gain code execution. CVE-2026-97229 has a CVSS score of 10.0, Critical severity. CVE-2026-110264 has a CVSS score of 10.0, Critical severity, and achieves the same unauthenticated code execution through an integer overflow when GitLab compiles a crafted regular expression.

The update also closes two High severity authorization flaws in CI/CD pipelines. CVE-2026-16301 has a CVSS score of 8.5, High severity, and lets an authenticated user with the Developer role run pipelines on protected branches without authorization. CVE-2026-81839 has a CVSS score of 7.7, High severity, and lets an authenticated user in GitLab EE run arbitrary pipelines in a transferred project with the new group's privileges. With active exploitation underway and the server at the center of the build and release process, this update demands immediate deployment.

IBM App Connect Enterprise versions 13.0.1.0 through 13.0.8.2 contain a critical flaw that lets a remote attacker obtain sensitive information. The product binds to an unrestricted IP address, so services meant for limited access can be reached from any network the host is on. CVE-2026-92559 has a CVSS score of 9.8, Critical severity.

App Connect Enterprise sits at the center of how business systems exchange data, so information exposed here can include the sensitive traffic those systems carry. Organizations running affected versions should apply the update to close the exposure and restrict network access to the integration layer.

This IBM i update fixes two serious vulnerabilities in versions 7.3, 7.4, 7.5, and 7.6. CVE-2026-96119 has a CVSS score of 9.9, Critical severity. Poor data sanitization in the HTTP Server Administration web application lets a remote authenticated attacker run arbitrary code or steal sensitive information. CVE-2026-102917 has a CVSS score of 7.8, High severity. It lets an authenticated attacker raise their privileges and act with QSECOFR/root authority.

Together, these flaws let an attacker go from a foothold to full control of IBM i systems that run core business workloads. Apply the update the same day.

IBM WebSphere Application Server - Liberty has five security flaws that weaken authentication and access control across the application tier. Two Critical flaws stand out. CVE-2026-93909 has a CVSS score of 9.1, Critical severity, and lets attackers bypass authentication when the samlWeb-2.0 feature is enabled. CVE-2026-93895 has a CVSS score of 9.1, Critical severity, and lets an unauthenticated remote attacker bypass access controls on gRPC service methods.

The update also fixes three High severity flaws. CVE-2026-93905 has a CVSS score of 8.2, High severity, and lets an unauthenticated remote attacker corrupt the saved status of batch jobs; it carries remote code execution risk. CVE-2026-105443 has a CVSS score of 8.2, High severity, and comes from weak isolation between servers that share an install. CVE-2026-95695 has a CVSS score of 7.4, High severity, and lets a remote attacker bypass security restrictions through incorrect authorization. Four of the five flaws allow privilege escalation, so applying the update on the same day closes several paths to unauthorized access.

This Juniper Junos OS Evolved update closes four flaws that give attackers root-level control of core network devices or knock them offline. CVE-2026-102031 has a CVSS score of 9.8, Critical severity: OS command injection in TACACS lets a low-privileged TACACS+-authenticated user run commands as root when periodic TACACS+ authorization refresh is enabled. CVE-2026-101967 and CVE-2026-101978 each have a CVSS score of 8.8, High severity. Both are OS command injection flaws in the bootzd zero-touch provisioning daemon that let an unauthenticated attacker on the management LAN run commands as root. One uses a crafted DHCP response, and the other uses a crafted gRPC response on PTX Series.

CVE-2026-102068 has a CVSS score of 7.5, High severity: a stack-based buffer overflow in the kernel lets an unauthenticated remote attacker trigger a kernel panic with a crafted TCP packet when key-chain authentication is used for BGP or LDP. Together, these flaws put routing integrity and network availability at direct risk.

This Juniper Junos OS update fixes 56 vulnerabilities across Junos OS and Junos OS Evolved, 14 of them Critical. The most severe flaws let unauthenticated attackers bypass J-Web authentication and run commands as root. Others let them trigger stack and heap buffer overflows in the routing protocol daemon, IKE key management, GRE tunnel processing, and service-deployment components, which can give an attacker full control of the device. Dozens more flaws let BGP, EVPN, LDP, LLDP, DHCP, and CFM traffic crash core routing and Layer 2 daemons, which can take down routing adjacencies and disrupt network availability across the enterprise.

CVE-2026-101950, CVE-2026-101954, CVE-2026-101956, CVE-2026-101980, CVE-2026-101982, CVE-2026-101983, CVE-2026-101986, CVE-2026-101990, CVE-2026-102175, CVE-2026-102178, CVE-2026-102182, CVE-2026-33789, CVE-2026-33792, and CVE-2026-33796 each have a CVSS score of 9.8, Critical severity. CVE-2026-101979, CVE-2026-101981, CVE-2026-102014, CVE-2026-102015, CVE-2026-102049, CVE-2026-102050, CVE-2026-102052, CVE-2026-102055, CVE-2026-102059, CVE-2026-102061, CVE-2026-102069, CVE-2026-102174, CVE-2026-102176, CVE-2026-103994, and CVE-2026-33798 each have a CVSS score of 8.8, High severity. CVE-2026-101955 has a CVSS score of 8.1, High severity. CVE-2026-101927 and CVE-2026-102079 each have a CVSS score of 7.8, High severity. CVE-2026-102177 has a CVSS score of 7.6, High severity. CVE-2026-101939, CVE-2026-101940, CVE-2026-101941, CVE-2026-101944, CVE-2026-101945, CVE-2026-101948, CVE-2026-101949, CVE-2026-101961, CVE-2026-101973, CVE-2026-101976, CVE-2026-101977, CVE-2026-102016, CVE-2026-102024, CVE-2026-102028, CVE-2026-102029, CVE-2026-102036, CVE-2026-102057, CVE-2026-102065, CVE-2026-102179, CVE-2026-102180, CVE-2026-102183, and CVE-2026-102184 each have a CVSS score of 7.5, High severity. CVE-2026-102056 has a CVSS score of 7.1, High severity.

• Many flaws let a single malformed routing update crash the routing daemon and drop network adjacencies.
• Restrict J-Web access and patch internet-facing SRX and MX devices first.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB server has eight vulnerabilities that let authenticated, low-privileged database users corrupt memory, reach table files they should not see, hijack other accounts, and in several cases run code on the server. Three are Critical: CVE-2026-85746, CVE-2026-85748, and CVE-2026-92262 each have a CVSS score of 9.9, Critical severity. They cover an out-of-bounds write in ST_AsText when it handles deeply nested GeometryCollections, a use-after-free in SYS_REFCURSOR handling, and a #mysql50# prefix that bypasses table-name filesystem encoding and can lead to data theft, corruption, or remote code execution.

The other five are High severity. CVE-2026-102523 has a CVSS score of 8.0, High severity. It lets ALTER TABLE ... CONVERT ... PARTITION reach table files the user is not authorized to access. CVE-2026-107814 (CVSS 8.4, High severity) and CVE-2026-107818 (CVSS 8.4, High severity) let users with the FILE privilege plant startup files or inject environment values into the restarted service. CVE-2026-107815 has a CVSS score of 8.5, High severity, and is a stack out-of-bounds write in the CONNECT engine's DOS table type. CVE-2026-97380 has a CVSS score of 8.8, High severity, and lets a GRANT PROXY authorization error reset another account's password. The update fixes all eight in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Metabase has released fixes for a critical flaw in how the platform handles native queries and actions against H2 data sources. CVE-2026-103928 has a CVSS score of 9.3, Critical severity. Metabase versions from 1.55.0 pass these queries through without restricting H2's host-facing built-in functions. As a result, any user allowed to run native queries or actions can call FILE_READ, FILE_WRITE, CSVREAD, CSVWRITE, or LINK_SCHEMA to read or write arbitrary files on the Metabase server or link other databases, which gives them elevated privileges on the host.

The default sample database uses H2, so standard deployments are exposed out of the box. The issue is fixed in Metabase 1.58.16, 1.59.13, 1.60.9, and 1.61.4. Update to the fixed release for your version line.

Mozilla Firefox updates fix 28 Critical vulnerabilities across the browser's core. They include sandbox escapes, use-after-free bugs, out-of-bounds memory errors, invalid pointers, privilege escalation, a same-origin policy bypass, and a site isolation failure. The flaws affect the Networking, DOM, Graphics, WebRender, JavaScript Engine and JIT, XML, SVG, Storage, Widget, Print Preview, Toolkit, DevTools, and Layout components. Sandbox escapes are the main danger: they let attacker code break out of the browser's containment and reach the underlying system. The fixes ship in Firefox 158, 158.0.1, and 159, Firefox ESR 153.5, 153.6, and 115.44, and Thunderbird 158, 158.0.1, 159, 153.5, and 153.6.

CVE-2026-109774, CVE-2026-109780, CVE-2026-113399, CVE-2026-117862, CVE-2026-117917, CVE-2026-117945, CVE-2026-117946, CVE-2026-117980, CVE-2026-117981, and CVE-2026-117982 each have a CVSS score of 9.8, Critical severity. CVE-2026-109705, CVE-2026-109707, CVE-2026-109708, CVE-2026-109740, CVE-2026-109745, CVE-2026-109750, CVE-2026-109755, CVE-2026-117861, CVE-2026-117868, CVE-2026-117920, CVE-2026-117962, CVE-2026-117971, CVE-2026-117985, CVE-2026-117988, CVE-2026-117990, and CVE-2026-117997 each have a CVSS score of 9.6, Critical severity. CVE-2026-109772 and CVE-2026-118027 each have a CVSS score of 9.1, Critical severity.

This update for Nutanix Acropolis Operating System (AOS) fixes CVE-2026-84731, a critical authentication bypass in Nutanix Prism Element. CVE-2026-84731 has a CVSS score of 9.8, Critical severity. A misconfigured authentication filter lets an unauthenticated remote attacker send a crafted internal management HTTP header and receive a valid session cookie. That cookie carries a token with full cluster administrative privileges.

With that access, an attacker can run root-level commands on every Controller VM in the cluster, destroy the cluster, and reach VM memory and virtual disks. Proof-of-concept code for this flaw exists, which lowers the barrier to attack. Apply this update the same day.

The OPNsense core update fixes three flaws that let authenticated users with limited privileges take full control of the firewall as root. CVE-2026-57155 has a CVSS score of 9.9, Critical severity. A user with Firewall Alias Edit privilege can abuse the GeoIP alias importer to write files as root and then run commands through a scheduled root job, which fully compromises the firewall. CVE-2026-119409 has a CVSS score of 7.2, High severity. A user with the System: Firmware privilege can store a malicious firmware mirror URL that runs commands as root and can also turn off package signature checks. CVE-2026-71490 has a CVSS score of 7.1, High severity. A privilege-parsing error lets a user marked read-only still save configuration changes.

Proof-of-concept code is public for CVE-2026-57155 and CVE-2026-71490. Version 26.1.11 fixes CVE-2026-57155 and CVE-2026-71490, and version 26.7.8 fixes CVE-2026-119409. Update to 26.7.8 or later to close all three flaws.

Oracle has released a security update for Oracle JD Edwards EnterpriseOne Tools that fixes two Critical vulnerabilities. CVE-2026-91265 has a CVSS score of 9.1, Critical severity. CVE-2026-91305 has a CVSS score of 9.1, Critical severity. JD Edwards EnterpriseOne runs core enterprise processes such as finance, distribution, and manufacturing. A weakness at this layer puts business-critical data and operations at risk. Apply this update the same day.

Oracle Access Manager receives a security update that addresses two Critical vulnerabilities. CVE-2026-87251 has a CVSS score of 9.8, Critical severity. CVE-2026-87337 has a CVSS score of 10.0, Critical severity.

Oracle Access Manager controls authentication and access across enterprise applications, so a flaw here can expose every system it protects. Both vulnerabilities score at or near the top of the CVSS range, and organizations should apply this update on a same-day basis.

Oracle has released a security update for Oracle APEX that fixes CVE-2026-101521. CVE-2026-101521 has a CVSS score of 9.8, Critical severity. A score this high puts Oracle APEX environments, and the applications and data they host, at serious risk until the update is applied. Patch all Oracle APEX instances on a same-day schedule.

Oracle Application Object Library has a critical vulnerability that attackers are already using. Attackers are actively exploiting CVE-2026-101767. This update fixes CVE-2026-101767, which has a CVSS score of 9.8, Critical severity.

Oracle Application Object Library is a core part of Oracle E-Business Suite, so an attacker who gets in this way puts business-critical data and operations at risk. Organizations running this product should treat the update as an emergency and deploy it now.

Oracle Business Intelligence Enterprise Edition has a Critical vulnerability that requires same-day attention. CVE-2026-91241 has a CVSS score of 9.1, Critical severity. This update closes the flaw in a platform that holds and serves an organization's core business data, so patching it quickly protects both the system and the data it reports on.

This Oracle Essbase update fixes eight Critical severity vulnerabilities in the analytics platform that organizations rely on for financial planning, forecasting, and reporting. All eight carry CVSS scores of 9.1 or higher. CVE-2026-91637, CVE-2026-91638, CVE-2026-91658, and CVE-2026-91663 each have a CVSS score of 9.9, Critical severity. CVE-2026-91665 has a CVSS score of 9.8, Critical severity. CVE-2026-91644 has a CVSS score of 9.3, Critical severity. CVE-2026-91655 and CVE-2026-91656 each have a CVSS score of 9.1, Critical severity.

Essbase holds sensitive financial and operational data, so this cluster of near-maximum scores puts that data at serious risk. Apply this update on the same day across all Essbase deployments.

Oracle has released a security update for Oracle HTTP Server that addresses a single critical vulnerability. CVE-2026-87347 has a CVSS score of 9.6, Critical severity. Oracle HTTP Server often sits at the edge of enterprise web and middleware deployments, so a flaw at this severity puts internet-facing services and the systems behind them at serious risk.

Apply this update on the same day across all Oracle HTTP Server instances, starting with internet-facing and business-critical servers.

Oracle has released a security update for Oracle Identity Manager that fixes CVE-2026-91408. CVE-2026-91408 has a CVSS score of 9.8, Critical severity. Oracle Identity Manager controls user provisioning and access across the enterprise, so a Critical flaw in this platform puts the whole identity layer at risk. Apply this update the same day.

Oracle has released a security update for Oracle WebCenter Content that fixes CVE-2026-91495. CVE-2026-91495 has a CVSS score of 9.8, Critical severity. Oracle WebCenter Content stores and manages enterprise documents and records, so a flaw this severe puts sensitive business content and the systems connected to it at risk. Apply the update the same day it is released to close this exposure.

Oracle WebLogic Server has three Critical-severity vulnerabilities, and this patch fixes all of them. CVE-2026-83399 has a CVSS score of 9.8, Critical severity. CVE-2026-87302 has a CVSS score of 9.1, Critical severity. CVE-2026-91323 has a CVSS score of 9.8, Critical severity.

WebLogic Server runs important business applications and middleware for many companies. Three Critical flaws in one product make it a high-value target. Apply this update the same day to close all three before attackers can use them.

Oracle has released a security update for Oracle Siebel CRM Cloud Applications that fixes CVE-2026-101446. CVE-2026-101446 has a CVSS score of 9.9, Critical severity. Siebel CRM holds customer records, sales pipelines, and service history, so a flaw at this severity level puts core business data and customer trust at direct risk.

This update needs same-day priority. Teams running Oracle Siebel CRM Cloud Applications should apply the fix today to close this critical exposure before attackers can use it.

The OTRS update fixes three authentication and access-control flaws in the service management platform. CVE-2026-93582 has a CVSS score of 9.4, Critical severity: in Community Edition 6 and earlier, an unauthenticated attacker can send a crafted Remote-User header to log in through the Generic Interface as any existing agent or customer user, without a password, when HTTP Basic Authentication is enabled. OTRS 7 and later are not exposed to this attack, but the update removes the unused fallback as hardening. CVE-2026-78357 has a CVSS score of 9.1, Critical severity: a session token issued before an account is deactivated or its password is changed stays valid for up to about 16 hours, so a stolen token keeps working after the user is locked out.

CVE-2026-78355 has a CVSS score of 8.7, High severity: a path traversal flaw in the SendSupportBundle function lets an authenticated administrator delete files outside the intended directory, within the permissions of the OTRS process. The token and path traversal flaws affect OTRS 7.0.X, 8.0.X, and 2023.X through 2026.X before 2026.7.X. Community Edition 6.x and earlier, and products built on it, are also exposed.

Podman versions 5.8.8 and 6.1.3 fix a critical flaw that lets a container image override the security limits administrators set for it. CVE-2026-94603 has a CVSS score of 10.0, Critical severity. From version 4.4.0 onward, podman run treats any image carrying a specific checkpoint annotation as a checkpoint restore. It then silently ignores restrictions the user supplies at container creation, such as --cap-drop=ALL.

A malicious or tampered image can use this to choose weaker sandbox settings and gain capabilities the operator meant to strip away. That breaks container isolation without any warning to the operator. Rootful deployments are exposed; rootless containers are not affected because checkpoint and restore are unavailable in that mode. Upgrade to 5.8.8 or 6.1.3 to close the gap.

SAP NetWeaver Visual Composer has a critical authorization flaw in certain portal functions. CVE-2026-89110 has a CVSS score of 9.9, Critical severity. A low-privileged attacker can call internal operations on a preconfigured remote system. Depending on how that remote connection is configured, this can lead to full compromise of the remote system, with high impact on confidentiality, integrity, and availability.

This update fixes the missing authorization checks. Because the flaw reaches beyond Visual Composer into connected remote systems, the impact can extend across core SAP business infrastructure. Apply the fix the same day.

SAP S/4HANA (Manage Substitution/Validation Rules) has a code injection flaw that lets an authenticated attacker run arbitrary ABAP code on the system. CVE-2026-89107 has a CVSS score of 9.9, Critical severity. The rule definition feature uses a domain-specific scripting language and does not properly validate input. An attacker with specific business privileges can submit crafted input that the rule processing logic runs as ABAP code.

This update fixes the input validation flaw in the rule processing logic. A successful attack fully compromises the affected system and puts the confidentiality, integrity, and availability of core business data at serious risk. Apply the patch to S/4HANA systems on a same-day timeline.

This Splunk Enterprise security update closes six vulnerabilities, three of them Critical, that let low-privileged users take over the platform that holds an organization's security and operational data. CVE-2026-76299 has a CVSS score of 9.9, Critical severity, and CVE-2026-76302 has a CVSS score of 9.9, Critical severity. CVE-2026-76301 has a CVSS score of 9.8, Critical severity. These three come from an internal security review that produced a hardening release, and they cover improper access control, improper neutralization, and protection mechanism failure.

The High severity fixes stop privilege escalation and command execution. CVE-2026-76291 has a CVSS score of 8.8, High severity: users with the schedule_search capability could slip past the SPL safeguards for risky commands and disclose or alter data, or disrupt availability. CVE-2026-76298 has a CVSS score of 8.8, High severity: users without the admin or power roles could derive the superuser password for the PostgreSQL sidecar database from search job logs and run operating system commands on search head cluster members. CVE-2026-76293 has a CVSS score of 7.2, High severity: users with the edit_manager_xml capability could run arbitrary operating system commands through the Splunk Web Manager page.

Splunk SOAR has a hardening release that fixes six Critical vulnerabilities found in an internal security review. They involve improper access control, poor resource lifetime control, mishandled exceptional conditions, a protection mechanism failure, an unprotected alternate path, and files or directories that outside parties can reach. Two of the flaws allow elevation of privilege. An attacker who exploits them could gain elevated access to the platform that runs an organization's security automation and incident response.

CVE-2026-76407 has a CVSS score of 9.8, Critical severity. CVE-2026-76408 has a CVSS score of 9.8, Critical severity. CVE-2026-76527 has a CVSS score of 9.8, Critical severity. CVE-2026-76528 has a CVSS score of 9.8, Critical severity. CVE-2026-76529 has a CVSS score of 9.8, Critical severity. CVE-2026-76531 has a CVSS score of 9.9, Critical severity.

Wazuh Manager 4.14.8 closes six vulnerabilities in the central manager, two of them Critical, all reachable from enrolled agents, cluster workers, or user accounts the platform already trusts. CVE-2026-74040 has a CVSS score of 9.1, Critical severity; a cluster worker can overwrite protected master files such as ossec.conf and agent.conf, achieving root remote code execution across the manager and every agent. CVE-2026-74043 has a CVSS score of 9.0, Critical severity; a malicious worker holding the cluster key can use path traversal in rule, decoder, and list uploads to write files at arbitrary paths as the wazuh user.

The release also fixes four High-severity flaws. CVE-2026-74034 has a CVSS score of 7.5, High severity, and lets any enrolled agent read arbitrary files as root, including /etc/shadow and client.keys. CVE-2026-74035 has a CVSS score of 7.2, High severity, and lets a delegated user administrator submit an empty password to take over the wazuh superuser account. CVE-2026-74037 has a CVSS score of 7.2, High severity, and lets administrators whose access was revoked keep authenticating because issued tokens are never checked against the blacklist. CVE-2026-74045 has a CVSS score of 7.1, High severity, and lets an enrolled agent crash wazuh-analysisd with a crafted syscheck event, causing a fleet-wide detection outage. Proof-of-concept code exists for CVE-2026-74034, CVE-2026-74037, CVE-2026-74040, and CVE-2026-74045. Affected versions reach back to 3.9.0; upgrade every manager to 4.14.8.

This Znuny update closes an authentication bypass in versions through 7.3.6. CVE-2026-93483 has a CVSS score of 9.5, Critical severity. On systems that use HTTPBasicAuth as the authentication backend, the agent and customer interfaces read the login username from a request header that the attacker controls. By sending a forged Remote-User header, an attacker can sign in as any existing user, including administrators, without credentials. This gives them full access to confidential ticket data and system controls.

Organizations running Znuny with HTTPBasicAuth enabled for agents or customers face direct exposure and should apply this update the same day.

Zulip has released version 12.2 to fix an authentication flaw in Zulip Server versions through 12.1. CVE-2026-102893 has a CVSS score of 9.1, Critical severity. The OpenID Connect login backend matches the email address from the identity provider to an existing account without rejecting a claim explicitly marked as unverified. If a configured identity provider sends an email address the user does not control, Zulip can log that user into the existing account tied to that address. This lets an attacker take over another user's account and gain that user's privileges.

The attack requires a misconfigured trusted identity provider. Deployments whose identity provider only issues email addresses the user controls are not affected. Upgrading to Zulip Server 12.2 closes the gap.

Cisco Secure Firewall Adaptive Security Appliance (ASA) Software has an update for a denial-of-service flaw in its Remote Access SSL VPN service. An unauthenticated, remote attacker can send a crafted request while connecting to the SSL remote access VPN and force the device to reload. The flaw comes from logic errors when secondary authentication is configured on a tunnel group. Cisco Secure Firewall Threat Defense (FTD) Software is also affected.

The update fixes CVE-2026-76418, which has a CVSS score of 8.6, High severity. Attackers are actively exploiting CVE-2026-76418. Each successful attack restarts the firewall, which cuts off VPN access and network protection while the device reboots. Apply this patch immediately to every ASA and FTD device that offers SSL remote access VPN.

GFI KerioConnect has two High severity flaws that expose user mailboxes and Windows endpoints to compromise. CVE-2026-112353 has a CVSS score of 8.2, High severity. It is a stored cross-site scripting flaw in the Webmail component. An attacker sends a crafted SVG attachment that slips past sanitization, and the attacker's script runs in the victim's authenticated Webmail session when the attachment is opened. The attacker can then steal the victim's credentials and mailbox contents. Attackers are actively exploiting CVE-2026-112353 to steal credentials and mailbox data.

CVE-2026-112357 has a CVSS score of 7.8, High severity. Weak installer permissions in the KerioConnect Outlook Connector (Offline Edition) leave the product directory writable by standard users. A local attacker can replace a service binary that runs as LocalSystem and gain full SYSTEM privileges at the next service start or reboot. The fixes ship in Kerio Connect 10.0.8 Patch 2 for the Webmail flaw and in Outlook Connector 10.0.9 Patch 2 for the privilege escalation flaw.

Perforce Puppet Enterprise is getting an urgent update that fixes two Critical flaws in Puppet Server, the system that controls configuration across every managed node. CVE-2026-115731 has a CVSS score of 9.4, Critical severity. It is an unsafe deserialization flaw in report processing. Any client with a CA-signed agent certificate can send a crafted report and run arbitrary code on the Puppet Server as its service user. Where the certificate authority autosigns requests without strong checks, an unauthenticated network attacker can get that certificate. CVE-2026-115732 has a CVSS score of 9.0, Critical severity. It is a certificate-name matching flaw that lets a client pose as an authorized host. Attackers can then impersonate other nodes, reach certificate-authority administration, and run commands on managed nodes.

Attackers are actively exploiting CVE-2026-115732. Because Puppet Server pushes configuration to the whole fleet, one compromised server can spread across the enterprise. Apply the update immediately and review certificate autosign settings.

This WordPress update fixes a High-severity flaw in WordPress Core, versions 4.7 through 7.1.3. CVE-2026-119977 has a CVSS score of 8.1, High severity. During full-package core upgrades, WordPress uses predictable staging paths that anyone can reach from the web. This lets unauthenticated attackers run code on the server while the upgrade is in progress.

Attackers are actively exploiting CVE-2026-119977. Every vulnerable site is exposed each time it runs a core upgrade, so organizations must apply this update right away to close the window and protect the web server and its data.

The Zyxel GS1900-24E firmware update fixes an out-of-bounds write flaw in the switch's CGI program. It affects firmware versions through 2.90(AAHK.2)C0. An unauthenticated attacker on an adjacent network can send a crafted HTTP request and run OS commands on the device. This gives the attacker remote code execution and elevation of privilege on a core network switch.

CVE-2026-107441 has a CVSS score of 8.8, High severity. Attackers are actively exploiting CVE-2026-107441 in the wild. Organizations should treat this update as an immediate priority. A compromised switch can expose, redirect, or disrupt traffic across the network segments it serves.

Absolute Secure Access has two critical flaws that let attackers weaken the server that controls client security. CVE-2026-116769 has a CVSS score of 9.3, Critical severity. It is an authentication bypass in Secure Access servers from version 13.0 up to, but not including, 14.61. It lets attackers change a client's security settings through the server. CVE-2026-97718 has a CVSS score of 9.4, Critical severity. It is a cross-site request forgery flaw in version 14.60 that gets around a security control, so an attacker can trick an administrator into creating an account the attacker controls.

Together, these flaws threaten the trust between the Secure Access server and every client it manages. Attackers can quietly weaken endpoint protections or plant an account they control on the server. Upgrading to version 14.61 closes both issues.

Adobe Campaign Classic receives a security update that fixes eight Critical vulnerabilities. Together they let attackers inject code and OS commands, run arbitrary SQL, get around authorization checks, and hijack user sessions. Most need only low privileges and no user interaction, and every flaw has a changed scope, so a compromise can reach well past the vulnerable component. That puts the platform's customer data and campaign infrastructure at direct risk.

The update covers these issues. CVE-2026-105781 is an SQL injection that lets attackers run arbitrary SQL commands. It has a CVSS score of 10.0, Critical severity. CVE-2026-104351 (code injection), CVE-2026-104353 (OS command injection), CVE-2026-105489 (SQL injection) and CVE-2026-105780 (incorrect authorization) each lead to arbitrary code execution by a low-privileged attacker. Each has a CVSS score of 9.9, Critical severity. CVE-2026-104350 is a reflected cross-site scripting flaw that can take over a victim's account or session. It has a CVSS score of 9.3, Critical severity. CVE-2026-104354 is an SQL injection that gives a high-privileged attacker code execution, and CVE-2026-105779 is an SQL injection that bypasses security controls for unauthorized read and limited write access. Each has a CVSS score of 9.1, Critical severity.

Apple has released security updates for Apple iOS and iPadOS that fix two Critical vulnerabilities, with the same fixes delivered across macOS, tvOS, visionOS, and watchOS. CVE-2026-112690 has a CVSS score of 9.8, Critical severity. It is an input validation flaw that lets a remote attacker break out of the WebContent sandbox, removing a core barrier between hostile web content and the rest of the device. CVE-2026-112514 has a CVSS score of 9.1, Critical severity. It is a use-after-free flaw that lets an attacker crash the system or corrupt kernel memory.

The fixes ship in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, tvOS 27.2, visionOS 27.2, and watchOS 27.2. Together, these flaws expose company phones, tablets, and Macs to sandbox escape and kernel-level compromise, so these updates should be deployed the same day.

Apple macOS receives fixes for nine Critical vulnerabilities in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. The flaws let a malicious app corrupt process memory, read kernel memory, or crash the system. Three separate bugs let apps or sandboxed processes break out of their sandbox. A remote attacker can force apps to terminate, an attacker who controls a network file server can crash the system, and an authentication flaw lets an attacker impersonate other users. One sandbox escape, a path traversal flaw, is fixed only in the Golden Gate release line.

CVE-2026-112526, CVE-2026-112552, and CVE-2026-84539 each have a CVSS score of 9.8, Critical severity. CVE-2026-112521 has a CVSS score of 9.3, Critical severity. CVE-2026-112443 and CVE-2026-86868 each have a CVSS score of 9.1, Critical severity. CVE-2026-112478, CVE-2026-112497, and CVE-2026-84633 each have a CVSS score of 9.0, Critical severity.

Apple has released an update for Apple Safari that closes a sandbox escape in the browser's Web Content process. CVE-2026-113897 has a CVSS score of 10.0, Critical severity. A remote attacker may be able to break out of the Web Content sandbox. That sandbox is the main barrier between hostile web content and the rest of the system.

Apple fixed the flaw by removing the vulnerable code. The fix ships in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, and visionOS 27.2. Organizations should deploy these updates the same day across every managed Apple device.

This Barracuda Email Security Gateway (ESG) update fixes two serious flaws in the appliance that screens an organization's email. CVE-2026-116606 has a CVSS score of 9.3, Critical severity. It is an authentication bypass in versions earlier than 9.4.0.030 that lets an unauthenticated remote attacker reach a configuration-import function and restore a crafted backup archive, which takes over the appliance's global configuration. CVE-2026-111560 has a CVSS score of 8.6, High severity. It is an OS command injection in the timezone configuration field that lets an authenticated administrator run commands with root privileges.

Together, the two flaws give an attacker a direct path to full control of the email gateway: the bypass opens the configuration to outsiders, and the command injection turns administrative access into root-level code execution. Update affected appliances to version 9.4.0.030 or later.

ClickHouse has released a security update that fixes a critical remote code execution flaw in ClickHouse Server. CVE-2026-116366 has a CVSS score of 9.5, Critical severity. An integer overflow lets an unauthenticated attacker with network access execute arbitrary code on the server under certain conditions.

No credentials are required, so any exposed ClickHouse Server is a direct entry point. A successful attack puts the data the server holds and the systems around it at risk. Apply this update the same day.

This curl update fixes seven Critical flaws in how curl and libcurl handle authentication, connection reuse, and certificate pinning. CVE-2026-86411, CVE-2026-86413, CVE-2026-86414, CVE-2026-87861, CVE-2026-87866, CVE-2026-92388, and CVE-2026-94265 each have a CVSS score of 9.1, Critical severity. Most of the flaws leak or misuse credentials. A malicious server can use a redirect to collect Negotiate and Kerberos credentials. A malicious proxy can collect Basic passwords and Kerberos tickets. Reused connections can carry one origin's authenticated identity over to another origin, and pooled FTP connections can keep a client certificate identity that a later transfer should not have.

The patch also fixes a public-key pinning bypass in wolfSSL builds, which lets curl accept a key the TLS peer does not hold. It also fixes a memory-safety flaw that follows a failed FTP wildcard listing and can lead to a crash, a use-after-free, or type confusion. Proof-of-concept code exists for all seven vulnerabilities. Because curl is built into a wide range of applications, scripts, and devices, this patch should be deployed the same day.

Dell PowerProtect Data Domain receives a security update that fixes 15 vulnerabilities across Feature Release versions 7.7.1.0 through 8.8 and the LTS2024, LTS2025, and LTS2026 release lines. Four flaws are Critical and need no login. An attacker with remote access can execute commands through a stack-based buffer overflow, expose credentials through a hard-coded cryptographic key, create privileged accounts, or run arbitrary commands with root privileges. Together, these flaws give an attacker complete control of the backup appliance. The remaining eleven High-severity flaws include OS command injection, buffer and integer overflows, path traversal, authentication bypass, and privilege escalation. They lead to command execution, filesystem access, protection bypass, and denial of service.

CVE-2026-103780, CVE-2026-86384, CVE-2026-86397, and CVE-2026-86400 each have a CVSS score of 9.8, Critical severity. CVE-2026-86378, CVE-2026-86396, and CVE-2026-86398 each have a CVSS score of 8.8, High severity. CVE-2026-103779 has a CVSS score of 8.3, High severity. CVE-2026-86377 has a CVSS score of 7.6, High severity. CVE-2026-110541, CVE-2026-86380, CVE-2026-86389, CVE-2026-86393, CVE-2026-86394, and CVE-2026-86399 each have a CVSS score of 7.2, High severity.

Dell PowerProtect Data Domain Management Center has received a security update that fixes five vulnerabilities in Feature Release versions 7.7.1.0 through 8.8 and in the LTS2024, LTS2025, and LTS2026 release lines. A remote attacker with low privileges can use the most serious of these flaws to bypass authentication, inject SQL, and run unauthorized operations on the Data Domain systems the console manages. The flaws expose the core of an organization's backup and recovery infrastructure.

CVE-2026-103792 (SQL injection) has a CVSS score of 9.6, Critical severity. CVE-2026-103799 (missing authorization) has a CVSS score of 9.6, Critical severity. CVE-2026-90717 (authentication bypass by spoofing that leads to elevation of privileges and can affect other managed Data Domain systems) has a CVSS score of 9.1, Critical severity. CVE-2026-86379 (OS command injection that a high-privileged attacker can use to run commands) has a CVSS score of 7.2, High severity. CVE-2026-110540 (missing authorization) has a CVSS score of 7.1, High severity.

Dell Wyse Management Suite has a critical cross-site scripting flaw in versions before 2609.0.0.155. CVE-2026-82158 has a CVSS score of 9.0, Critical severity. A remote attacker with only low privileges can inject script into the management console's web pages. That script runs in the browsers of other users who open those pages, including administrators who control the managed thin-client fleet.

The update to version 2609.0.0.155 or later fixes the flaw by properly neutralizing input before the console renders it. Because this console is the central control point for endpoint configuration, organizations should treat it as a high-value target and apply the update the same day.

Docker Desktop for Windows with the WSL2 backend has a container-isolation flaw. CVE-2026-112917 has a CVSS score of 9.2, Critical severity. An unprivileged Linux container can use 32-bit socketcall to get around the default seccomp restriction on AF_VSOCK. That exposes services facing the host and Windows files that the logged-in user can access. The flaw affects x86-64 WSL2 deployments. LinuxKit-based backends are not affected.

The fix needs two updates: Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 on an older version of WSL is still vulnerable, so update both components together to close the gap.

Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux have a SQL injection flaw. A remote attacker who can access a service can use it to run database functions that should be blocked. If the service is set to public access, which is not the default, that attacker can be anonymous. CVE-2026-10757 has a CVSS score of 9.8, Critical severity.

Esri has released a patch for ArcGIS Server versions 12.1, 12.0, 11.5, 11.3, and 11.1, which are in General Availability or Extended support. Versions in mature or retired status are not eligible for the patch. Organizations on those versions must upgrade to a supported release and then apply the patch.

Fortinet has released a security update for Fortinet FortiSandbox that closes a critical authentication bypass flaw. CVE-2026-107656 has a CVSS score of 9.6, Critical severity. Attackers can skip authentication by using an alternate path or channel, then send crafted HTTP requests to run unauthorized code or commands, which gives them elevated privileges on the appliance.

The flaw affects FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, and all 4.2 versions, plus FortiSandbox PaaS 5.0.0 through 5.0.6 and all PaaS 4.4 and 4.2 versions. FortiSandbox analyzes suspicious files across the security stack, so a compromised appliance weakens threat detection across the whole organization.

The FreeRDP update fixes 20 vulnerabilities across the client, server, proxy, and RD Gateway components. Version 3.32.2 covers all of them. Most are memory corruption flaws: heap overflows, out-of-bounds writes, use-after-free, and integer wraparounds. A malicious RDP server, client, or gateway can trigger them through audio, graphics, clipboard, smartcard, and authentication handling, leading to crashes or code execution. One flaw lets unauthenticated attackers inject keystrokes into a shadow server session. Another weakens certificate validation, so a man-in-the-middle can intercept RDP sessions, including keystrokes, clipboard data, and screen content. Proof-of-concept code exists for 14 of the 20 flaws, including both Critical ones.

CVE-2026-121952 and CVE-2026-121953 each have a CVSS score of 9.8, Critical severity. CVE-2026-109676, CVE-2026-111380, CVE-2026-111382, CVE-2026-114045, and CVE-2026-121958 each have a CVSS score of 8.8, High severity. CVE-2026-121962 has a CVSS score of 8.1, High severity. CVE-2026-111881 has a CVSS score of 7.6, High severity. CVE-2026-110838, CVE-2026-121955, CVE-2026-121956, CVE-2026-121957, and CVE-2026-121964 each have a CVSS score of 7.5, High severity. CVE-2026-111880 and CVE-2026-121392 each have a CVSS score of 7.4, High severity. CVE-2026-111379 and CVE-2026-111381 each have a CVSS score of 7.3, High severity. CVE-2026-110837 and CVE-2026-110839 each have a CVSS score of 7.1, High severity.

GLPI updates close three access-control flaws in the IT asset and service management platform. CVE-2026-52848 has a CVSS score of 9.2, Critical severity: during login, an unauthenticated user can use a crafted URL to skip one-time-password verification and defeat two-factor authentication in versions 11.0.0 through 11.0.7. CVE-2026-121559 has a CVSS score of 7.2, High severity: a user with the Technician profile can clone a Super-Admin account with a new login and password, because profile and group assignments are copied without permission checks, giving the attacker a Super-Admin account they control. CVE-2026-57152 has a CVSS score of 7.1, High severity: GLPI permission logic can grant access to a document without confirming it is linked to the targeted item, exposing files to users who should not see them.

Versions 10.0.28 and 11.0.10 fix all three flaws. Together, these flaws let attackers bypass MFA, escalate to full administrative control, and read restricted documents across the asset and ticketing data GLPI holds. Update immediately to the latest release in your branch.

Google Android receives a patch for four Critical vulnerabilities in its image and media handling code. CVE-2026-58868, CVE-2026-58876, CVE-2026-58936, and CVE-2026-58968 each have a CVSS score of 9.8, Critical severity. CVE-2026-58868 is a heap buffer overflow in the frame decoder that allows an out-of-bounds write and leads to remote code execution. CVE-2026-58876 is a use-after-free memory safety issue in multiple locations that leads to remote code execution. CVE-2026-58936 is a use-after-free in PNG handling that corrupts memory and leads to remote code execution. CVE-2026-58968 is a double free in metadata parsing that leads to remote escalation of privilege.

None of the four flaws require additional execution privileges or any user interaction, so a remote attacker can reach them without tricking the device owner. The patch closes all four. Unpatched Android devices carry a direct path to remote compromise and should be updated across the fleet without delay.

This JetBrains Toolbox App update fixes CVE-2026-118697, which has a CVSS score of 9.0, Critical severity. The jetbrainsd daemon trusted compromised intermediate certificates, an improper certificate validation flaw that allows elevation of privilege. The flaw affects Toolbox App before 3.9.1 and 3.8.2, as well as IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip and RustRover before their fixed releases.

Developer workstations run with broad access to source code, credentials and build systems. A daemon that accepts forged trust lets an attacker raise privileges on those machines. Update Toolbox App and every affected JetBrains IDE to the fixed versions.

Mozilla Thunderbird updates fix two Critical vulnerabilities that let remote attackers act as the user and steal credentials. CVE-2026-113867 has a CVSS score of 9.1, Critical severity. Thunderbird did not escape attribute values in outgoing XMPP chat stanzas, so a remote XMPP user can inject stanzas into the user's connection with no interaction. Attackers can then send messages and change contact and subscription settings as the user. This flaw affects only Thunderbird's chat feature with XMPP accounts and is fixed in Thunderbird 158.0.1 and 153.5.1.

CVE-2026-118177 has a CVSS score of 9.1, Critical severity. During calendar discovery, Thunderbird accepted calendar locations that pointed to other servers, local files, or network shares. A malicious server, or a network attacker when the lookup uses plain HTTP, can force a subscription to such a location. On Windows, this leaks the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and calendar changes can be written to the attacker's share or overwrite a local file. This flaw is fixed in Thunderbird 159 and 153.6.

NoMachine has three vulnerabilities that open the door to remote code execution and full SYSTEM takeover. The most severe, CVE-2026-114549, has a CVSS score of 9.8, Critical severity. It is a heap-based buffer overflow in the nxwebrunner web service, which listens on TCP port 4443 by default, and it lets unauthenticated remote attackers run code as the service account. CVE-2026-92208 has a CVSS score of 8.8, High severity. It is a heap-based buffer overflow in mDNS record parsing that lets unauthenticated attackers on the adjacent network execute code as the service account.

CVE-2026-111184 has a CVSS score of 7.8, High severity. Incorrect permissions on a named pipe in the NoMachine Device Service let a local attacker who already runs low-privileged code escalate to SYSTEM. Together, these flaws give attackers a path from network access to complete control of the host. Patch all NoMachine installations now, starting with systems that expose the web service.

Oracle Java SE has two Critical vulnerabilities, and this update fixes both. CVE-2026-114820 has a CVSS score of 9.1, Critical severity. CVE-2026-91403 has a CVSS score of 9.1, Critical severity.

Java SE runs underneath a wide range of business applications on servers and endpoints. With two flaws scored this high, apply the update the same day to every system that runs Java SE.

This Oracle SOA Suite update fixes fifteen vulnerabilities, and every one of them is rated Critical. Three reach the maximum score: CVE-2026-91216, CVE-2026-91221, and CVE-2026-91231 each have a CVSS score of 10.0, Critical severity. CVE-2026-91224, CVE-2026-91232, CVE-2026-91250, and CVE-2026-91251 each have a CVSS score of 9.9, Critical severity. CVE-2026-91214, CVE-2026-91233, CVE-2026-91234, CVE-2026-91235, and CVE-2026-91236 each have a CVSS score of 9.8, Critical severity.

CVE-2026-91218 has a CVSS score of 9.6, Critical severity. CVE-2026-91230 has a CVSS score of 9.3, Critical severity. CVE-2026-91225 has a CVSS score of 9.1, Critical severity. Oracle SOA Suite links core business applications and workflows, so this many top-tier flaws in a single product puts integration infrastructure at serious risk. Apply the update the same day.

pgAdmin 4 version 9.19 fixes nine vulnerabilities in server mode. Together they let attackers take over accounts, borrow the pgAdmin service account's credentials, and run commands on the pgAdmin host. The most serious, CVE-2026-116241, has a CVSS score of 9.9, Critical severity. It lets an ordinary database user slip a command past the Import/Export Data tool, and pgAdmin then runs that command on its host under the account that runs pgAdmin. A second set of flaws lets attackers get around login protections. CVE-2026-116238 has a CVSS score of 8.1, High severity: it removes the lockout on failed logins, so an unauthenticated attacker can keep guessing passwords on any internal account, including the administrator's. CVE-2026-116239 has a CVSS score of 8.5, High severity: it lets an LDAP or Kerberos user sign in as another account, including the administrator.

The remaining High-severity fixes stop server-mode users from reaching credentials and files that belong to the service account or to other users. CVE-2026-116242 has a CVSS score of 8.2, High severity, and exposes the service account's SSH keys and agent. CVE-2026-116244 has a CVSS score of 8.2, High severity, and exposes its Kerberos tickets. CVE-2026-116245 has a CVSS score of 8.2, High severity, and exposes its connection service entries and password variables. CVE-2026-116247 has a CVSS score of 8.2, High severity, and exposes its saved password files and client certificates. CVE-2026-116249 has a CVSS score of 8.4, High severity, and allows path traversal into other users' password files, certificates, and SSH keys. CVE-2026-116243 has a CVSS score of 7.5, High severity, and lets a user run an uploaded executable from shared storage as the pgAdmin service account. Desktop mode is not affected by these flaws, but every server-mode deployment needs version 9.19.

• Treat any shared pgAdmin server as a privileged gateway to every database it connects to, and upgrade it the same day.

Progress WS_FTP Server on Windows has nine vulnerabilities, six of them Critical. The fixes come in versions 2024.0.7 and 2025.0.4. The most serious is CVE-2026-84295, with a CVSS score of 10.0, Critical severity. It is an authentication flaw that lets an unauthenticated remote attacker obtain sensitive information, including administrative credentials. CVE-2026-90868 has a CVSS score of 9.9, Critical severity, and CVE-2026-90865 has a CVSS score of 9.0, Critical severity. Both are OS command injection flaws that enable arbitrary command execution, with elevated privileges in the case of CVE-2026-90865. CVE-2026-90863, CVE-2026-90864, and CVE-2026-90866 each have a CVSS score of 9.1, Critical severity. Through missing authorization and path traversal, they let a delegated Host Administrator exceed their scope, reach files outside it, and potentially run code or fully compromise the server.

The update also fixes three High-severity flaws. CVE-2026-90867 has a CVSS score of 8.1, High severity, and exposes Web Admin console functions to remote authentication attempts. CVE-2026-84294 has a CVSS score of 7.7, High severity, and is a path traversal flaw in the Ad Hoc Transfer component that lets an authenticated user reach files outside intended directories. CVE-2026-90869 has a CVSS score of 7.5, High severity, and lets a remote attacker who knows an enrolled SSH public key shut down the shared SSH service. Versions 2024.0.6 and 2025.0.3 fix only the first two of these issues. Upgrading to 2024.0.7 or 2025.0.4 closes all nine.

CPython's update fixes a critical certificate-trust weakness in its "ssl" module. CVE-2026-115557 has a CVSS score of 9.4, Critical severity. Without certificate revocation configured, Python applications could still trust certificates that are known to be compromised. That opens encrypted connections to impersonation and interception. The update adds a built-in denylist of known compromised certificates. Python now rejects them automatically, whatever the SSLContext policy says. Every service, script, and integration that relies on Python for secure connections gains this protection once it is updated.

The Quest Foglight for Databases update fixes 13 vulnerabilities, and every one of them can give an attacker code execution with SYSTEM privileges. The three most serious need no authentication: CVE-2026-92188 (missing authentication in the ForgeMBeanServerSupport module), CVE-2026-92189 (external control of a file path in writeTopologySectionToFile), and CVE-2026-92190 (unsafe deserialization in the baseRmiServiceExporter bean) each have a CVSS score of 9.8, Critical severity. An unauthenticated remote attacker can use any of them to take full control of the host.

The update also fixes flaws that an authenticated user can exploit. Six directory traversal flaws affect file upload, license loading, and archive extraction: CVE-2026-92186, CVE-2026-92187, CVE-2026-92192, CVE-2026-92194, CVE-2026-92195, and CVE-2026-92197. Each has a CVSS score of 8.8, High severity. CVE-2026-92191, an incorrect authorization flaw in the runScript function, also has a CVSS score of 8.8, High severity. CVE-2026-92196, a server-side template injection flaw, has a CVSS score of 7.2, High severity. Two local privilege escalation flaws complete the release. CVE-2026-92199 comes from a hard-coded encryption key, and CVE-2026-92200 comes from incorrect folder permissions set by the installer. Each has a CVSS score of 7.8, High severity.

ServiceNow AI Platform has a sandbox escape flaw that lets an authenticated user with the admin role bypass Rhino sandbox restrictions and run arbitrary code on the underlying host operating system. That jump from application admin to the host opens the door to further unintended access beyond the platform itself. CVE-2026-103093 has a CVSS score of 9.4, Critical severity.

ServiceNow has deployed the fix to hosted instances and provided the update to partners and self-hosted customers. Self-hosted deployments must apply the update or upgrade to a patched release now to close this path to the host.

SolarWinds Dameware receives a security update that fixes two vulnerabilities in the remote administration platform. CVE-2026-28336 has a CVSS score of 9.9, Critical severity. It is a command injection flaw that lets an authenticated attacker compromise the remotely controlled host. CVE-2026-28327 has a CVSS score of 8.2, High severity. It is a DLL hijacking flaw that occurs during installation and enables elevation of privilege by an attacker with local access and admin privileges.

Dameware sits at the center of IT support operations with direct reach into managed endpoints, so a compromised session puts every connected host at risk. Apply this update the same day to close both paths.

SUSE Rancher updates fix five vulnerabilities in Rancher Manager and Rancher Fleet. Four of them let users gain privileges, and one leaks credentials. The two Critical flaws pose the greatest risk. CVE-2026-88811 has a CVSS score of 9.1, Critical severity: missing filtering in the Rancher Manager meta proxy can leak Rancher credentials to cloud providers. CVE-2026-94290 has a CVSS score of 9.1, Critical severity: Fleet does not properly limit which kubeconfig secrets a cluster can reference, so an ordinary user can make the controller run their Fleet content on the management cluster with administrative privileges.

Three High-severity privilege escalation flaws complete the update. CVE-2024-22031 has a CVSS score of 8.5, High severity: a user can create a project with the same name as one in another cluster and gain access to it. CVE-2026-104615 has a CVSS score of 7.9, High severity: Fleet cluster registration does not tie a cluster's identity to its registration token, so a request can attach to a cluster registered with a different token. CVE-2026-88810 has a CVSS score of 7.2, High severity: the inheritedNamespacedRules field of a GlobalRole skips privilege-escalation checks, so a non-administrative user can receive permissions in downstream clusters beyond the ones they already hold.

Teltonika RUT devices and the wider RUTOS and TSWOS families have two serious command execution flaws. The update closes both. CVE-2026-82104 has a CVSS score of 9.4, Critical severity. It lets an unauthenticated user call internal LUA functions directly and skip the checks that normal API requests go through, which can lead to OS command execution. It affects RUTOS 7.22 through 7.24.2 and TSWOS 1.9 through 1.10, across RUT, RUTX, RUTM, RUTC, ATRM, TAP, CAP, OXA, DAP, TRB, OTD, EBG, SWM and TSW devices.

CVE-2026-75826 has a CVSS score of 8.5, High severity. It is a command injection flaw in the backup function that lets a remote authenticated attacker run arbitrary OS commands. It is fixed in RUTOS 7.24.6 and 7.25.2, and in TSWOS 1.10.4. Together, these flaws give an attacker a direct path to take over network edge devices that carry business traffic.

This Veeam Backup and Replication update fixes an authorization bypass in the CDP Coordinator Service. An unauthenticated attacker can get past authorization controls on this service without any credentials. CVE-2026-108142 has a CVSS score of 9.1, Critical severity.

Backup infrastructure is a prime target because it holds copies of an organization's most sensitive data and is central to ransomware recovery. Apply this patch the same day to close unauthenticated access to the CDP Coordinator Service and protect backup integrity.

Veeam Backup for Microsoft 365 receives a security update that fixes two serious flaws in the platform organizations rely on to protect their Microsoft 365 data. CVE-2026-106076 has a CVSS score of 9.0, Critical severity. It is a SQL injection flaw that lets an authenticated organization-transfer peer inject SQL into the configuration database of the source server. The result is cross-tenant read and write access to configuration data and remote code execution as the PostgreSQL service account.

CVE-2026-106077 has a CVSS score of 8.3, High severity. It lets a user with the Veeam Backup for Microsoft 365 Administrator role read arbitrary files on the backup server with LocalSystem privileges. Together, these flaws put backup integrity, tenant isolation, and the backup server itself at risk.

WatchGuard Fireware OS receives a security update that fixes 13 vulnerabilities across the firewall's SIP proxy, Access Portal, FireCluster synchronization, authentication and logging services, certificate management, and management interface. Several flaws let unauthenticated remote attackers run arbitrary code or take privileged administrative actions on the device, while others let attackers who control or intercept traffic to the log server, Active Directory server, or WatchGuard Cloud execute code with root privileges. The rest allow authenticated or local attackers to gain root-level file write access, crash management and cluster services, or lock administrators out of the device.

The update covers seven Critical flaws: CVE-2026-103594 has a CVSS score of 9.5, Critical severity; CVE-2026-112709, CVE-2026-112710, CVE-2026-93857, CVE-2026-93865, and CVE-2026-93866 each have a CVSS score of 9.2, Critical severity; and CVE-2026-103593 has a CVSS score of 9.1, Critical severity. It also covers six High flaws: CVE-2026-111107 and CVE-2026-90465 each have a CVSS score of 8.7, High severity; CVE-2026-90442 has a CVSS score of 8.6, High severity; CVE-2026-90464 and CVE-2026-93862 each have a CVSS score of 7.2, High severity; and CVE-2026-93864 has a CVSS score of 7.1, High severity.

Wing FTP Server has a path traversal flaw because it does not verify each user's base folder. CVE-2026-105420 has a CVSS score of 9.4, Critical severity. An attacker with admin privileges can use scripts to add user directories that escape the base folder, then write files anywhere on the system. This can lead to remote code execution with the privileges of the server process.

The risk is higher on standard installs. The installation guide tells administrators to run the server with sudo, so files the attacker creates are owned by root. Version 8.2.6 fixes the flaw by enforcing the base folder boundary.

This WSO2 API Manager update closes two Critical access control flaws in the System REST APIs that let users without the right privileges run administrative actions. CVE-2025-11969 has a CVSS score of 9.4, Critical severity. Improper authorization lets users with lower-privilege roles perform restricted administrative operations, including running administrative functions. APIs exposed through the API Gateway are not affected.

CVE-2026-4052 has a CVSS score of 9.8, Critical severity. A missing authorization check lets a self-registered user reach the System REST APIs with a token from the WSO2 Identity Server token endpoint. This affects deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. Both flaws let attackers escalate privileges and take administrative control of the API management platform.

Zoho Log360 receives a security update that fixes two access control flaws affecting Log360 and EventLog Analyzer. CVE-2026-13594 has a CVSS score of 9.1, Critical severity, and lets an attacker gain unauthorized access to the product. CVE-2026-16900 has a CVSS score of 7.5, High severity, and lets an unauthenticated attacker bypass authentication to register a rogue local collector by sending a specially crafted registration request.

Both flaws allow privilege escalation inside a platform that collects and analyzes security event data. An attacker who exploits them can gain a foothold in the logging pipeline, tamper with what defenders see, and weaken incident detection across the environment. Apply the update the same day.

Camunda 7 versions 7.24.14 and 7.23.17 fix two serious flaws in the engine's REST API. CVE-2026-109432 has a CVSS score of 9.8, Critical severity. It is an expression injection flaw: the orQueries field of task queries skips the check that should block expressions in ad hoc queries. Any authenticated user can slip in a malicious expression and run operating-system commands as the engine service user. CVE-2026-109431 has a CVSS score of 8.1, High severity. It is a missing authorization check in the task comment and attachment endpoints. An authenticated user with no permissions who knows an object ID can read and download task comments and attachments, and can permanently delete attachments.

Proof-of-concept code is available for both vulnerabilities, so attackers have a clear path to use them. Any user account becomes a route to full server compromise and to stolen or destroyed business process data. Upgrade the 7.24 line to 7.24.14 and the 7.23 line to 7.23.17 now.

GnuPG for Windows has an update that fixes a critical flaw in how the software trusts its configuration directory. CVE-2026-118131 has a CVSS score of 9.8, Critical severity. GnuPG 2.5.21 on Windows inherits default permissions on the C:ProgramData directory, so any member of the local Users group can create subdirectories there. An attacker with low-privilege access can create GnuPG's expected configuration directory first and fill it with malicious configuration files.

When a victim runs GnuPG, its components load those planted files, and the attacker's code runs with the victim's privileges. A standard user can use this to take over the session of any other user on the same system, including administrators. Shared workstations, terminal servers, and multi-user systems that use GnuPG for signing or encryption face the highest risk.

HCL Domino Server is exposed to a man-in-the-middle flaw caused by the compromise of private keys for eight eMudhra intermediate CA certificates. These keys undermine certificate trust for the server's outbound network request features. An unauthenticated network attacker can spoof server certificates, then intercept and modify the content of outbound TLS connections. CVE-2026-108014 has a CVSS score of 9.1, Critical severity.

The update restores certificate trust for Domino's outbound TLS connections and closes this interception path. Apply it the same day to protect the integrity and confidentiality of data that Domino sends to external services.

HCL Notes Client has a critical certificate trust flaw. The private keys for eight eMudhra intermediate CA certificates were compromised, and this weakens the certificate trust behind the client's outbound network requests. An unauthenticated network attacker can spoof server certificates and launch a man-in-the-middle attack to intercept or modify outbound TLS traffic. This update covers CVE-2026-108015, which has a CVSS score of 9.1, Critical severity.

The risk is direct: email and collaboration traffic that users believe is secure can be read or altered in transit. Organizations running HCL Notes Client should deploy this update the same day to restore trusted connections and protect sensitive business communications.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

HPE ArubaOS (AOS) receives a security update that fixes 32 Critical vulnerabilities across AOS-8 and AOS-10. The flaws include authentication bypass, command injection, buffer overflow, memory corruption, SQL injection, path traversal, and sensitive information disclosure. Many sit in the management interfaces, the SSH daemon, the CLI, Wi-Fi frame processing, and the PAPI access point management protocol on UDP port 8211. An unauthenticated attacker, either remote or on an adjacent network, can run arbitrary code or commands as a privileged user or as root, take administrative control, change configurations, and fully compromise the controller.

CVE-2026-79844, CVE-2026-79846, CVE-2026-79847, CVE-2026-79848, CVE-2026-79849, CVE-2026-79850, and CVE-2026-79851 each have a CVSS score of 10.0, Critical severity. CVE-2026-79852, CVE-2026-79853, CVE-2026-79854, CVE-2026-79855, CVE-2026-79856, CVE-2026-79857, CVE-2026-79858, CVE-2026-79859, CVE-2026-79860, and CVE-2026-79861 each have a CVSS score of 9.8, Critical severity. CVE-2026-79862, CVE-2026-79863, CVE-2026-79864, CVE-2026-79865, CVE-2026-79866, CVE-2026-79867, CVE-2026-79868, CVE-2026-79869, CVE-2026-79870, and CVE-2026-79871 each have a CVSS score of 9.6, Critical severity. CVE-2026-79872 has a CVSS score of 9.4, Critical severity. CVE-2026-79873, CVE-2026-79874, CVE-2026-79875, and CVE-2026-79876 each have a CVSS score of 9.3, Critical severity.

Two Critical vulnerabilities in Oracle Enterprise Manager for Oracle Database make this a same-day update. CVE-2026-101528 has a CVSS score of 9.9, Critical severity. CVE-2026-101529 has a CVSS score of 9.9, Critical severity. Both flaws are in the platform that manages Oracle Database environments, and this patch fixes both.

Two Critical vulnerabilities in Oracle Solaris put affected systems at serious risk, and this update closes both. CVE-2026-101537 has a CVSS score of 9.8, Critical severity, and CVE-2026-60432 also has a CVSS score of 9.8, Critical severity. With both flaws rated this high in one operating system, any unpatched Solaris system carries outsized exposure, making this a same-day update.

A security update for Oracle PeopleSoft Enterprise PeopleTools closes a Critical vulnerability in the technology layer that every PeopleSoft application runs on. CVE-2026-101420 has a CVSS score of 9.6, Critical severity, which places it among the most serious flaws an organization can carry. PeopleSoft HR, finance, and campus applications all depend on PeopleTools, so leaving this flaw open puts the core business systems built on top of it at risk.

Red Hat Build of Keycloak contains a Critical flaw in its SAML HTTP-Redirect binding that leaves federated user accounts open to full takeover. The server processes percent-encoded parameter names, such as %53AMLResponse, but its signature verification checks only literal names. That mismatch lets a crafted, unsigned SAML message slip past verification, and the server acts on it instead of the legitimately signed one. Keycloak decides who gets in, so a forged login gives the attacker every permission the targeted account holds.

Red Hat's update closes the gap between how the server reads SAML parameters and how it verifies their signatures. CVE-2026-117691 has a CVSS score of 9.1, Critical severity.

Six access-control flaws in Sonatype Nexus Repository 3 give administrator access, sign-in rights, signing secrets and upload rights to users who should not have them, and this update closes all six. CVE-2026-113373 has a CVSS score of 9.1, Critical severity, and lets disabled or locked users sign back in to Nexus Repository 3 Pro through a SAML or OAuth2/OpenID Connect identity provider and get their roles back. CVE-2026-97712 has a CVSS score of 8.7, High severity, and lets users who can create or update roles grant roles and privileges they do not hold, up to full administrative access. CVE-2026-113374 has a CVSS score of 8.6, High severity, and lets users who can only create capabilities turn on header-based authentication, so remote clients can sign in as an existing user, including an administrator, without credentials.

CVE-2026-113371 and CVE-2026-113372 each have a CVSS score of 7.1, High severity. Together they expose APT and YUM repository signing passphrases and YUM private signing keys to accounts that hold only read privilege for administering the repository, and anyone holding a leaked key can sign repository metadata as that repository. CVE-2026-97665 has a CVSS score of 7.1, High severity, and lets accounts with only read and browse privileges upload NuGet symbol packages without write permission to hosted repositories that have Symbol Server enabled. When anonymous access is on, this includes the built-in anonymous user.

A critical flaw in SonicWall Global Management System (GMS) lets an unauthenticated attacker with network access read internal GMS files and expose sensitive information. This patch fixes CVE-2026-109593, which affects GMS 9.5.2 and earlier versions. CVE-2026-109593 has a CVSS score of 9.1, Critical severity. The attack needs no credentials, so every unpatched GMS instance reachable over the network is at risk.

Strapi Open Source and Enterprise Headless CMS has a Critical broken access control flaw in its review-workflows package. The package applies document updates without checking whether the caller has update rights, so users without that permission can still change managed content. A feature built to manage content review becomes a way to make unauthorized edits. This update closes that gap and covers one vulnerability. CVE-2026-118170 has a CVSS score of 9.1, Critical severity.

The Vertiv Avocent ACS8000 update closes a critical remote code execution flaw that gives remote attackers root-level control of the appliance. CVE-2026-65184 is an OS command injection vulnerability in the root-privileged wsserver terminal-bridge daemon. The daemon builds a shell command from client-supplied WebSocket fields and runs it without quoting, escaping, or character-set validation. The daemon's public-key session path also performs no appliance-session check. CVE-2026-65184 has a CVSS score of 9.8, Critical severity.

Apache Kafka has four Critical vulnerabilities, each with a CVSS score of 9.1: CVE-2026-110985, CVE-2026-111108, CVE-2026-111115, and CVE-2026-111496. CVE-2026-110985 is an authentication bypass: a broker using SASL/OAUTHBEARER with the default validator and no JWKS endpoint URL silently falls back to a validator that never checks the token signature, algorithm, or issuer, so an unauthenticated remote attacker who can reach the listener can forge a token for any principal, including superusers, and take full control of the cluster. CVE-2026-111108 and CVE-2026-111115 are memory-amplification flaws in the protocol readers: a request of a few tens of megabytes can declare enormous array lengths or tens of millions of tagged fields, forcing the broker to allocate many times the request size and crash with an out-of-memory error. Parsing runs before authorization, so open listeners need no credentials and authenticated ones need no specific permissions. CVE-2026-111496 affects Kafka Streams: a single record with a timestamp near the maximum value overflows the stream-time clock and locks the processing thread in an infinite loop that returns on every restart; it is reachable only through brokers older than 4.0.0 or those with a relaxed timestamp bound.

Apache Kafka 4.2.2, 4.3.2, and 4.4.0 resolve all four CVEs. A broker that would run without signature verification now refuses to start, the generated readers cap array pre-allocation and reject oversized array and tagged-field counts before allocating, and Streams computes punctuation times with overflow-checked arithmetic. Until the upgrade is deployed, set a JWKS endpoint URL on every listener that uses OAUTHBEARER validation, lower the maximum socket request size, and restrict network access to broker listeners.

Delinea Secret Server (On-Prem) versions earlier than 12.3.1 carry three authentication-bypass flaws that hand attackers elevated access to the enterprise password vault. CVE-2026-115829 has a CVSS score of 9.9, Critical severity: a user can generate a two-factor PIN code for any account without prior authentication, skip the initial login step, and sign in with the second factor alone. CVE-2026-115828 has a CVSS score of 9.4, Critical severity: Secret Server does not always validate the PIN or biometric check when a FIDO2-compliant device is used. CVE-2026-115830 has a CVSS score of 8.7, High severity: under certain conditions a user can submit an unsigned JSON Web Token (JWT) and receive cloudadmin permissions in response. All three flaws enable privilege escalation.

Secret Server 12.3.1 fixes all three issues. Because the vault stores privileged credentials for the whole organization, a single bypassed login exposes every secret inside it and the systems those secrets unlock. Upgrade every on-prem Secret Server instance to 12.3.1 or later without delay.

CVE-2026-124194 is a spoofing flaw in Microsoft Outlook that attackers are already using. An attacker sends a specially crafted message file and gets the user to open it. Outlook then connects to a network location the attacker controls, but it skips the usual warning about external content. That quiet connection can leak the user's NTLMv2 hash, a scrambled form of their login secret, which the attacker can use to sign in as that person. It affects Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024.

CVSS Score: 6.5

SEVERITY: Moderate

THREAT: An attacker with no account could trick a user into opening a crafted message file and steal that user's NTLMv2 hash. With it, they could sign in as the user and reach what that person can reach.

EXPLOITS: This vulnerability is actively exploited. The issue was not publicly disclosed before the fix, and no confirmed public proof-of-concept is identified.

TECHNICAL SUMMARY: The root cause is CWE-356: the product interface does not warn the user about an unsafe action. When Outlook opens a crafted message file, it reaches out to an attacker-controlled network location without showing the normal external-content warning. During that connection, Windows sends the user's NTLMv2 authentication data, and the attacker captures the hash. The attacker can then use it to authenticate as the user. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. The attack works over the network, is easy to carry out, and needs no privileges, but the user must open the file. The impact is a high loss of confidentiality, with no direct effect on integrity or availability. The Preview Pane is not an attack vector.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit) and Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit). The fix ships as a security update through the Office release channels. An attacker sends a malicious Office message file and convinces the user to open it in Outlook.

BUSINESS IMPACT: Email is the easiest door into any company, and this flaw turns one opened file into stolen identity. A captured hash can let an attacker sign in as the victim, read their data, and move to other systems they can reach. If the victim is an administrator or a finance user, the damage grows fast. Because the warning users are trained to watch for never appears, even careful staff can be caught. Attackers are already using it, so this is a live risk, not a theory.

WORKAROUND: No official mitigations or workarounds are listed. Until the update is in place, warn users not to open unexpected message files, block outbound SMB traffic (TCP 445) to the internet, and watch for unusual sign-ins that may use stolen hashes.

URGENCY: The Moderate label undersells this one. Attackers are already exploiting it, it needs only one click on an email file, and it hits Outlook, which nearly every organization runs. A stolen hash can open doors far beyond the inbox. Push the Office update to every Outlook user now, starting with administrators and high-value accounts.

SPEAKER NOTES:

• Attackers are actively exploiting this Outlook spoofing flaw.
• Opening a crafted message file makes Outlook connect out with no warning.
• That connection can leak the user's NTLMv2 hash, which lets attackers sign in as them.
• The Preview Pane is not an attack path, so the user must open the file.
• Deploy the Office update to all Outlook users right away, even though it is rated Moderate.

This is a heap-based buffer overflow in Microsoft Office. An attacker can craft a malicious file that, when the user interacts with it, writes past the end of a memory buffer and lets the attacker run code with the user's permissions. The attacker needs no privileges on the target. Microsoft rates it Critical.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: A remote attacker could trick a user into handling a malicious Office file and then run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-122, Heap-based Buffer Overflow. Office copies data into a heap buffer without making sure it fits, so a crafted file can overwrite nearby memory and take control of execution. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network, low complexity, no privileges, user interaction required, with high impact. Microsoft has not published additional FAQ details on the exact trigger, so the precise file type and user action cannot be confirmed from the data.

EXPLOITABILITY: Affected: Microsoft 365 Apps for Enterprise (32-bit and 64-bit) and Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit). Fixes are delivered through the Office release channels. An attacker would deliver a crafted file and rely on the user to interact with it.

BUSINESS IMPACT: Office runs on almost every corporate desktop, and malicious documents remain one of the most common ways attackers get in. Code execution on a single workstation can lead to stolen credentials, data theft, and ransomware that spreads across the network. Users with admin rights make the impact far worse.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, block or quarantine Office attachments from untrusted senders, keep users on least-privilege accounts, and remind staff to be careful with unexpected files.

URGENCY: This flaw is Critical, reachable over the network, and needs no privileges, only a user interacting with a file. Because Office is so widely deployed, the attack surface is enormous. Roll out the Office update across all channels quickly and verify devices are current.

CVE-2026-118730 is a remote code execution flaw in Microsoft Excel caused by a use-after-free memory bug. An attacker who gets a user to open a specially crafted Excel file could run code on that user's computer with the same rights as the user. The flaw affects Microsoft 365 Apps, Office LTSC 2021 and 2024, and Office Online Server.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in Microsoft Excel. Excel releases a piece of memory while handling a workbook but keeps using a stale pointer to it. A crafted file can fill that freed memory with attacker-controlled data, letting the attacker redirect execution and run code. The attack needs no login and no special privileges, but it does require the user to take part: open a specially crafted file sent by the attacker. The Preview Pane is not an attack vector, which removes one easy path for attackers. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted Excel file.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-118713 is a remote code execution flaw in Microsoft Excel caused by a use-after-free memory bug. An attacker who gets a user to open a specially crafted workbook and edit a cell in it could run code on that user's computer with the same rights as the user. The attack is triggered when the user edits a cell in the malicious workbook.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in Microsoft Excel. When the user edits a cell in a crafted workbook, Excel frees memory tied to that data but still references it later. An attacker who controls what lands in that memory can take over the program's flow and run code. The attack needs no login and no special privileges, but it does require the user to take part: the user must open a crafted workbook in an affected version of Excel and edit a cell in it. The Preview Pane is not an attack vector, which removes one easy path for attackers. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted workbook and edit a cell in it.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-118711 is a remote code execution flaw in Microsoft Excel caused by a stack-based buffer overflow. An attacker who gets a user to open a specially crafted workbook and edit a cell in it could run code on that user's computer with the same rights as the user. The attack is triggered when the user edits a cell in the malicious workbook.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a stack-based buffer overflow (CWE-121) in Microsoft Excel. When a cell in a crafted workbook is edited, Excel copies more data onto the stack than the buffer can hold. The extra data overwrites nearby memory, which an attacker can use to take over execution and run code. The attack needs no login and no special privileges, but it does require the user to take part: the user must open a crafted workbook in an affected version of Excel and edit a cell in it. The Preview Pane is not an attack vector, which removes one easy path for attackers. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted workbook and edit a cell in it.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-118702 is a Critical remote code execution vulnerability in Microsoft Office Excel caused by a double free memory error. An attacker who convinces a user to open a specially crafted file could run code on the computer with the user's rights. The Preview Pane is not an attack vector, so the file must actually be opened. Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 are affected.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated attacker who tricks a user into opening a malicious workbook could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a double free (CWE-415) in Microsoft Office Excel. When Excel processes a specially crafted file, it can release the same block of memory twice. That corrupts the heap and can let an attacker control program flow and run their own code in the context of the user. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: the malicious file is delivered over the network, the attack is low in complexity and needs no privileges, but the user must open the file. The Preview Pane is not an attack vector. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Microsoft 365 Apps for Enterprise (32-bit and 64-bit) and Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions) are affected. An attacker must get a user to open a specially crafted file, usually through email or a download. Simply previewing the file in the Preview Pane does not trigger the bug.

BUSINESS IMPACT: Excel sits on nearly every business desktop, and spreadsheets are among the most trusted files people open every day. A single opened invoice, report, or budget file could give an attacker a foothold on a workstation, with access to the user's email, documents, and saved credentials. From there, attackers can steal data, install ransomware, or move deeper into the network. Finance, HR, and executive teams, who handle spreadsheets constantly, are prime targets.

WORKAROUND: No official mitigation or workaround is listed, so patching is the real fix. Until then, tell users not to open Excel files from unknown or unexpected senders, keep Protected View on for files from the internet and email, and filter or block risky spreadsheet attachments at the mail gateway.

URGENCY: This is rated Critical with a CVSS score of 8.8, needs no privileges, and targets one of the most widely used business applications. The only hurdle is getting a user to open a file, which phishing attackers clear every day. No exploitation has been seen yet, but Microsoft 365 Apps and Office LTSC should be updated in this patch cycle.

CVE-2026-118701 is a Critical remote code execution vulnerability in Microsoft Office Excel caused by a heap-based buffer overflow. An attacker could convince a user to open a specially crafted workbook in an affected version of Excel and save it, which could let the attacker run code with the user's privileges. The Preview Pane is not an attack vector. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office Online Server are affected.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated attacker who tricks a user into opening a malicious workbook could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. When a user opens a specially crafted workbook and then saves it, Excel can write data past the end of a heap buffer. An attacker who controls that overflow can corrupt memory and run code with the user's privileges. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network delivery, low complexity, no privileges, but user interaction is required. The Preview Pane is not an attack vector. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions), and Office Online Server (fixed by update 5002946) are affected. An attacker must convince a user to open a specially crafted workbook in an affected version of Excel and save it. Previewing the file is not enough to trigger the bug.

BUSINESS IMPACT: Excel sits on nearly every business desktop, and spreadsheets are among the most trusted files people open every day. A single opened invoice, report, or budget file could give an attacker a foothold on a workstation, with access to the user's email, documents, and saved credentials. From there, attackers can steal data, install ransomware, or move deeper into the network. Finance, HR, and executive teams, who handle spreadsheets constantly, are prime targets.

WORKAROUND: No official mitigation or workaround is listed, so patching is the real fix. Until then, tell users not to open Excel files from unknown or unexpected senders, keep Protected View on for files from the internet and email, and filter or block risky spreadsheet attachments at the mail gateway.

URGENCY: This is rated Critical with a CVSS score of 8.8, needs no privileges, and targets one of the most widely used business applications in the world. The attack path is simple and familiar: send a file, get it opened. Even though no exploitation has been seen yet, Excel file bugs are a favorite phishing tool, so update Microsoft 365 Apps, Office LTSC, and Office Online Server in this patch cycle.

CVE-2026-118297 is a remote code execution flaw in Microsoft Excel caused by a heap-based buffer overflow. An attacker who gets a user to open a specially crafted Excel file could run code on that user's computer with the same rights as the user. The flaw affects Microsoft 365 Apps, Office LTSC 2021 and 2024, and Office Online Server.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Excel. While parsing a crafted file, Excel writes more data into a heap buffer than it was sized for. That overflow corrupts nearby heap memory, which an attacker can shape to take control of execution and run code. The attack needs no login and no special privileges, but it does require the user to take part: the user must open a specially crafted file sent by the attacker. The Preview Pane is not an attack vector, which removes one easy path for attackers. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted Excel file.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-118296 is a remote code execution flaw in Microsoft Excel caused by a double free memory bug. An attacker who gets a user to open a specially crafted Excel file could run code on that user's computer with the same rights as the user. The flaw affects Microsoft 365 Apps, Office LTSC 2021 and 2024, and Office Online Server.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a double free (CWE-415) in Microsoft Excel. While processing a crafted file, Excel releases the same block of memory twice. That corrupts the memory manager's internal state, and an attacker can use the corruption to take control of execution and run code. The attack needs no login and no special privileges, but it does require the user to take part: the user must open a specially crafted file sent by the attacker. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted Excel file.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-118148 is an incorrect authorization flaw in Active Directory Domain Services. An attacker with a low-privileged account can exploit it over the network to gain SYSTEM privileges. The attack is complex because the attacker must win a race condition, but successful exploitation is considered more likely.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An authenticated attacker with low-level access could gain SYSTEM privileges on an affected system, opening the door to domain-wide compromise.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is incorrect authorization (CWE-863) in Active Directory Domain Services. Under certain timing, the service fails to enforce the right access checks, so a low-privileged user can perform actions they should not be allowed to. The attacker must win a race condition to exploit it. The attack is over the network, with high complexity, low privileges, and no user interaction. A successful attacker gains SYSTEM privileges, with high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker with valid low-privileged credentials sends requests over the network and races the authorization check to escalate.

BUSINESS IMPACT: Active Directory controls who can access what across the business. SYSTEM access on a domain controller can lead to control of every account, server, and workstation in the domain. That means mass ransomware deployment, data theft, and a long, costly recovery.

WORKAROUND: No official workarounds are listed. Limit who can log on to domain controllers, monitor for unusual directory activity, and enforce strong account hygiene until the patch is applied.

URGENCY: This is a Critical bug in the heart of most corporate networks, and exploitation is considered more likely. Any user account could be the starting point. Patch domain controllers first, then the rest of the fleet.

CVE-2026-118292 is a remote code execution flaw in Microsoft Excel caused by a stack-based buffer overflow. An attacker who gets a user to open a specially crafted workbook and save it in a different file format could run code on that user's computer with the same rights as the user. The attack is triggered when the user saves the malicious workbook in a different file format.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any outside attacker who can deliver a malicious workbook by email, chat, or file share could take over the victim's session and run code with that user's permissions.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a stack-based buffer overflow (CWE-121) in Microsoft Excel. When a crafted workbook is saved in a different file format, Excel copies data onto the stack without checking its size. The overflow overwrites nearby memory, which an attacker can use to take over execution and run code. The attack needs no login and no special privileges, but it does require the user to take part: the user must open a crafted workbook in an affected version of Excel and save it in a different file format. The Preview Pane is not an attack vector, which removes one easy path for attackers. If the attack works, the attacker gets full control over confidentiality, integrity, and availability within the user's context, which means they can steal data, change files, or install more malware.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit), plus Office Online Server (fixed by update 5002946, which replaces 5002928). To exploit this flaw, an attacker sends or shares a booby-trapped workbook and persuades the user to open a specially crafted workbook and save it in a different file format.

BUSINESS IMPACT: Excel sits at the heart of finance, HR, sales, and operations, and spreadsheets are shared all day long. That makes a poisoned workbook an easy and believable lure. One successful attack can give an intruder a foothold on a user's machine, open the door to data theft or ransomware, and spread to shared drives and other systems. The fallout can include downtime, breach costs, regulatory trouble, and lost customer trust.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, block or quarantine Office files from unknown senders, keep Protected View on for files from the internet, use attack surface reduction rules to stop Office apps from launching child processes, and remind users not to open unexpected attachments.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. It needs no credentials, only a user who opens a file, and Excel is installed on almost every business desktop. Spreadsheet lures are one of the most common phishing tricks, so the gap between a fix and real attacks can be short. Deploy the Office update across all affected editions, and Office Online Server where used, as soon as possible.

CVE-2026-119382 is a heap-based buffer overflow in the Windows Trusted Platform Module (TPM) components. An attacker who already has a low-privileged account on the system can trigger the overflow locally and raise their privileges. The flaw affects all supported Windows client and server versions in the update.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: A local attacker with a standard user account could exploit this bug to gain higher privileges and take full control of the machine.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Windows TPM handling. A low-privileged local user can send crafted input that causes Windows to write past a heap buffer. This memory corruption can be used to run code in a more privileged context. The attack is local, low complexity, needs low privileges, and requires no user interaction. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. The attacker must first be able to run code on the system as a regular user, then trigger the bug locally.

BUSINESS IMPACT: Privilege escalation bugs turn a small breach into a big one. An attacker who lands on one workstation through phishing or malware can use this flaw to gain full control, disable defenses, and harvest credentials. Because the TPM is tied to security features like BitLocker and Windows Hello, tampering here hits trust at its core.

WORKAROUND: No official workarounds are listed. Limit local logon rights, enforce least privilege, and use application control to block untrusted code until the patch is in place.

URGENCY: Microsoft rates this Critical, and the attack is simple once an attacker is on the box. Attackers routinely chain bugs like this with phishing to go from user to full control. Every supported Windows version is affected, so patch broadly and quickly.

CVE-2026-119969 is a heap-based buffer overflow in the Windows Graphic Fonts component. An attacker who gets a user to open or view specially crafted content can overflow memory while the font is processed and run code on the system. It affects every supported Windows client and server release in the update.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated remote attacker who tricks a user into opening malicious content could run code with that user's rights and take control of the system.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in how Windows handles graphic fonts. When a crafted font is parsed, Windows writes past the end of a heap buffer, corrupting nearby memory. An attacker can shape that corruption to redirect execution and run their own code. The attack works over a network, needs low complexity and no privileges, but does require the user to take an action such as opening a file or visiting content. A successful attack fully compromises confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker delivers a weaponized font inside a document, email, or web content and waits for a user to open or preview it.

BUSINESS IMPACT: Fonts are everywhere: documents, emails, web pages, and presentations. That makes this an easy bug to hide inside everyday business files. One click by one employee could give an attacker a foothold to steal data, plant ransomware, or move deeper into the network.

WORKAROUND: No official workarounds are listed. Until you patch, block untrusted documents and attachments at the email gateway, use Protected View for Office files, and limit user privileges so a successful attack does less damage.

URGENCY: This bug is rated Critical, reachable over the network, and needs no credentials, just one user action. Font handling is built into every Windows system in the list, from laptops to servers, so the attack surface is huge. Patch quickly before attackers turn this into a phishing payload.

CVE-2026-119967 is a use-after-free flaw in the Windows Message Queuing Queue Manager. An unauthenticated attacker could send a specially crafted packet to an affected service and run code on the target system, with no user interaction. The attack only works when Message Queuing HTTP support is enabled and set up to accept anonymous requests, and the attacker cannot turn that setting on through this bug.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated attacker who can reach an MSMQ server with anonymous HTTP support enabled could run code on it. That would give them a foothold on a server that often handles business application traffic.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The bug is a use-after-free (CWE-416) in the Message Queuing Queue Manager. A crafted packet can make the service use memory after it has been freed, which an attacker can turn into code execution. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It needs no credentials or user action, but the complexity is high because the target must have Message Queuing HTTP support enabled and configured to process anonymous requests.

EXPLOITABILITY: Affected: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. Only systems with Message Queuing HTTP support enabled and accepting anonymous requests are exploitable; the attacker sends a crafted packet over the network. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: Servers that expose MSMQ over HTTP are often tied to line-of-business apps and integrations with partners. A compromise could lead to data theft, tampered transactions, or ransomware spreading from a trusted application server. Because anonymous access is part of the attack path, there is no login barrier to slow an attacker down.

WORKAROUND: Microsoft lists no mitigations or workarounds. If you cannot patch, disable Message Queuing HTTP support where it is not needed, turn off anonymous access to it, and block MSMQ traffic from untrusted networks.

URGENCY: This is a Critical, unauthenticated remote code execution bug in a service with a long track record of serious flaws. The required configuration narrows the target list, but any system that matches is fully exposed. Find MSMQ servers with HTTP support enabled and patch them right away.

CVE-2026-119963 is a remote code execution flaw in Windows Message Queuing (MSMQ). A double free bug in the service lets an attacker who has no account on the system send a specially crafted packet and run code on the target. It affects a wide range of supported Windows client and server versions, and the attacker needs no credentials and no help from a user.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated attacker anywhere on the network could send crafted packets to a Windows system running Message Queuing and run their own code on it. No login and no user click are needed.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a double free (CWE-415) in the Windows Message Queuing service. When the service processes a malicious packet, it can release the same block of memory twice. That corrupts the memory manager's internal state, and a skilled attacker can shape that corruption to take control of the program's flow and execute code. The attack runs over the network, needs no privileges and no user interaction, and a successful exploit can fully compromise confidentiality, integrity and availability on the target. Attack complexity is high because specific protocol settings or configurations must be in place first.

EXPLOITABILITY: Affected versions include Windows 10 (versions 1607, 1809, 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker sends a specially crafted packet to the Message Queuing service over the network. The attack only works when specific conditions, such as particular protocol settings or configurations, are in place, which makes it harder to pull off at scale.

BUSINESS IMPACT: Message Queuing often runs on servers that move orders, transactions and messages between business applications. Code execution on such a server hands an attacker a trusted foothold inside the network, where they can steal data, tamper with business messages, deploy ransomware or move to other systems. Because no login is required, a single exposed MSMQ endpoint could be the starting point of a full breach.

WORKAROUND: No official mitigations or workarounds are listed. If you cannot patch right away, disable the Message Queuing service on systems that do not need it, and block inbound traffic to the Message Queuing port (TCP 1801) at the host and network firewall so only trusted systems can reach it.

URGENCY: This flaw is rated Critical, is reachable over the network, and needs neither credentials nor user action. Even though conditions must line up for an attack to work, the payoff is full code execution on Windows servers and workstations that are found in almost every organization. Message Queuing has a history of serious network-reachable bugs, so attackers are likely to study this patch. Deploy the update quickly, starting with any system where Message Queuing is enabled or reachable from untrusted networks.

CVE-2026-119964 is another remote code execution flaw in Windows Message Queuing (MSMQ). A double free bug lets an unauthenticated attacker send a specially crafted packet over the network and execute code on the target system. It affects nearly every supported version of Windows client and server, and it needs no credentials and no user interaction.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated attacker anywhere on the network could send crafted packets to a Windows system running Message Queuing and run their own code on it. No login and no user click are needed.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The root cause is a double free (CWE-415) in the Message Queuing service. While handling a malicious packet, the service frees the same memory more than once. This leaves memory in a corrupted state that an attacker can abuse to redirect execution and run code. The attack runs over the network, needs no privileges and no user interaction, and success means full impact to confidentiality, integrity and availability. Attack complexity is high, because particular protocol settings or configurations must be in place before the attack can succeed.

EXPLOITABILITY: Affected versions include Windows 10 (versions 1607, 1809, 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker sends a specially crafted packet to the Message Queuing service over the network. The attack only works when specific conditions, such as particular protocol settings or configurations, are in place, which makes it harder to pull off at scale.

BUSINESS IMPACT: Many line-of-business applications depend on Message Queuing to pass orders, payments and system events between servers. If an attacker gains code execution on one of these servers, they can read or alter sensitive business messages, disrupt critical workflows, plant ransomware, and use the server as a stepping stone into the rest of the network. The lack of any login requirement makes exposed MSMQ systems an easy first target.

WORKAROUND: No official mitigations or workarounds are listed. If you cannot patch right away, disable the Message Queuing service on systems that do not need it, and block inbound traffic to the Message Queuing port (TCP 1801) at the host and network firewall so only trusted systems can reach it.

URGENCY: This vulnerability is rated Critical, can be reached over the network, and requires no account or user action. It ships alongside a sister flaw in the same service, which doubles the attention attackers will give to Message Queuing this month. The high attack complexity slows attackers down but does not stop them. Roll out the update promptly, and treat any server with Message Queuing enabled as a top priority.

CVE-2026-119966 is an integer overflow in the Windows Graphics Kernel. An attacker who already has high privileges on a system could use it locally to elevate further and break out of the current security scope. Microsoft rates it Critical.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: A local attacker who already holds high privileges could exploit this flaw to gain even greater control, crossing a security boundary into a more privileged context.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is an integer overflow or wraparound (CWE-190) in the Windows Graphics Kernel. When a calculation exceeds the size of its number type, it can wrap to a small value and lead to memory being sized or accessed incorrectly. An attacker can use this to corrupt kernel memory and elevate privileges. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:C) shows a local attack that needs high privileges and is complex to pull off, but the scope is changed, so the impact reaches beyond the vulnerable component. Confidentiality, integrity and availability impacts are all high.

EXPLOITABILITY: Affected versions are Windows 11 versions 23H2, 24H2, 25H2 and 26H2 (x64 and ARM64), and Windows Server 2025, including Server Core. An attacker needs local, high-privileged access to trigger the overflow.

BUSINESS IMPACT: Attackers who already have admin-level access use bugs like this to escape sandboxes or security boundaries and hide deeper in the system. That makes it harder to detect and remove them. The result can be persistent compromise, disabled security tools and wider damage across the network.

WORKAROUND: Microsoft lists no mitigations or workarounds. Reduce the number of accounts with high privileges and closely monitor privileged activity until the update is installed.

URGENCY: Microsoft rates this Critical because a successful attack crosses a security boundary. The need for high privileges lowers the immediate risk, but this kind of bug is valuable in attack chains after an initial compromise. Fixes are in KB5131087 (Windows 11 23H2), KB5132061 and KB5132043 (Windows 11 24H2/25H2/26H2), and KB5131080 and KB5131077 (Server 2025), and a restart is required.

CVE-2026-119962 is a Critical remote code execution vulnerability in the Windows Credential Security Support Provider (CredSSP) protocol. A double free memory bug lets an unauthenticated attacker send network traffic that could lead to code execution on the target. No user interaction is needed, although the attack is complex to pull off. The flaw affects a wide range of Windows client and server versions, from Windows 10 version 1607 and Windows Server 2016 up to Windows 11 version 26H2 and Windows Server 2025.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: A remote, unauthenticated attacker who can reach a system over the network could run code on it without any user help, potentially taking full control.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a double free (CWE-415) in the Windows CredSSP protocol, the component Windows uses to securely delegate user credentials during authentication, for example with Remote Desktop and remote management. A double free happens when the same block of memory is released twice, which corrupts memory management and can let an attacker control what code runs next. The CVSS v3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack comes over the network and needs no privileges or user interaction, but high attack complexity means the attacker must meet conditions outside their direct control to succeed. If they do, the impact on confidentiality, integrity, and availability is high.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker would need network access to a system using CredSSP and would send crafted traffic to trigger the double free.

BUSINESS IMPACT: CredSSP sits in the authentication path for remote access, which many organizations depend on to manage servers and support users. A successful attack could hand an outsider control of a server or workstation without a single password or click. That can mean data theft, ransomware deployment, and lateral movement across the network. Because servers and admin systems are often where CredSSP is used most, the blast radius of a compromise could be large.

WORKAROUND: No official mitigation or workaround is listed, so the update is the fix. Until it is installed, limit network access to remote access services that rely on CredSSP, such as Remote Desktop and WinRM, to trusted management networks or VPN only, and make sure they are not exposed to the internet.

URGENCY: This is a Critical, no-click, network-reachable flaw in a core Windows authentication component, and it touches almost every supported Windows client and server. High attack complexity slows attackers down, but it does not stop them. Exposed servers and remote access gateways should be patched first, followed by the rest of the fleet in this cycle. A restart is required, so plan maintenance windows now.

This vulnerability affects Windows Hyper-V, the virtualization layer that runs virtual machines on Windows 11 and Windows Server 2025. Hyper-V uses a resource before it is properly set up, and an attacker who already has high privileges on the system can abuse that to raise their privileges further. Because the scope is changed, the impact can reach past the component where the bug lives. Microsoft rates it Critical.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: A local attacker who already has high privileges could use this flaw to gain even more control, potentially crossing the security boundary that Hyper-V is meant to enforce.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-908, Use of Uninitialized Resource. Hyper-V reads or uses memory or another resource that has not been initialized, so its contents are whatever was left behind. An attacker who can influence that leftover state may be able to steer how Hyper-V behaves. The CVSS vector is AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H: local access, high complexity, high privileges required, no user interaction, and a changed scope with high impact to confidentiality, integrity, and availability. The changed scope is the key point: the attack can affect resources beyond the attacker's starting security context.

EXPLOITABILITY: Affected: Windows 11 versions 24H2, 25H2, 26H1, and 26H2 (x64 and ARM64), and Windows Server 2025 including Server Core. Fixes ship in KB5132061, KB5132043, KB5132059, KB5131080, and KB5131077, depending on the version. Exploitation needs local access, high privileges, and specific conditions, so it is not easy to pull off.

BUSINESS IMPACT: Hyper-V hosts often run many workloads at once, so a break in the virtualization boundary can affect far more than one machine. An attacker who gets deeper control of a host could tamper with or read data from other workloads, disrupt services, or hide their presence. For organizations that rely on Windows Server 2025 for virtualization, this can mean wide outages and data exposure from a single compromised foothold.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, limit who holds administrative rights on Hyper-V hosts and guests, and monitor privileged activity closely.

URGENCY: This flaw is rated Critical and targets the virtualization layer that holds many workloads together. Although it needs high privileges and is complex to exploit, attackers who already have a foothold look for exactly this kind of step-up. Patch Hyper-V hosts in the next maintenance window, and note that a restart is required for most affected versions.

CVE-2026-119961 is a race condition that leads to a use-after-free in Windows Internet Information Services (IIS). An unauthenticated attacker can send a specially crafted packet to an affected service and run code on the target system. No user interaction is needed, but the attacker must win a race condition.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated remote attacker could run code on an IIS server and take control of it.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw combines improper synchronization of a shared resource (CWE-362) with a use-after-free (CWE-416) in IIS. When two operations hit the same resource at the wrong time, IIS can use memory that was already freed. An attacker who wins this race with crafted packets can take over execution. The attack is over the network, with high complexity, no privileges, and no user interaction. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. Systems with IIS installed are exposed. An attacker sends crafted packets to the service over the network and tries to win the race.

BUSINESS IMPACT: IIS often hosts public websites, APIs, and internal portals, many of them facing the internet. A compromised web server can leak customer data, serve malware to visitors, and give attackers a launch point into the internal network. Downtime and data exposure hit both revenue and reputation.

WORKAROUND: No official workarounds are listed. Remove IIS where it is not needed, limit internet exposure of IIS servers, and place them behind a web application firewall or reverse proxy.

URGENCY: This is a Critical, unauthenticated, no-click bug in a web server that is often exposed to the internet. Attackers can try the race again and again with automated tools. Patch internet-facing IIS servers first.

CVE-2026-119958 is an out-of-bounds write in Windows LDAP, the Lightweight Directory Access Protocol. An unauthenticated attacker could send a specially crafted set of LDAP calls and run arbitrary code within the context of the LDAP service. With a CVSS score of 9.8, low attack complexity, and no user interaction, this is one of the most serious bugs in the release.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: An unauthenticated attacker on the network could run code inside the LDAP service. On domain controllers, that could put the entire Active Directory environment at risk.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is an out-of-bounds write (CWE-787) in the Windows LDAP implementation. A specially crafted sequence of LDAP calls can cause the service to write data outside the memory it owns, which an attacker can use to run code in the context of the LDAP service. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means it is reachable over the network, easy to trigger, needs no credentials or user action, and has a full impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An unauthenticated attacker sends crafted LDAP calls to a system running the LDAP service. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: LDAP is the backbone of directory services and identity, and it runs on every domain controller. A compromised domain controller can mean stolen credentials, rogue admin accounts, and domain-wide ransomware. Recovery from a directory compromise is slow and expensive, and it often means rebuilding trust across the whole environment.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, make sure LDAP ports (389, 636, 3268, 3269) are not reachable from the internet or untrusted segments, and watch domain controllers for unusual LDAP traffic or service crashes.

URGENCY: A 9.8 score, no authentication, low complexity, and a target as central as LDAP make this a top-priority patch. Attackers watch for bugs like this because they can lead straight to domain compromise. Patch domain controllers and other LDAP-facing servers first.

CVE-2026-119957 is a double free bug in Windows Remote Desktop Services. An attacker who already has a low-privileged account on an affected server can trigger the flaw locally and, by winning a race condition, raise their privileges. Microsoft rates it Critical because the scope is changed, which means the damage can reach beyond the component that has the bug.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: A logged-in attacker with low privileges, including one working from inside a guest virtual machine, could exploit this flaw to gain the privileges of the affected service on the host.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a double free (CWE-415) in Windows Remote Desktop Services, where the same block of memory can be released twice. Freeing memory twice can corrupt the heap and let an attacker steer what ends up in that memory, which can lead to code running with higher privileges. Microsoft says exploitation requires the attacker to win a race condition, so the attack is not simple or fully reliable. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C) shows a local attack needing low privileges and no user action, with a changed scope and high impact to confidentiality, integrity and availability. Microsoft notes that a successful attacker operating inside a guest virtual machine could gain the privileges of the affected virtualization service on the host.

EXPLOITABILITY: Affected versions are Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker needs local, low-privileged access and must win a race condition to trigger the double free.

BUSINESS IMPACT: Remote Desktop servers and virtualization hosts often sit at the heart of a business, serving many users at once. If a low-privileged user or a compromised guest can break out to host-level privileges, the attacker may reach every session, workload and credential on that machine. That can turn one small compromise into data theft, ransomware staging or a full server takeover.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the update is installed, limit who can sign in to affected servers, keep untrusted workloads off shared hosts, and watch for unusual privilege changes.

URGENCY: Microsoft rates this Critical, and the changed scope means a successful attack can cross a security boundary. The race condition makes exploitation harder, but attackers routinely chain local privilege bugs with initial access to finish the job. Because it affects every supported Windows Server release from 2016 to 2025, patch servers that host Remote Desktop or shared workloads first.

CVE-2026-119952 is a remote code execution flaw in Windows Schannel, the Windows component that handles TLS and SSL for secure connections. It comes from an observable timing discrepancy and lets an unauthenticated attacker run code by sending a crafted packet, with no user action needed. Microsoft rates it Critical and considers exploitation more likely.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated remote attacker could send crafted packets to a service that uses Schannel and run code on the target system, without any user interaction.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known. Attackers are considered more likely to target it.

TECHNICAL SUMMARY: The flaw is an observable timing discrepancy (CWE-208) in Windows Schannel, the security provider that secures TLS and SSL traffic for many Windows services. Timing differences in how Schannel handles certain input can be abused so that a specially crafted packet leads to code execution on the target. Microsoft says no authentication or user interaction is needed, but the attack only works when specific conditions, such as particular protocol settings or configurations, are in place. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) shows a network attack with high complexity and high impact to confidentiality, integrity and availability.

EXPLOITABILITY: Affected versions are Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 (x64, ARM64 and 32-bit where applicable); and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker sends crafted packets to a Schannel-backed service and needs specific protocol settings or configurations to be in place.

BUSINESS IMPACT: Schannel protects web servers, remote access, email and many internal services that rely on TLS. A remote code execution bug in this layer puts internet-facing systems directly in the line of fire. Exploitation could lead to server takeover, theft of sensitive data and certificates, and a serious hit to customer trust.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the update is applied, limit exposure of TLS services to trusted networks where possible and monitor internet-facing servers closely.

URGENCY: This is a Critical, no-click, no-credential bug in a component almost every Windows server exposes. Microsoft considers exploitation more likely, and every supported Windows release is affected. Patch internet-facing servers first. Fixes ship in the November cumulative updates, including KB5131291 (Windows 10 1607 and Server 2016), KB5131085 (Windows 10 1809 and Server 2019), KB5131096 (Windows 10 21H2/22H2), KB5131087 (Windows 11 23H2), KB5132061 and KB5132043 (Windows 11 24H2/25H2/26H2), KB5132059 (Windows 11 26H1), KB5131090 (Server 2022), and KB5131080 and KB5131077 (Server 2025). A restart is required.

This is a use-after-free flaw in Windows Deployment Services (WDS), the Windows Server role used to install operating systems over the network. An attacker with no credentials can send a specially crafted packet to the service and run code on the server. No user interaction is needed. The attack needs specific conditions to be in place, which raises the bar, but Microsoft still rates it Critical.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated attacker on the network could take over a Windows Deployment Services server, gaining control of a system that shapes how new machines are built.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-416, Use After Free. WDS frees memory while handling network traffic and later uses it again, letting a crafted packet corrupt memory and redirect execution. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: network, high complexity, no privileges, no user interaction, with high impact. Microsoft explains that the high complexity means particular protocol settings or configurations must be in place for an attack to succeed, which reduces the chance of widespread, opportunistic attacks.

EXPLOITABILITY: Affected: Windows Server 2016, 2019, 2022, and 2025, including Server Core installations, where the WDS role is in use. Fixes are KB5131291 (2016), KB5131085 (2019), KB5131090 (2022), and KB5131080 or KB5131077 (2025). A restart is required. Exploitation means sending a crafted packet to the WDS service when the needed conditions exist.

BUSINESS IMPACT: Deployment servers are trusted infrastructure. If an attacker controls one, they could tamper with operating system images and push backdoored builds to every machine installed from it. That turns one compromised server into a supply-chain problem inside your own network. Recovery would mean rebuilding trust in every system that was deployed after the compromise.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, restrict network access to WDS servers to the deployment segments that need them, and disable or remove the WDS role where it is not used.

URGENCY: This flaw is Critical, needs no credentials, and needs no user action. The high complexity lowers the odds of mass attacks, but a deployment server is a high-value target worth extra effort for a determined attacker. Patch WDS servers promptly across all supported Windows Server versions and plan for the restart.

CVE-2026-119947 is another use-after-free flaw in Windows Hyper-V. An attacker who controls a guest virtual machine could exploit it to execute code on the host in the context of the virtual machine worker process. It is rated Critical because it breaks the isolation between guests and the host, even though the attacker must win a race condition to succeed.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: A privileged attacker inside a guest VM could escape to the Hyper-V host. That gives them a path to other VMs running on the same machine.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in Hyper-V. Memory is freed and then used again, and an attacker in the guest can try to control that memory to gain code execution on the host in the security context of the virtual machine worker process. The CVSS vector is AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The attacker needs high privileges in the guest, and the attack complexity is high because it depends on winning a race condition. The changed scope means the damage reaches beyond the guest into the host.

EXPLOITABILITY: Affected: 64-bit and ARM64 editions of Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker with high privileges in a guest VM must win a race condition to run code on the host. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: Virtualization hosts concentrate risk, because one host can run many critical servers. A guest escape can expose databases, domain controllers, and file servers that share the host. The result could be data theft, sabotage of multiple systems at once, and costly downtime across many services.

WORKAROUND: Microsoft lists no mitigations or workarounds. Reduce risk by limiting admin access in guest VMs, keeping untrusted workloads on separate hosts, and monitoring hosts for unusual worker process behavior.

URGENCY: This is a Critical isolation break in Hyper-V, and it ships alongside a second Hyper-V guest escape this month. Hypervisors are high-value targets, and one successful attack affects every VM on the host. Patch virtualization hosts early in your rollout.

CVE-2026-124185 is a remote code execution flaw in Microsoft Office Word caused by the use of an uninitialized resource. An attacker could send a malicious Office file and, if the user opens it, run code on their computer. Microsoft rates it Critical.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An unauthenticated attacker who convinces a user to open a malicious Office file could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a use of uninitialized resource (CWE-908) in Microsoft Office Word. When Word processes a specially crafted file, it can use memory or another resource before it has been properly set up, and an attacker can influence what that resource contains to gain code execution. Microsoft says the attacker must send the file and convince the user to open it, and that success depends on factors such as the environment, system configuration and other security measures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U) shows a network attack with high complexity, no privileges needed and user interaction required, with high impact to confidentiality, integrity and availability.

EXPLOITABILITY: Affected versions are Microsoft 365 Apps for Enterprise and Microsoft Office LTSC 2021 and LTSC 2024, in both 32-bit and 64-bit editions. An attacker must deliver a malicious Office file and get the user to open it.

BUSINESS IMPACT: Word documents are part of everyday business, and phishing with booby-trapped attachments remains one of the most common ways attackers get in. One opened file on one workstation can give an attacker a foothold to steal data, harvest credentials and spread to other systems.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the update is applied, be cautious with Office files from unknown senders, keep Protected View enabled, and use email filtering to block suspicious attachments.

URGENCY: Microsoft rates this Critical, and Office is installed on nearly every corporate desktop. Phishing gives attackers an easy delivery path, even if the exploit itself is complex. Make sure Microsoft 365 Apps and Office LTSC installations pick up the latest build through their normal update channel.

CVE-2026-124170 is a remote code execution flaw in Microsoft Office Excel. A heap-based buffer overflow lets an attacker run code on a victim's computer if they can get the user to open a malicious Office file. It affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office Online Server.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An attacker who sends a booby-trapped Excel file could run code on the victim's computer with that user's rights. This could give them access to the user's data and a foothold in the network.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Excel. When Excel processes a specially crafted file, it writes more data into a heap memory buffer than the buffer can hold. The extra data overwrites nearby memory, which an attacker can use to take control of the program and run code. The attacker needs no privileges, but the victim must open the malicious file. Attack complexity is high: success needs a deep understanding of the system and depends on the environment, configuration and other security measures in place. If it works, the impact on confidentiality, integrity and availability is high.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 and 2024 (32-bit and 64-bit editions), and Office Online Server. An attacker must send a user a malicious Office file and convince them to open it, for example through a phishing email or a shared file.

BUSINESS IMPACT: Excel files move constantly between employees, customers and partners, which makes them a natural phishing lure. A single successful attack could expose financial data, customer records and credentials on the user's machine, and give the attacker a starting point for ransomware or deeper network intrusion. Office Online Server is also affected, which widens the exposure to server-side file handling.

WORKAROUND: No official mitigations or workarounds are listed. Until the update is installed, warn users about unexpected Excel attachments, keep Protected View enabled for files from the internet, and use email filtering and attachment sandboxing to catch malicious files.

URGENCY: This flaw is rated Critical and affects Excel, one of the most widely used business applications in the world. Malicious documents are a favorite phishing tool, and a convincing email is often all an attacker needs to get a file opened. Although the attack is complex, the reach of Office makes it an attractive target. Update Microsoft 365 Apps, Office LTSC and Office Online Server quickly.

CVE-2026-120005 is a heap-based buffer overflow in Microsoft PowerPoint that can let an attacker run code on a user's computer. The attacker has to get the user to open a specially crafted presentation file. Once opened, the attacker's code runs with the user's permissions, and no prior access to the system is needed.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can deliver a file to a user, through email, a download, or a shared link, can attempt this attack. If the user opens the file, the attacker can take control of the user's session and data.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in PowerPoint. When PowerPoint processes a crafted presentation, it writes more data into a heap buffer than the buffer can hold. This overwrites nearby memory, which an attacker can use to change program behavior and run their own code. The attack is network-based with low complexity and needs no privileges, but it does require the user to open the file. Success brings high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). The attacker crafts a malicious PowerPoint file and convinces the user to open it.

BUSINESS IMPACT: Presentations move constantly between staff, partners, and customers, so a malicious deck blends right in. If an employee opens one, the attacker gets a foothold to steal sensitive files, harvest credentials, and launch ransomware or wider attacks. Sales, marketing, and leadership teams, who open outside presentations every day, face the highest exposure.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patched, block or quarantine Office files from untrusted sources, keep Protected View turned on, and remind users not to open unexpected presentations.

URGENCY: PowerPoint is installed on most business desktops, and opening a file is about the easiest thing an attacker can ask a user to do. The bug is rated Critical, there is no workaround, and file-based Office attacks are a common first step in breaches. Deploy the update quickly to close this door.

CVE-2026-120789 is a Critical remote code execution vulnerability in Microsoft Office Excel. A heap-based buffer overflow can be triggered when a user opens a specially crafted workbook and interacts with affected features, allowing an attacker to run code as the signed-in user. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office Online Server are affected and should be updated.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated attacker who tricks a user into opening a malicious workbook could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. When Excel processes a specially crafted workbook and the user interacts with the affected workbook features, data can be written past the end of a memory buffer on the heap. An attacker who controls that overflow can corrupt memory and steer Excel into running their own code in the context of the signed-in user. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means the attack is delivered over the network, is low in complexity, needs no privileges, but does need the user to take action. A successful attack gives full impact on confidentiality, integrity, and availability for that user's session.

EXPLOITABILITY: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions), and Office Online Server (fixed by update 5002946) are affected. An attacker has to convince a user to open a specially crafted workbook in Excel and interact with the affected features, typically through a phishing email, a shared link, or a file share.

BUSINESS IMPACT: Excel sits on nearly every business desktop, and spreadsheets are among the most trusted files people open every day. A single opened invoice, report, or budget file could give an attacker a foothold on a workstation, with access to the user's email, documents, and saved credentials. From there, attackers can steal data, install ransomware, or move deeper into the network. Finance, HR, and executive teams, who handle spreadsheets constantly, are prime targets.

WORKAROUND: No official mitigation or workaround is listed, so patching is the real fix. Until then, tell users not to open Excel files from unknown or unexpected senders, keep Protected View on for files from the internet and email, and filter or block risky spreadsheet attachments at the mail gateway.

URGENCY: This is rated Critical with a CVSS score of 8.8, needs no privileges, and targets one of the most widely used business applications in the world. The attack path is simple and familiar: send a file, get it opened. Even though no exploitation has been seen yet, Excel file bugs are a favorite phishing tool, so update Microsoft 365 Apps, Office LTSC, and Office Online Server in this patch cycle.

CVE-2026-120788 is a Critical remote code execution vulnerability in Microsoft Office Excel. It comes from a heap-based buffer overflow that can be triggered when a user opens a specially crafted workbook and interacts with certain workbook features. If that happens, an attacker could run code on the computer with the same rights as the signed-in user. Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office Online Server all need the update.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated attacker who tricks a user into opening a malicious workbook could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. When Excel processes a specially crafted workbook and the user interacts with the affected workbook features, data can be written past the end of a memory buffer on the heap. An attacker who controls that overflow can corrupt memory and steer Excel into running their own code in the context of the signed-in user. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means the attack is delivered over the network, is low in complexity, needs no privileges, but does need the user to take action. A successful attack gives full impact on confidentiality, integrity, and availability for that user's session.

EXPLOITABILITY: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions), and Office Online Server (fixed by update 5002946) are affected. An attacker has to convince a user to open a specially crafted workbook in Excel and interact with the affected features, typically through a phishing email, a shared link, or a file share.

BUSINESS IMPACT: Excel sits on nearly every business desktop, and spreadsheets are among the most trusted files people open every day. A single opened invoice, report, or budget file could give an attacker a foothold on a workstation, with access to the user's email, documents, and saved credentials. From there, attackers can steal data, install ransomware, or move deeper into the network. Finance, HR, and executive teams, who handle spreadsheets constantly, are prime targets.

WORKAROUND: No official mitigation or workaround is listed, so patching is the real fix. Until then, tell users not to open Excel files from unknown or unexpected senders, keep Protected View on for files from the internet and email, and filter or block risky spreadsheet attachments at the mail gateway.

URGENCY: This is rated Critical with a CVSS score of 8.8, needs no privileges, and targets one of the most widely used business applications in the world. The attack path is simple and familiar: send a file, get it opened. Even though no exploitation has been seen yet, Excel file bugs are a favorite phishing tool, so update Microsoft 365 Apps, Office LTSC, and Office Online Server in this patch cycle.

CVE-2026-120786 is a Critical remote code execution vulnerability in Microsoft Office Excel caused by a heap-based buffer overflow. An attacker who gets a user to open a specially crafted workbook and work with certain workbook features could run code with that user's permissions. The bug affects Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, and Office Online Server.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated attacker who tricks a user into opening a malicious workbook could run code on that user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. When Excel processes a specially crafted workbook and the user interacts with the affected workbook features, data can be written past the end of a memory buffer on the heap. An attacker who controls that overflow can corrupt memory and steer Excel into running their own code in the context of the signed-in user. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which means the attack is delivered over the network, is low in complexity, needs no privileges, but does need the user to take action. A successful attack gives full impact on confidentiality, integrity, and availability for that user's session.

EXPLOITABILITY: Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit editions), and Office Online Server (fixed by update 5002946) are affected. An attacker has to convince a user to open a specially crafted workbook in Excel and interact with the affected features, typically through a phishing email, a shared link, or a file share.

BUSINESS IMPACT: Excel sits on nearly every business desktop, and spreadsheets are among the most trusted files people open every day. A single opened invoice, report, or budget file could give an attacker a foothold on a workstation, with access to the user's email, documents, and saved credentials. From there, attackers can steal data, install ransomware, or move deeper into the network. Finance, HR, and executive teams, who handle spreadsheets constantly, are prime targets.

WORKAROUND: No official mitigation or workaround is listed, so patching is the real fix. Until then, tell users not to open Excel files from unknown or unexpected senders, keep Protected View on for files from the internet and email, and filter or block risky spreadsheet attachments at the mail gateway.

URGENCY: This is rated Critical with a CVSS score of 8.8, needs no privileges, and targets one of the most widely used business applications in the world. The attack path is simple and familiar: send a file, get it opened. Even though no exploitation has been seen yet, Excel file bugs are a favorite phishing tool, so update Microsoft 365 Apps, Office LTSC, and Office Online Server in this patch cycle.

CVE-2026-122194 is a remote code execution flaw in Microsoft Defender, caused by a NULL pointer dereference in the Microsoft Malware Protection Engine. An unauthenticated attacker could use it to run code over a network, but a user must take some action for the attack to work. Microsoft rates it Critical.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An unauthenticated remote attacker who gets a user to interact with malicious content could run code on the target machine, potentially with the high privileges the Defender engine uses.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The bug is a NULL pointer dereference (CWE-476) in the Microsoft Malware Protection Engine, the scanning core behind Microsoft Defender. When the engine processes certain input, it can use a pointer that does not point to valid memory. Microsoft says this can be used to execute code over a network. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) shows a network attack with low complexity and no privileges needed, but it does need user interaction. Confidentiality, integrity and availability impacts are all high. Microsoft has not published further technical details.

EXPLOITABILITY: The affected product is the Microsoft Malware Protection Engine. An attacker would need a user to interact with attacker-supplied content so the engine processes it.

BUSINESS IMPACT: Defender runs on a huge number of Windows endpoints and servers, and it is trusted to inspect untrusted content. A flaw in the scanning engine turns that trust upside down: content meant to be blocked could become the way in. A successful attack could lead to malware installation, data theft and a weakened security posture across the fleet.

WORKAROUND: Microsoft lists no mitigations or workarounds. The fix is delivered through the normal engine update channel, so confirm that Defender engine updates are not blocked or delayed and that devices report the latest engine version.

URGENCY: Microsoft rates this Critical, it needs no privileges, and the vulnerable component is present on nearly every Windows system. Engine updates usually install automatically and need no restart, so the main task is to verify that every device, including offline and isolated ones, has received the updated engine.

CVE-2026-116928 is an out-of-bounds write in Microsoft Exchange Server. An unauthenticated attacker could send an email with a specially crafted attachment to an affected Exchange server. The bug triggers when the server automatically processes the attachment for indexing, so the recipient never needs to open the email or the file. Successful exploitation could allow code execution with the permissions of the processing service, and the flaw carries a CVSS score of 9.8.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: Anyone who can send email to your organization could run code on the Exchange server without credentials or user interaction. That puts mailboxes, credentials, and internal network access at risk.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is an out-of-bounds write (CWE-787) in how Exchange Server processes attachments for indexing. A crafted attachment causes the processing service to write outside its intended memory, which can lead to code execution with that service's permissions. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack comes over the network, is easy to trigger, needs no privileges, and needs no user action because indexing happens automatically when mail arrives.

EXPLOITABILITY: Microsoft's update data for this CVE lists these products and fixes: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025). Exchange servers are exposed when they receive and index an email carrying a crafted attachment; no one needs to open it.

BUSINESS IMPACT: Exchange servers hold sensitive email, calendars, and contacts, and they are usually reachable from the internet by design. A compromise can lead to email theft, business email compromise, credential harvesting, and a jump into the internal network. The zero-click delivery through ordinary email makes this a fast and quiet way in.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, consider stricter attachment filtering at the email gateway, and watch Exchange servers for unusual activity from indexing or content processing services.

URGENCY: A 9.8 score, no authentication, and zero-click delivery by email make this one of the most urgent fixes this month. Exchange servers are constant targets, and attackers move quickly on mail server bugs. Patch Exchange servers as soon as possible.

CVE-2026-125137 is a heap-based buffer overflow in the Windows Graphics Kernel. An attacker who already has a low-privilege foothold can abuse it to raise their privileges locally. What makes this one stand out is where those privileges land: Microsoft says a successful attacker could gain elevated rights on the host system, beyond the guest virtual machine boundary. That is why Microsoft rates it Critical, even though the base score sits at 7.8.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: A logged-in attacker with low privileges inside a virtual machine could break out of that guest and gain high-level rights on the underlying host. From there, every workload on that host is in reach.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in the Windows Graphics Kernel. Code in the graphics stack writes more data into a heap buffer than the buffer can hold, corrupting nearby memory. An attacker who can trigger this overflow can steer that corruption to run code with higher privileges. The CVSS vector shows a changed scope (S:C), which means the impact reaches past the vulnerable component: in this case from a guest virtual machine to the host. Confidentiality, integrity, and availability are all rated High. Attack complexity is High because exploitation only works when the target virtual machine has multiple assigned graphics adapters with different configurations, a setup the attacker cannot control.

EXPLOITABILITY: Affected systems include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2019, 2022, and 2025, including Server Core installations. The attacker needs local access with low privileges and no user interaction. Exploitation also depends on a virtual machine having multiple graphics adapters with differing configurations.

BUSINESS IMPACT: Virtualization exists to keep workloads apart. A guest-to-host escape breaks that promise. In shared or multi-tenant environments, one compromised virtual machine could become a launch point to the host and every other guest on it. That can mean stolen data across business units or customers, tampered systems, outages, and the cost and reputation damage that follow a breach of core infrastructure.

WORKAROUND: Microsoft lists no workaround or mitigation. Until the update is applied, review virtual machines that have multiple graphics adapters assigned, remove extra or mismatched adapters where they are not needed, and limit who can log on to those guests.

URGENCY: Microsoft rates this Critical because it can break the boundary between a guest and its host. It needs only a low-privilege account and no user interaction, and the affected Windows versions cover nearly every modern desktop and server. Hosts running virtual machines with GPU assignments should be patched first, followed by the rest of the fleet.

This vulnerability affects Microsoft Exchange Server Subscription Edition. An attacker with a low-level authenticated account can send a specially crafted request to run code on the Exchange server. No user interaction is required. Microsoft rates it Critical and expects attackers are likely to go after it, which puts it high on the list for attackers who target email systems.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any attacker with a basic Exchange account, including one taken over through phishing, could run code on the mail server and gain control of a system that holds the organization's email.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known. Attacks are expected to be likely, so they could follow soon.

TECHNICAL SUMMARY: The weakness is listed as CWE-706, Use of Incorrectly-Resolved Name or Reference, and Microsoft's summary describes it as improper input validation. Exchange does not properly validate part of an incoming request and ends up resolving a name or reference to the wrong target, which an attacker can use to execute code on the server. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H: network, low complexity, low privileges, no user interaction, with high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected: Microsoft Exchange Server Subscription Edition RTM. The fix is KB5133453, and a restart is required. An attacker with any low-privileged authenticated access sends a crafted request to the server.

BUSINESS IMPACT: Exchange servers hold years of sensitive email and connect deeply into Active Directory. Attackers have repeatedly gone after Exchange because a single compromised server can expose confidential communications, enable business email fraud, and serve as a launch point for ransomware. A low bar for access means a single phished account could be enough.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, limit external access to Exchange, enforce multifactor authentication to protect accounts, and monitor Exchange logs for unusual requests and new processes.

URGENCY: This flaw is Critical, has a low-complexity network attack path, needs only a basic account, and is expected to be a likely attack target. Exchange is a long-standing favorite target. Install KB5133453 on every Exchange Server Subscription Edition server as soon as possible and plan the restart.

CVE-2026-125136 is a heap-based buffer overflow in the Windows Network Connected Devices Auto-Setup Service, the feature that finds and sets up devices like printers on the local network. An attacker on the same network can advertise a specially crafted fake device, and if network device discovery is turned on, the affected system may run the attacker's code. No login and no user action are needed, which is why Microsoft rates it Critical.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Anyone who can reach the same local network segment, such as a rogue insider, a guest on office Wi-Fi, or an attacker on a hotel or coffee shop network, could take over a Windows device. They would gain the ability to run code on that device without any credentials.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in the Network Connected Devices Auto-Setup Service. When Windows discovers a device on the network, the service processes information the device advertises about itself. A specially crafted device announcement can cause the service to write past the end of a heap buffer, corrupting memory and letting the attacker run code. The CVSS vector shows an adjacent network attack (AV:A), low complexity, no privileges, and no user interaction, with High impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2. An unauthenticated attacker on the same local network advertises a malicious device to a system with network device discovery enabled. No user interaction is required.

BUSINESS IMPACT: Laptops move between offices, homes, airports, and hotels, and many of those networks are shared with strangers. A flaw that turns a fake printer announcement into code execution gives attackers a quiet way in. Once inside, they could steal data, plant ransomware, or move deeper into the corporate network the next time the device connects. The result can be data loss, downtime, and costly incident response.

WORKAROUND: Microsoft lists no workaround or mitigation. If the update cannot be applied right away, consider turning off network discovery on untrusted networks or disabling the Network Connected Devices Auto-Setup service where it is not needed, and keep devices off shared or public networks where possible.

URGENCY: Microsoft rates this Critical. The attack needs no credentials and no user action, only a spot on the same network, and the service runs across a wide range of Windows 10 and Windows 11 releases. Mobile users and devices on shared networks face the highest risk, so they should be patched first.

CVE-2026-119990 is a Critical elevation of privilege vulnerability in Azure OpenAI. A critical function was missing authentication, which could let an unauthenticated attacker elevate privileges over the network. The attack needs no credentials and no user interaction, which is why it carries a CVSS score of 9.8. Microsoft lists customer action as required for this issue.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: A remote attacker with no credentials could reach an unprotected critical function in Azure OpenAI and gain elevated privileges, opening the door to data and resources tied to the service.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The flaw is missing authentication for a critical function (CWE-306) in Azure OpenAI. A function that should have checked who was calling it did not, so an attacker could use it without proving their identity and end up with privileges they should never have. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-based, low complexity, no privileges, and no user interaction. Successful exploitation has high impact on confidentiality, integrity, and availability. Microsoft does not give further technical detail on the affected function.

EXPLOITABILITY: The affected product is Azure OpenAI, and the fix is described in Microsoft's release notes. An attacker would send requests over the network to the unprotected function, with no credentials or user action needed. The specific affected versions or deployments are not listed in the data.

BUSINESS IMPACT: Organizations increasingly connect Azure OpenAI to internal data, applications, and workflows. Elevated access to that service could expose prompts, model outputs, connected data, and business logic, or let attackers misuse the service and run up costs. A breach here could leak sensitive information, damage trust in AI-driven processes, and create compliance problems.

WORKAROUND: No official mitigation or workaround is listed. Follow the actions in Microsoft's release notes for Azure OpenAI, and in the meantime restrict network access to Azure OpenAI resources with private endpoints or firewall rules, review access keys and role assignments, and watch activity logs for unusual requests.

URGENCY: A 9.8 CVSS score, Critical severity, and an attack that needs no credentials and no user interaction put this at the top of the list. Even though no exploitation is known, missing-authentication bugs are easy to find and abuse once details leak. Because Microsoft marks customer action as required, cloud and AI teams should confirm their Azure OpenAI resources are covered right away rather than assume the fix is automatic.

CVE-2026-111309 is a release of invalid pointer or reference flaw in Microsoft Office Outlook that lets an attacker run code on the victim's machine. The attack works when a user opens or previews a specially crafted email. In a typical scenario, the attacker sends the email and convinces the user to read it.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can send email to a user can try this attack. If the user opens or previews the message, the attacker can run code on the user's computer with the user's rights.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The bug is a release of invalid pointer or reference (CWE-763) in Outlook. While handling a crafted email, Outlook tries to free memory using a pointer that is not valid, which corrupts memory management. An attacker can use this to take control of program flow and run their own code. The Preview Pane is an attack vector, so simply viewing the message can trigger it. The attack is network-based with low complexity and no privileges needed, and it brings high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). The attacker sends a crafted email and gets the user to open or preview it in Outlook.

BUSINESS IMPACT: Outlook sits at the center of daily work, and this bug turns routine email reading into a way in. A compromised mailbox can lead to data theft, business email compromise, fraudulent payments, and ransomware. Because a preview is enough, even careful users can be caught.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patched, consider turning off the Reading Pane, reading mail in plain text, tightening email filtering, and removing local admin rights from users.

URGENCY: This is a Critical Outlook bug that can be triggered just by previewing an email, and there is no workaround. With Outlook used so widely, the attack surface is huge. Make this Office update a priority.

CVE-2026-111285 is a heap-based buffer overflow in Microsoft Office Word that can let an attacker run code on a user's computer. The attacker needs the user to open a specially crafted file, and the Preview Pane is also an attack vector. Successful attacks run code with the permissions of the logged-in user.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can deliver a crafted document to a user can try this attack. Opening or previewing the file could let the attacker run code and take over the user's session.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Word. A crafted document causes Word to write data beyond the bounds of a heap buffer, corrupting memory that an attacker can use to run their own code. The Preview Pane is an attack vector, which lowers the amount of user action needed. The attack is network-based with low complexity and no privileges needed, and it brings high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). The attacker sends a crafted Word file and gets the user to open or preview it.

BUSINESS IMPACT: When previewing a file is enough, the usual advice of "don't open strange attachments" is not enough protection. An attacker could steal files and credentials, use the hijacked account to spread further, or set up ransomware. Any team that handles outside documents is exposed.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patched, consider turning off the Preview Pane in Outlook and File Explorer, keep Protected View on, and filter Office attachments from untrusted senders.

URGENCY: This is a Critical bug in one of the most common business apps, and the Preview Pane path means very little user action is needed. There is no workaround. Push the Office update quickly to shut this attack path down.

CVE-2026-110068 is a use-after-free flaw in Microsoft Office Outlook that lets an attacker run code on a victim's computer. The attacker only needs to send a specially crafted email and get the user to open it in Outlook. No account on the target system is needed, and the code runs with the same rights as the user who opened the message.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can send an email to a user can try this attack. If the user opens the message, the attacker can run code with that user's permissions and take over their session, data, and mailbox.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The bug is a use-after-free (CWE-416) in Outlook. Outlook frees a piece of memory while handling a crafted email but keeps using a reference to it later. An attacker who shapes the email carefully can control what ends up in that freed memory and steer the program into running attacker-supplied code. The attack works over the network, needs low complexity and no privileges, but does require the user to open the message. A successful attack gives full impact on confidentiality, integrity, and availability within the user's context.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). Microsoft provides the fix through the Office release channels. An attacker sends a crafted email and convinces the user to open it in Outlook.

BUSINESS IMPACT: Email is the front door of every business, and this flaw turns a normal inbox action into a way in. A single opened message could give an attacker access to the user's files, mail, and saved credentials. From there, they can steal data, send convincing phishing mail from a trusted account, plant ransomware, or move deeper into the network. Executives, finance, and help desk staff, who open many outside emails, are especially attractive targets.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the update is applied, train users to be careful with unexpected emails, use email filtering to block suspicious messages, and run users without local admin rights to limit the damage.

URGENCY: This is a Critical remote code execution bug in one of the most widely used business apps in the world. The attack path is simple: send an email and wait for someone to open it. No exploitation is known yet, but email-based Office bugs are a favorite of attackers, and there is no workaround. Update Office as soon as possible.

CVE-2026-111289 is a remote code execution flaw in Microsoft Office caused by a use-after-free memory bug. An attacker who gets a user to open, or even preview, a specially crafted Office file could run code on that computer with the user's rights. Because the Preview Pane is an attack vector, the user may not even need to fully open the file.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can get a crafted Office file in front of a user could run code with that user's permissions and use it as a launch point for deeper attacks.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in Microsoft Office. Office frees a block of memory while processing a document, but later code still tries to use it. A crafted file can control what ends up in that freed memory, which lets an attacker hijack the program's flow and run their own code. The attack needs no login and no special privileges. It does need user interaction, but that can be as small as viewing the file in the Preview Pane. Successful exploitation gives the attacker high impact on confidentiality, integrity, and availability within the user's context.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). An attacker sends or shares a crafted Office file and gets the user to open or preview it.

BUSINESS IMPACT: Office documents are the most common files in any business, and people open them without a second thought. A preview-pane attack makes this even riskier, since a user scrolling through email could trigger it. A successful attack can lead to stolen data, stolen credentials, ransomware, and lateral movement across the network, along with downtime, recovery costs, and reputational harm.

WORKAROUND: There are no official mitigations or workarounds for this vulnerability, so patching is the real fix. Until the update is in place, consider turning off the Preview Pane in Outlook and File Explorer, filter or quarantine Office attachments from unknown senders, keep Protected View on, and use attack surface reduction rules to stop Office from launching child processes.

URGENCY: Microsoft rates this flaw Critical with a CVSS score of 8.8. The Preview Pane attack path means very little user action is needed, no credentials are required, and Office is installed on nearly every business endpoint. That mix makes it a prime target for phishing campaigns once attackers study the patch. Roll out the Office update to all affected editions right away.

This is a use-after-free flaw in Microsoft Word. An attacker can send a specially crafted Word document that, when handled a certain way, runs the attacker's code with the user's permissions. Microsoft notes that the Preview Pane is an attack vector, which means the risk is not limited to fully opening the file. The attacker does not need an account on the target system. Microsoft rates it Critical.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: A remote attacker could send a booby-trapped Word document and run code on the victim's computer with the victim's rights, giving them a foothold inside the organization.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-416, Use After Free. Word frees a block of memory and later uses it again, so an attacker who controls what fills that memory can hijack program flow. Microsoft describes a path where the user opens the crafted document, saves it as Rich Text Format, and dismisses the conversion and document-protection prompts. Microsoft also states that the Preview Pane is an attack vector. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network, low complexity, no privileges, user interaction required, with high impact. Code runs with the permissions of the logged-in user.

EXPLOITABILITY: Affected: Microsoft 365 Apps for Enterprise (32-bit and 64-bit) and Microsoft Office LTSC 2021 and LTSC 2024 (32-bit and 64-bit). Fixes are delivered through the Office release channels. An attacker delivers the crafted document by email, file share, or download and relies on the user to handle it, or on the Preview Pane to render it.

BUSINESS IMPACT: Word documents are everywhere, and email attachments are still a favorite way in for attackers. A single user handling the wrong file could give an attacker code execution on a workstation, which is often the first step toward stealing data, deploying ransomware, or spreading across the network. If the user has admin rights, the damage grows quickly.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, consider turning off the Preview Pane for Office files, block or quarantine Word attachments from untrusted senders, keep users on least-privilege accounts, and remind staff not to open or convert unexpected documents.

URGENCY: This flaw is Critical, reachable over the network, needs no attacker account, and can be triggered through the Preview Pane. Office is installed on nearly every business desktop, so the exposed population is huge. Push the Office update across all channels now and confirm devices have picked it up.

CVE-2026-110047 is a use-after-free flaw in Microsoft Office Word that lets an attacker run code on a user's computer. The user has to open a specially crafted Word file from the attacker. The Preview Pane is not an attack vector for this bug, but once the file is opened, the attacker's code runs with the user's permissions.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can get a document in front of a user can attempt this attack. If the user opens it, the attacker gains code execution with the user's rights.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The bug is a use-after-free (CWE-416) in Word. While processing a crafted document, Word frees an object in memory but later uses it again. An attacker can arrange for controlled data to sit in that freed memory and redirect the program to run their code. The attack is network-based with low complexity and no privileges needed, but it requires the user to open the file. The Preview Pane is not an attack vector. Success gives high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). The attacker sends or shares a crafted Word file and convinces the user to open it.

BUSINESS IMPACT: Word files are shared everywhere, from invoices to resumes to contracts, so a malicious one is easy to disguise. A single opened document can give an attacker access to company data and credentials, and a base for ransomware or further attacks. HR, finance, and legal teams, who open outside documents often, are prime targets.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patched, keep Protected View on, block Office files from untrusted sources, and remind users not to open unexpected attachments.

URGENCY: Word is on nearly every business computer, and malicious documents are one of the oldest and most reliable attack methods. The bug is Critical with no workaround. Even though the Preview Pane is not an attack vector, the patch should go out quickly.

CVE-2026-110043 is a heap-based buffer overflow in Microsoft Office Outlook that lets an attacker run code on a user's computer. The attacker sends a specially crafted email, and the attack can trigger when the user selects the message to show it in the Preview Pane. The code runs with the user's permissions, and the attacker needs no account on the target system.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: Any remote attacker who can send email to a user can try this attack. If the user simply views the message in the Preview Pane, the attacker can run code and take over the user's session.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Outlook. When Outlook renders a crafted email, it writes more data into a heap buffer than it can hold, corrupting nearby memory. An attacker can use this corruption to run their own code. The Preview Pane is an attack vector, so the user only has to select the message for it to be displayed. The attack is network-based with low complexity and no privileges needed, and it brings high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). An attacker sends a crafted email and gets the user to select it so it shows in the Preview Pane.

BUSINESS IMPACT: Clicking through the inbox is something every employee does all day, and this bug turns that habit into a risk. A successful attack could expose email, files, and credentials, and give attackers a trusted account for sending more phishing. It can also be the first step toward ransomware or a wider breach.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patched, consider turning off the Reading Pane, reading email in plain text, filtering suspicious mail at the gateway, and limiting local admin rights.

URGENCY: Preview Pane attacks need almost no help from the user, which makes them very appealing to attackers. Outlook is used across nearly every business, the bug is Critical, and there is no official workaround. Roll out the Office update quickly.

This is a server-side request forgery (SSRF) flaw in Azure Managed Grafana, Microsoft's hosted version of the popular Grafana monitoring and dashboard service. An attacker with no account can trick the service into sending a request to a system the attacker controls. That request leaks a service access token, and with that token the attacker can act with whatever permissions the token carries. Microsoft rates it Critical and lists Customer Action Required as Yes.

CVSS Score: The CVSS v3.1 score does not exist for this vulnerability. Microsoft has not published a CVSS v3.1 Base Score or vector for it.

SEVERITY: Critical

THREAT: An unauthenticated remote attacker could steal a service access token from Azure Managed Grafana. With it, they could act with the token's permissions and reach cloud resources the service is trusted to touch.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-918, Server-Side Request Forgery. The service can be made to send outbound requests to an address chosen by the attacker instead of only to trusted destinations. When it does, it includes a service access token in that request, so the attacker's server simply receives the token. The attack works over the network, needs no authentication, and needs no user interaction. The impact is elevation of privilege: the attacker gains the rights tied to the stolen token, which in a cloud setting can extend well beyond the Grafana instance itself.

EXPLOITABILITY: Affected product: Azure Managed Grafana. The fix is described in the service release notes, and Microsoft marks no restart as required. An attacker exploits it by sending crafted input that makes the service call out to an attacker-controlled host, then capturing the token that comes with the request.

BUSINESS IMPACT: Grafana dashboards often sit next to the most sensitive parts of a cloud environment because they pull data from many sources. A stolen service token can turn a monitoring tool into a quiet entry point. Attackers could read operational data, query connected data sources, or move further into the Azure tenant using the token's rights. The result can be data exposure, tampering with monitoring, and a costly incident investigation.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the fix is confirmed in your instances, limit network exposure of the Grafana endpoint, review the permissions given to the service identity, and watch for unusual outbound requests and token use.

URGENCY: This flaw is rated Critical, needs no login, and needs no user action, which is the easiest attack path there is. Because Customer Action Required is Yes, teams should not assume the cloud provider handled it for them. Confirm your Azure Managed Grafana instances are on the fixed release and review the service identity's permissions now.

CVE-2026-118737 is a remote code execution flaw in the Windows Remote Procedure Call (RPC) Runtime. It comes from improper verification of a cryptographic signature and lets an unauthenticated attacker run code over the network without any user action. Microsoft rates it Critical and it affects every supported version of Windows client and server.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated attacker with network access could send crafted requests to an affected server and run code on it, without needing any user to do anything.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is an improper verification of a cryptographic signature (CWE-347) in the Windows RPC Runtime, the component many Windows services use to talk to each other across a network. Microsoft describes a timing-dependent authentication weakness involving a pending DNS query: an attacker who wins the race can send specially crafted requests that the server accepts when it should not. Success lets the attacker run code on the server. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) shows a network attack with no privileges or user action needed, but high complexity because of the race condition. Confidentiality, integrity and availability impacts are all high.

EXPLOITABILITY: Affected versions are Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 (x64, ARM64 and 32-bit where applicable); and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An unauthenticated attacker on the network must win a race tied to a pending DNS query to get crafted RPC requests accepted.

BUSINESS IMPACT: RPC is woven into core Windows services, including those on domain controllers, file servers and application servers. A no-click, no-credential path to code execution on these systems is exactly what attackers want for spreading through a network. One compromised server could lead to stolen data, ransomware deployment and long business outages.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until patching is complete, block RPC traffic at the network edge, limit RPC access between network segments to the systems that need it, and monitor for unusual RPC activity.

URGENCY: This is a Critical, network-reachable remote code execution bug that needs no credentials and no user action. The race condition raises the bar, but it does not stop a determined attacker who can retry. With every supported Windows release affected, patch internet-facing and high-value servers such as domain controllers first. Fixes ship in the November cumulative updates, including KB5131291 (Windows 10 1607 and Server 2016), KB5131085 (Windows 10 1809 and Server 2019), KB5131096 (Windows 10 21H2/22H2), KB5131087 (Windows 11 23H2), KB5132061 and KB5132043 (Windows 11 24H2/25H2/26H2), KB5132059 (Windows 11 26H1), KB5131090 (Server 2022), and KB5131080 and KB5131077 (Server 2025). A restart is required.

CVE-2026-118146 is an incorrect authorization flaw in Active Directory Domain Services that leads to remote code execution. An authenticated attacker with low-level access can send a specially crafted request to an affected server and run code on it. No user interaction is needed, and exploitation is considered more likely.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: An authenticated attacker with low privileges could run code on an affected server and take control of it, putting the whole domain at risk.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is incorrect authorization (CWE-863) in Active Directory Domain Services. The service does not properly check whether a request is allowed, so a low-privileged user can send a crafted request that results in code running on the server. The attack is over the network, with low complexity, low privileges, and no user interaction. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker with a valid low-privileged account sends a specially crafted request to an affected server over the network.

BUSINESS IMPACT: Code execution on a directory server is one of the worst outcomes a business can face. Attackers can create accounts, reset passwords, push malware through Group Policy, and hold the entire network hostage. A single stolen user password could be enough to start the attack.

WORKAROUND: No official workarounds are listed. Restrict network access to domain controllers, enforce MFA and strong passwords to protect low-privileged accounts, and watch for unusual directory requests.

URGENCY: This is a Critical, low-complexity network bug in Active Directory, and exploitation is considered more likely. Stolen user credentials are cheap and common, so the bar to attack is low. Treat domain controllers as top priority for this update.

CVE-2026-118145 is a use-after-free flaw in the Windows Function Discovery SSDP Provider, the component that discovers devices on the local network. An unauthenticated attacker on an adjacent network could exploit it to execute code. The attack is hard to pull off because it needs a memory allocation to fail while the service processes device information, but no credentials or user interaction are required.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An attacker on the same local network segment could run code on a Windows machine without logging in. This could help them spread from one compromised device to others nearby.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The bug is a use-after-free (CWE-416) in the Function Discovery SSDP Provider, which handles Simple Service Discovery Protocol traffic used to find devices. When the service processes device information, an allocation failure can leave it using memory that was already freed, which an attacker can exploit to run code. The CVSS vector is AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The attacker must be on an adjacent network, needs no privileges or user action, and faces high complexity because the allocation failure makes the attack harder to trigger reliably.

EXPLOITABILITY: Affected: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. The attacker must be on the same network segment and send device information that the SSDP provider processes. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: Device discovery runs on many Windows systems by default, especially on laptops and desktops. An attacker who already has a foothold on one network device, or who joins a guest or Wi-Fi network, could use this flaw to move to other machines. That could speed up ransomware spread and data theft inside offices, branches, and shared networks.

WORKAROUND: Microsoft lists no mitigations or workarounds. If you cannot patch, consider disabling the SSDP Discovery and Function Discovery services where they are not needed, block SSDP traffic (UDP 1900) between segments, and keep untrusted devices on separate networks.

URGENCY: This is a Critical, unauthenticated code execution bug in a discovery service that is common on Windows endpoints. The need for adjacent network access and a failed allocation lowers the odds of attack, but it is a useful tool for lateral movement. Roll it out with your regular cumulative updates and do not delay, especially on laptops that join shared networks.

CVE-2026-116710 is a heap-based buffer overflow in Windows Message Queuing (MSMQ). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and run code on the target system. No login and no user interaction are needed. The attack is rated high complexity, but the reward is remote code execution on servers and workstations that have Message Queuing enabled.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: Any attacker who can reach the Message Queuing service over the network could run code on the target without credentials. That could give them a foothold for wider attacks.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The bug is a heap-based buffer overflow (CWE-122) in Windows Message Queuing. A specially crafted packet sent to the service can write past the end of a heap buffer, which can let an attacker take control of execution. The CVSS vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network based and needs no privileges or user action. The complexity is high because success requires a deep understanding of the system and depends on the environment, configuration, and other security measures in place.

EXPLOITABILITY: Affected: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. Systems are exposed when Message Queuing is running and reachable; an attacker sends a crafted packet to the service. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: Message Queuing often supports internal business applications, so it can sit on servers that handle orders, payments, or integration traffic. A successful attack could give an outsider code execution on those servers, leading to data theft, ransomware, or a pivot deeper into the network. Because no credentials are needed, the attack can start from anywhere on the network that can reach the service.

WORKAROUND: Microsoft lists no mitigations or workarounds. If you cannot patch, check whether the Message Queuing service is installed and disable it where it is not needed. Block inbound MSMQ traffic (TCP port 1801) at the firewall from untrusted networks.

URGENCY: This is a Critical, unauthenticated, network-reachable code execution bug. Message Queuing has a history of serious flaws, and exposed MSMQ services are easy to find. Patch systems with Message Queuing enabled first, and confirm the service is off where you do not need it.

CVE-2026-109459 is a heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager. An unauthenticated attacker can send a specially crafted packet to the service and run code on the target system without any user interaction. Attack complexity is high because the attacker must use complex memory shaping and needs specific conditions in place.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated remote attacker who can reach the MSMQ service could run code on the system and take full control of it.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in the MSMQ Queue Manager. A crafted network packet causes the service to write beyond a heap buffer, corrupting memory. With careful memory shaping, the attacker can turn this into code execution on the target. No authentication or user interaction is needed, but exploitation is harder because specific protocol settings or configurations must be in place. The impact on confidentiality, integrity, and availability is high.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. Only systems running the Message Queuing service are exposed. An attacker sends a crafted packet to the service over the network.

BUSINESS IMPACT: MSMQ often sits behind line-of-business apps, payment flows, and back-office integrations. A compromised queue server can give attackers a quiet path into critical business processes and the data moving through them. Because no login or user action is needed, a single exposed server could become an entry point for ransomware or data theft.

WORKAROUND: No official workarounds are listed. Check whether the Message Queuing service is enabled and disable it where it is not needed. Block MSMQ ports (such as TCP 1801) at the network edge and limit access to trusted hosts.

URGENCY: This is a Critical, unauthenticated, no-click network bug. Even with high attack complexity, servers running MSMQ are prime targets because a successful attack needs no help from users. Find your MSMQ systems and patch them first.

CVE-2026-125134 is a use-after-free bug in the Windows Function Discovery Resource Publication service, the component that lets a Windows computer announce itself and its resources to other devices on the local network. An attacker on the same network segment, with no login and no help from a user, can send crafted SOAP requests to the service. If the system is short on memory and the attacker wins a timing race, the result is code running as SYSTEM. It is not easy to pull off, but when it works, the attacker gets full control of the machine.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An unauthenticated attacker on the same local network segment could take over a Windows system and run code with SYSTEM privileges. That gives them full control to steal data, install malware, or move on to other machines.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in the Function Discovery Resource Publication service. When the service handles SOAP requests and a memory allocation fails under low-memory conditions, an asynchronous request-cleanup routine can free memory that is still in use. An attacker who sends specially crafted requests at the right moment can make the service reuse that freed memory, which can be shaped to hijack execution. Because the service runs with high privileges, successful exploitation leads to code execution as SYSTEM, with high impact on confidentiality, integrity, and availability. The attack needs no privileges and no user interaction, but the attack complexity is high because the target must be under sustained memory pressure and the attacker must win a timing condition.

EXPLOITABILITY: Affected systems include Windows 10 (versions 1607, 1809, 21H2, and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1, and 26H2), and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. The attacker must be on an adjacent network, such as the same subnet or LAN segment. They send crafted SOAP requests to the service while the target is low on memory, either waiting for that state or trying to cause it.

BUSINESS IMPACT: Function Discovery is part of nearly every modern Windows desktop and server, so the attack surface is huge. An attacker who already has a foothold on an office network, guest Wi-Fi that is not properly separated, or a shared network segment could use this bug to grab SYSTEM control of nearby machines without a password. From there, they could steal sensitive data, deploy ransomware, harvest credentials, and spread across the network. A single compromised server could cause outages, data breaches, regulatory trouble, and costly recovery work.

WORKAROUND: There is no official workaround. If the update cannot be applied right away, limit exposure by keeping untrusted devices off internal network segments, separating guest and IoT networks, and blocking network discovery traffic between segments with host or network firewalls. Where network discovery is not needed, consider disabling the Function Discovery Resource Publication service. Watching for unusual memory pressure and service crashes may also help spot attempts.

URGENCY: Microsoft rates this bug Critical, and it gives an attacker SYSTEM-level control with no credentials and no user action. The tricky timing makes it harder to exploit, but attackers who are already inside a network are patient and well equipped. Because the affected service ships on almost every supported Windows desktop and server, the number of exposed machines is very large. Deploying this month's updates quickly closes a path that could turn one compromised device into a network-wide incident.

CVE-2026-113865 is an elevation of privilege flaw in Windows Hyper-V. A time-of-check time-of-use (TOCTOU) race condition lets an attacker inside a guest virtual machine run code on the host in the context of the virtual machine worker process. The attacker needs low privileges in the guest and must win the race.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: An attacker with low-level access inside a guest VM could escape to the Hyper-V host and run code as the virtual machine worker process. This puts the host and its other VMs within reach.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a time-of-check time-of-use race condition (CWE-367) in Windows Hyper-V. Hyper-V checks a value or resource, then uses it a moment later. An attacker in a guest VM can change that value in the gap between the check and the use, so Hyper-V acts on data it never validated. This can let the attacker run code on the host in the security context of the virtual machine worker process. The attack is local, needs low privileges and no user interaction, and the scope is changed. Attack complexity is high because the race must be won. Impact on confidentiality, integrity and availability is high.

EXPLOITABILITY: Affected versions include Windows 10 (versions 21H2 and 22H2, x64 and ARM64), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2022 and 2025, including Server Core installations. An attacker with low privileges in a guest VM must win a race condition to exploit the bug.

BUSINESS IMPACT: Organizations rely on Hyper-V to keep workloads isolated from one another. A guest-to-host escape undermines that isolation and could let one compromised VM affect the host and every workload on it. The consequences include stolen data, tampered systems and outages across many services at once.

WORKAROUND: No official mitigations or workarounds are listed. Until you patch, limit access to guest VMs, separate untrusted workloads from sensitive ones, and monitor Hyper-V hosts for unusual behavior.

URGENCY: This flaw is rated Critical and breaks the boundary between guest and host. It is one of several Hyper-V escape bugs fixed this month, which makes Hyper-V hosts a clear patching priority. The race condition makes exploitation harder, but the reward for attackers is high. Deploy the update to Hyper-V hosts as soon as possible.

CVE-2026-113864 is a use-after-free flaw in Windows Hyper-V. An attacker who already has high-privileged local access can trigger the bug to elevate privileges on the system. Microsoft rates it Critical even though the base score is moderate, because Hyper-V sits at the core of virtualized infrastructure. The fix ships in the November 2026 security updates for supported Windows 10, Windows 11, and Windows Server releases.

CVSS Score: 6.4

SEVERITY: Critical

THREAT: A local attacker who already holds high privileges could exploit this flaw to gain elevated control over a Hyper-V system. On a virtualization host, that control can reach the workloads that depend on it.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The vulnerability is a use after free (CWE-416) in Windows Hyper-V. A use-after-free happens when code keeps using a block of memory after it has been released. An attacker who can control what gets placed in that freed memory may be able to steer the program into running their own code or corrupting trusted data. Here, an authorized local attacker can use the flaw to elevate privileges. The CVSS vector (AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) shows a local attack with high complexity and high required privileges, but a successful exploit gives full impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected releases include Windows 10 Versions 1607, 1809, 21H2, and 22H2; Windows 11 Versions 23H2, 24H2, 25H2, 26H1, and 26H2 (x64 and ARM64); and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. The attacker must already be on the machine with high privileges and must win a hard-to-hit memory condition. No user interaction is needed.

BUSINESS IMPACT: Hyper-V hosts often run many business systems at once, so a flaw in the hypervisor puts more than one server at stake. An attacker who gains full control at this layer could read sensitive data, tamper with virtual machines, or shut down services. That can lead to outages, data breaches, and costly recovery work. It also gives an intruder a strong place to hide and to move deeper into the network.

WORKAROUND: Microsoft lists no workaround or mitigation. Until the update is applied, limit administrative access to Hyper-V hosts, remove the Hyper-V role from systems that do not need it, and watch hosts closely for unusual privileged activity.

URGENCY: Microsoft rates this flaw Critical, and it hits the virtualization layer that many organizations run on. The attack bar is high, since it needs local access with high privileges, but attackers who have already stolen admin credentials are exactly the ones who would use it. Hyper-V is common across Windows Server and Windows client fleets, so the exposure is broad. Patch Hyper-V hosts first, then roll the update out to the rest of the affected systems.

CVE-2026-113862 is a use-after-free bug in Windows Network Address Translation (NAT). An unauthenticated attacker could send a specially crafted packet over the network to run code on an affected system, with no user action needed. Microsoft rates it Critical and considers exploitation more likely.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: An unauthenticated remote attacker could send a crafted packet to an affected system and run code on it without any user interaction.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known. Attackers are considered more likely to target it.

TECHNICAL SUMMARY: The flaw is a use after free (CWE-416) in the Windows NAT component, which translates network addresses as traffic moves between networks. When the component uses memory after it has been freed, an attacker who controls what fills that memory can redirect execution. Microsoft says an attacker must win a race condition, and that a specially crafted packet sent to an affected service can trigger code execution with no authentication or user interaction. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U) reflects a network attack with high complexity and high impact to confidentiality, integrity and availability.

EXPLOITABILITY: Affected versions are Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2 (x64, ARM64 and 32-bit where applicable); and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker sends crafted packets to an affected service and must win a race condition to trigger the use-after-free.

BUSINESS IMPACT: NAT sits in the path of network traffic, so a bug here can be reached without any login. Systems that route or share network connections, including hosts running virtualization or Internet Connection Sharing, are natural targets. A successful attack could give an outsider a foothold to move laterally, steal data or launch ransomware.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the update is applied, disable NAT or connection-sharing features where they are not needed, and restrict untrusted traffic to systems that use them.

URGENCY: This is a Critical, wormable-style bug: no credentials, no clicks, just packets. Microsoft considers exploitation more likely, and every supported Windows version is affected. Patch exposed and routing systems first, then the rest of the fleet. Fixes ship in the November cumulative updates, including KB5131291 (Windows 10 1607 and Server 2016), KB5131085 (Windows 10 1809 and Server 2019), KB5131096 (Windows 10 21H2/22H2), KB5131087 (Windows 11 23H2), KB5132061 and KB5132043 (Windows 11 24H2/25H2/26H2), KB5132059 (Windows 11 26H1), KB5131090 (Server 2022), and KB5131080 and KB5131077 (Server 2025). A restart is required.

CVE-2026-113861 is a use-after-free flaw in Windows Hyper-V. An attacker who already controls a guest virtual machine could use it to run code on the Hyper-V host in the context of the virtual machine worker process. That breaks the basic promise of virtualization: that what happens in one VM stays in that VM. Microsoft rates it Critical even though the attack is hard to pull off, because the payoff is control over the host that runs every other guest.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An attacker with high privileges inside a guest virtual machine could escape to the Hyper-V host. From there they could reach other virtual machines and the data they hold.

EXPLOITS: This vulnerability is not known to be exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The bug is a use-after-free (CWE-416) in Hyper-V, where the code keeps using memory after it has been freed. An attacker inside a guest VM can trigger this condition and steer what ends up in the freed memory, which can lead to code running on the host in the security context of the virtual machine worker process. The CVSS vector is AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The attack is local and needs high privileges in the guest, and the complexity is high because the attacker must win a race condition. The scope is changed, meaning the impact crosses from the guest into the host, with full loss of confidentiality, integrity and availability.

EXPLOITABILITY: Affected: Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1 and 26H2; and Windows Server 2016, 2019, 2022 and 2025, including Server Core installations. An attacker needs high privileges inside a guest VM and must win a race condition to run code on the host. Fixes are delivered in the November cumulative updates: KB5131291 (Windows 10 1607 and Windows Server 2016), KB5131085 (Windows 10 1809 and Windows Server 2019), KB5131096 (Windows 10 21H2 and 22H2), KB5131087 (Windows 11 23H2), KB5132061 or KB5132043 (Windows 11 24H2, 25H2 and 26H2), KB5132059 (Windows 11 26H1), KB5131090 (Windows Server 2022), and KB5131080 or KB5131077 (Windows Server 2025).

BUSINESS IMPACT: Hyper-V hosts often carry dozens of workloads, so one compromised host can expose many servers at once. In shared or multi-tenant setups, a guest escape means one customer or department could reach another's data. Successful attacks could lead to data theft, tampering with other VMs, ransomware deployed at the hypervisor layer, and long outages for every service on that host.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you can patch, limit who has administrative access inside guest VMs, isolate untrusted workloads on separate hosts, and watch hosts for unusual worker process activity.

URGENCY: This is a Critical guest-to-host escape in a hypervisor that runs core business workloads. The race condition makes attacks harder, but it does not make them impossible, and the payoff is control of an entire host. Patch Hyper-V hosts first, especially those running untrusted or shared guests.

CVE-2026-113860 is an elevation of privilege flaw in Windows Hyper-V. A use after free bug lets an attacker who already has low-level access to a system gain administrator privileges. To succeed, the attacker must win a race condition.

CVSS Score: 7.0

SEVERITY: Critical

THREAT: A local attacker with a standard user account could exploit this flaw to become an administrator. That level of access lets them disable defenses, steal data and spread further.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a use after free (CWE-416) in Windows Hyper-V. Hyper-V can keep using a block of memory after it has been released. If an attacker manages to place their own data in that freed memory at the right moment, they can influence what Hyper-V does next and raise their privileges. The attack is local, needs low privileges and no user interaction, and the scope is unchanged. Attack complexity is high because the attacker must win a race condition. A successful attack grants administrator privileges, with high impact on confidentiality, integrity and availability.

EXPLOITABILITY: Affected versions include Windows 10 (versions 1809, 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2019, 2022 and 2025, including Server Core installations. An attacker with local, low-privileged access must win a race condition to exploit the bug.

BUSINESS IMPACT: Elevation of privilege bugs are the second step in most real attacks. Once an attacker lands on a machine through phishing or stolen credentials, a flaw like this lets them become an administrator, turn off security tools, dump credentials and move across the network. On Hyper-V hosts, administrator access can put every hosted workload at risk.

WORKAROUND: No official mitigations or workarounds are listed. Until you patch, limit local logon rights on Hyper-V systems, follow least privilege, and watch for unexpected privilege changes.

URGENCY: This flaw is rated Critical and affects Hyper-V across a wide range of Windows client and server versions. The race condition makes exploitation harder, but privilege escalation bugs are prized by attackers who already have a foothold, and they are often chained with other flaws. Include this update in your standard rollout and prioritize Hyper-V hosts and shared systems.

CVE-2026-113856 is an elevation of privilege flaw in Windows Hyper-V. A heap-based buffer overflow lets an attacker inside a guest virtual machine run code on the host in the context of the virtual machine worker process. The attacker needs low privileges in the guest and must win a race condition.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: An attacker with a foothold inside a guest VM could break out and run code on the Hyper-V host under the virtual machine worker process. That gives them a path from one VM toward the host and its other workloads.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in Windows Hyper-V. Hyper-V can write more data into a heap buffer than it can hold, which overwrites nearby memory. An attacker in a guest VM can use this to run code on the host in the security context of the virtual machine worker process. The attack is local, needs low privileges and no user interaction, and the scope is changed, which means the impact reaches beyond the guest. Attack complexity is high because the attacker must win a race condition. Impact on confidentiality, integrity and availability is high.

EXPLOITABILITY: Affected versions include Windows 10 (versions 21H2 and 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H1 and 26H2), and Windows Server 2022 and 2025, including Server Core installations. An attacker with low privileges in a guest VM must win a race condition to trigger the overflow.

BUSINESS IMPACT: Virtualization keeps workloads apart. When a guest can run code on the host, a single compromised VM can threaten every other system on that host. This matters most for shared hosts, test labs that run untrusted code, and environments that host workloads for different customers or departments. The result could be data exposure, service disruption or a wider breach.

WORKAROUND: No official mitigations or workarounds are listed. Until you patch, restrict who can run code in guest VMs, avoid placing untrusted VMs on hosts with sensitive workloads, and monitor hosts for unusual worker process activity.

URGENCY: This flaw is rated Critical and lets an attacker cross from a guest VM to the host, which is one of the most serious kinds of virtualization bugs. Only low privileges are needed inside the guest. The race condition adds difficulty, but attackers who target virtual environments have the time and skill to work through it. Patch Hyper-V hosts on Windows Server 2022 and 2025 and supported clients promptly.

CVE-2026-113859 is a remote code execution flaw in the Windows TCP/IP stack. A use after free bug lets an unauthenticated attacker on an adjacent network run code on the target system. The attacker must win a race condition, but needs no credentials and no user interaction.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An attacker on the same local network segment could run code on a vulnerable Windows system without logging in. That gives them control of the machine and a base for further attacks.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept code is known.

TECHNICAL SUMMARY: The flaw is a use after free (CWE-416) in Windows TCP/IP, the core networking stack in Windows. Under certain timing, the stack can use memory after it has been freed. An attacker who sends crafted network traffic and wins the race can place controlled data in that memory and redirect execution to run code. The attack vector is adjacent, so the attacker must be on the same network segment. It needs no privileges and no user interaction, and the scope is unchanged. Attack complexity is high because a race condition must be won. Impact on confidentiality, integrity and availability is high.

EXPLOITABILITY: Affected versions are Windows 11 versions 24H2, 25H2, 26H1 and 26H2 (x64 and ARM64) and Windows Server 2025, including Server Core installations. An attacker on an adjacent network must send crafted traffic and win a race condition.

BUSINESS IMPACT: TCP/IP is part of every networked Windows system, so the exposure is broad on affected versions. An attacker who gets onto a shared network, such as an office LAN, guest Wi-Fi or a compromised device, could take over systems without any credentials. Code execution in the networking stack could lead to data theft, system takeover or crashes that disrupt operations.

WORKAROUND: No official mitigations or workarounds are listed. Until you patch, segment networks to limit who can reach critical systems, keep untrusted devices off networks shared with servers, and watch for unusual network activity.

URGENCY: This flaw is rated Critical and sits in the Windows networking stack, which every affected system uses. It needs no credentials and no user action, only a position on the local network. The race condition and adjacent-network requirement narrow the attack, but newer Windows 11 releases and Windows Server 2025 are being deployed widely. Roll out the update quickly, especially on servers and laptops that join shared networks.

CVE-2026-113825 is a Critical remote code execution vulnerability in the Windows SMB Server Network Transport Driver, srvnet.sys. It is caused by a race condition, where two operations use the same shared resource without proper synchronization. An authenticated attacker who wins that race could run code on the target over the network. The bug affects Windows 10 version 1809 and later, Windows 11, and Windows Server 2019, 2022, and 2025.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An attacker with low-level network credentials could send crafted SMB traffic to a vulnerable system and, if they win a race condition, run code in the kernel-level SMB driver.

EXPLOITS: This vulnerability is not known to be exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a race condition (CWE-362) in srvnet.sys, the kernel-mode driver that handles network transport for the Windows SMB server. When concurrent operations touch a shared resource without proper locking, an attacker can time requests so that memory is used in an unsafe state. Exploiting it successfully can lead to code execution on the target. The CVSS v3.1 vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The attack comes over the network, needs low privileges, and needs no user interaction, but attack complexity is high because the attacker must win the race. Successful exploitation has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2019, 2022, and 2025, including Server Core installations. An authenticated attacker would send repeated, carefully timed SMB requests to the target to win the race condition.

BUSINESS IMPACT: SMB is the backbone of Windows file sharing, and file servers often hold an organization's most important data. Code execution in the SMB transport layer could let an attacker take over file servers and domain-joined systems, steal or encrypt shared data, and spread across the network. Because only low privileges are needed, a single phished user account could be enough to start the attack.

WORKAROUND: No official mitigation or workaround is listed, so install the update. In the meantime, block TCP port 445 at the network perimeter, restrict SMB access between network segments to systems that truly need it, and use host firewalls to limit which machines can reach SMB on servers and workstations.

URGENCY: This flaw is rated Critical, sits in a kernel-level network driver, and affects nearly every modern Windows system that shares files. The race condition raises the bar, but low privileges and no user interaction keep the attack path realistic for anyone already inside the network. File servers and domain systems should be patched first, and the update requires a restart.

This vulnerability is in Windows Hyper-V on Windows 11 version 26H1. Hyper-V follows a pointer it should not trust, and an attacker who already has high privileges can use it to gain Virtual Trust Level 1 (VTL1) privileges. VTL1 is the isolated, higher-trust environment that powers virtualization-based security features, so this flaw targets one of Windows' strongest protections. Microsoft rates it Critical.

CVSS Score: 8.2

SEVERITY: Critical

THREAT: A local attacker with high privileges could break into VTL1, the protected environment that guards secrets and security checks, and gain control that normal administrators are not supposed to have.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-822, Untrusted Pointer Dereference. Hyper-V takes a pointer value from a less trusted source and uses it without proper checks, which can let an attacker make Hyper-V read or write memory of the attacker's choosing. Microsoft states that successful exploitation grants VTL1 privileges. The CVSS vector is AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H: local, low complexity, high privileges required, no user interaction, and a changed scope with high impact across confidentiality, integrity, and availability. Low complexity makes this more practical than many Hyper-V bugs once an attacker is an admin.

EXPLOITABILITY: Affected: Windows 11 version 26H1 for x64 and ARM64 systems. The fix is KB5132059, and a restart is required. An attacker must already have high privileges on the machine and then trigger the bad pointer use in Hyper-V.

BUSINESS IMPACT: Virtualization-based security exists to protect credentials and enforce code integrity even when an admin account is compromised. If an attacker can reach VTL1, those protections can no longer be trusted. That opens the door to credential theft, persistent hidden access, and bypassing core security controls. For organizations that rely on these features to stop credential theft, this turns a bad day into a much worse one.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until you patch, tightly limit local administrator access and watch privileged accounts for unusual activity.

URGENCY: This is a Critical flaw with low attack complexity that defeats a protection layer designed to survive admin compromise. Attackers who gain admin rights through phishing or another bug could chain it to go deeper. Deploy KB5132059 to Windows 11 26H1 devices promptly and plan for the required restart.

CVE-2026-113752 is a use-after-free bug in Windows Print Spooler components. An unauthenticated attacker on the same adjacent network can exploit it to run code on the target system. To succeed, the attacker must win a race condition, which makes the attack harder.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An unauthenticated attacker on the local or adjacent network could run code on the target system and take control of it.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a use-after-free (CWE-416) in Print Spooler components. Windows frees a block of memory but keeps using it, so an attacker who controls what fills that memory can hijack execution. The attacker must win a race condition to time this correctly. The attack vector is adjacent network, with high complexity, no privileges, and no user interaction. A successful attack has high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected versions include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker on the same network segment sends crafted requests to the spooler and tries to win the race to trigger the bug.

BUSINESS IMPACT: The Print Spooler runs by default on most Windows systems, including servers that never print. A successful attack inside the network lets an intruder spread from machine to machine, steal data, or deploy ransomware. Past spooler bugs have shown how fast attackers jump on this service.

WORKAROUND: No official workarounds are listed. Where printing is not needed, especially on domain controllers and servers, stop and disable the Print Spooler service. Segment networks to limit who can reach spooler services.

URGENCY: This is a Critical bug that needs no login and no user action. The Print Spooler is on almost every Windows system, so the exposure is wide. Even with a race condition to win, attackers already on the network have time to try, so patch soon.

CVE-2026-113749 is a heap-based buffer overflow in the Microsoft Windows Codecs Library, the part of Windows that decodes images, audio, and video. An integer overflow in how the library sizes its memory can lead it to write past the end of a heap buffer. A remote attacker with no account on the target can use this to run code, but only after a user opens or processes a specially crafted file. The bug affects a wide range of supported Windows 10, Windows 11, and Windows Server releases.

CVSS Score: 7.5

SEVERITY: Critical

THREAT: An unauthenticated remote attacker who tricks a user into opening or previewing a malicious media file could run code on the system and take over the user's session, with full impact on confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not known to be actively exploited. The issue was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw sits in the Windows Codecs Library, which parses and decodes media content for Windows apps and system components. When the library handles certain values in a crafted file, an integer overflow or wraparound (CWE-190) can produce a buffer that is too small for the data that follows. The decoder then writes beyond that heap buffer (CWE-122), corrupting nearby memory. An attacker who shapes this corruption carefully can redirect execution and run code in the context of the process doing the decoding. The attack works over the network, needs no privileges, but does need user interaction, and attack complexity is high: success depends on a deep understanding of the target and on factors such as system configuration and other security defenses.

EXPLOITABILITY: Affected systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server 2016, 2019, 2022, and 2025, including Server Core installations. An attacker would deliver a crafted media file through email, a website, a chat app, or a file share and convince a user to open it. Exploitation is rated less likely because of the high attack complexity.

BUSINESS IMPACT: Media files are everywhere, and people open them without a second thought, which makes this an easy lure for phishing campaigns. A successful attack gives an outsider code execution on a workstation or server, opening the door to data theft, ransomware deployment, credential harvesting, and lateral movement across the network. Because the codecs library ships in almost every supported version of Windows, the exposed footprint in a typical organization is large, and one compromised endpoint can become the starting point for a much wider breach.

WORKAROUND: No official mitigation or workaround is listed. Until the update is installed, block or quarantine untrusted media attachments at the email and web gateway, remind users not to open unexpected image or video files, and limit user privileges to reduce what an attacker gains if code runs.

URGENCY: This flaw carries a Critical rating, needs no credentials, and can be triggered remotely through something as ordinary as a media file. The high complexity and lack of known exploitation buy some time, but not much: once a patch is out, attackers study it, and a bug in a component present on nearly every Windows device is an attractive target. Prioritize this update across workstations first, where users open files, and then servers.

CVE-2026-112967 is a heap-based buffer overflow in the Windows Xbox Live Networking Service that allows an attacker to run code remotely. An attacker on the same network can call service endpoints and trigger the bug without any credentials and without any action from the user. It affects a wide range of Windows 10 and Windows 11 versions.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: An attacker with access to the same network can exploit this flaw without credentials or user interaction. A successful attack could give them full control of the affected Windows system.

EXPLOITS: This vulnerability is not known to be actively exploited. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The flaw is a heap-based buffer overflow (CWE-122) in the Windows Xbox Live Networking Service. When the service handles calls to its endpoints, it can write past the end of a heap buffer. An in-network attacker who calls arbitrary endpoints with crafted input can corrupt memory and gain remote code execution. The attack is network-based, has low complexity, and needs no privileges or user interaction. This gives the highest possible impact on confidentiality, integrity, and availability, which is why it scores 9.8.

EXPLOITABILITY: Affected systems include Windows 10 Version 1809, 21H2, and 22H2, and Windows 11 Version 23H2, 24H2, 25H2, 26H1, and 26H2, across 32-bit, x64, and ARM64 editions where listed. Fixes ship in KB5131085, KB5131096, KB5131087, KB5132061, KB5132043, and KB5132059, depending on the version. Most of these updates need a restart. An attacker on the network sends crafted calls to the service's endpoints.

BUSINESS IMPACT: This is the kind of bug that turns one compromised device into a network-wide problem. Because no user action is needed, an attacker who gets a foothold anywhere on the internal network could jump from machine to machine on their own. That opens the door to fast-moving ransomware, data theft, and business shutdown. The service name sounds consumer-focused, but it lives on standard business Windows endpoints.

WORKAROUND: Microsoft lists no mitigations or workarounds. If you cannot patch right away, limit network access between workstations, segment the network, and consider disabling the Xbox Live Networking Service on business systems that do not need it, after testing.

URGENCY: A CVSS score of 9.8, no login, and no user interaction make this the most urgent fix in this group. It affects nearly every supported Windows client version, and network-reachable, wormable-style bugs are a top target for attackers. Patch all Windows 10 and Windows 11 systems right away and plan for the required restarts.

This is a heap-based buffer overflow in the Windows Raw Image Extension, the add-on that lets Windows display camera RAW photos. An attacker can create a malicious RAW image file, and the bug can trigger when Windows generates a thumbnail or preview of it. The user only has to navigate to the folder that holds the file; they do not need to open it. Successful exploitation allows remote code execution. Microsoft rates it Critical.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: A remote attacker could plant a malicious RAW image where a user will browse to it and run code on that user's computer without the file ever being opened.

EXPLOITS: This vulnerability is not known to be exploited in the wild. It was not publicly disclosed before the fix, and no public proof-of-concept exploit code is known.

TECHNICAL SUMMARY: The weakness is CWE-122, Heap-based Buffer Overflow. When the Raw Image Extension parses a crafted RAW file, it writes data past the end of a heap buffer, which can corrupt memory and let the attacker take control of execution. Because Windows builds thumbnails and previews automatically, simply viewing a folder in File Explorer can trigger the parsing. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H: network, low complexity, no privileges, user interaction required, with high impact.

EXPLOITABILITY: Affected: Raw Image Extension on Windows 10 versions 1809, 21H2, and 22H2, and on Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2. The fix is delivered as an updated Raw Image Extension, and no restart is required. An attacker places a crafted RAW file in a folder, download, or share and convinces the user to browse to it.

BUSINESS IMPACT: Image files feel safe, and users rarely think twice about opening a folder of photos. That makes this an easy lure through shared drives, downloads, or removable media. A successful attack gives the attacker code execution on the workstation, which can lead to credential theft, data loss, and a path into the wider network.

WORKAROUND: Microsoft lists no mitigations or workarounds. Until the extension is updated, consider removing the Raw Image Extension where it is not needed, and avoid browsing untrusted folders that may contain RAW image files.

URGENCY: This flaw is Critical, needs no privileges, and can trigger just from viewing a folder. The extension is installed on a wide range of Windows 10 and Windows 11 builds. Make sure the updated Raw Image Extension reaches all devices, especially since app-based updates are easy to overlook in normal patch cycles.