Patch Tuesday September 2026

CVE-2026-62878 is a remote code execution vulnerability in Windows DNS Server caused by a stack-based buffer overflow. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. The attack has low complexity, requires no privileges, and requires no user interaction.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: The vulnerability creates a severe remote compromise risk for affected Windows DNS servers. Because no authentication or user interaction is required, an attacker only needs network access to the vulnerable service and a specially crafted packet to attempt exploitation.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-62878 affects Windows DNS Server and is caused by a stack-based buffer overflow. The flaw can occur when the DNS service processes specially crafted network data that exceeds the intended stack buffer boundary. This memory corruption could allow an attacker to influence program execution and potentially execute arbitrary code on the target system. Exploitation is network-based, has low attack complexity, requires no privileges, and requires no user interaction. The CVSS v3.1 metrics indicate high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows DNS Server. Specific affected Windows Server versions are not confirmed in the available data. An unauthenticated attacker could exploit the vulnerability remotely by sending a specially crafted packet to the affected DNS service. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a DNS server and potentially gain control of critical network infrastructure. This could lead to data theft, malware installation, service disruption, DNS manipulation, or further attacks inside the environment. Because DNS is essential to normal network operations, compromise of a DNS server could have wide-reaching business and operational impact.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict unnecessary network exposure to DNS services, limit access to trusted network segments where practical, and monitor DNS servers for malformed or suspicious traffic.

URGENCY: This vulnerability is rated Critical with a CVSS v3.1 score of 9.8. It can be targeted remotely, has low attack complexity, and requires no authentication or user interaction. Although Microsoft assesses exploitation as less likely and reports no known active exploitation, the potential impact of successful remote code execution on a DNS server makes this a high-priority patch.

CVE-2026-62817 is a remote code execution vulnerability in Windows DNS Server caused by an out-of-bounds write. An unauthenticated attacker on an adjacent network could exploit the flaw by interacting with arbitrary endpoints and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: The vulnerability creates a serious remote code execution risk for Windows DNS Server systems reachable from an adjacent network. An attacker does not need authentication or existing privileges, and successful exploitation could compromise a core network service.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-62817 affects Windows DNS Server and is caused by an out-of-bounds write. This type of memory corruption can occur when the DNS service writes data beyond the intended memory boundary. An in-network attacker could interact with arbitrary endpoints and potentially trigger the vulnerability. Successful exploitation could allow remote code execution on the target system. The attack vector is adjacent, attack complexity is low, no privileges are required, and no user interaction is needed. The CVSS v3.1 metrics indicate high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows DNS Server. Specific affected Windows Server versions are not confirmed in the available data. Exploitation requires access from an adjacent network and can be attempted without authentication or user interaction.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a DNS server and potentially compromise a critical network infrastructure system. This could lead to service disruption, data exposure, malware installation, DNS manipulation, or further attacks within the organization. Because DNS is central to network operations, compromise could affect a wide range of dependent systems and services.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict access to DNS services from untrusted or unnecessary network segments and closely monitor DNS servers for suspicious or malformed traffic.

URGENCY: This vulnerability is rated Critical, has low attack complexity, and requires no authentication or user interaction. Although exploitation is limited to an adjacent network and Microsoft assesses exploitation as less likely, successful exploitation could result in remote code execution on a critical DNS server. Organizations should prioritize deployment of the official security update.

CVE-2026-62820 is a remote code execution vulnerability in Windows DNS Server caused by improper synchronization during concurrent access to a shared resource. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. Successful exploitation requires the attacker to win a race condition, which increases attack complexity.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: The vulnerability creates a remote code execution risk in Windows DNS Server. An attacker does not need credentials or user interaction, but successful exploitation depends on winning a race condition. If exploited, the flaw could provide a path to compromise a critical infrastructure service.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-62820 affects Windows DNS Server and is caused by a race condition involving concurrent access to a shared resource without proper synchronization. Under specific timing conditions, an unauthenticated attacker can send specially crafted network traffic and attempt to trigger the flaw. Successful exploitation requires winning the race condition, which is why the attack complexity is rated High. If successful, the attacker could execute code on the target system. The CVSS v3.1 metrics show high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows DNS Server. Specific affected Windows Server versions are not confirmed in the available data. Exploitation can be attempted remotely over the network without authentication or user interaction, but the attacker must successfully win a race condition.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a DNS server and potentially gain control of a critical network infrastructure system. This could lead to service disruption, data exposure, malware installation, DNS manipulation, or further attacks inside the organization. Because DNS supports core network operations, compromise could have broad operational impact.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict unnecessary network exposure to DNS services, limit access to trusted segments where practical, and monitor DNS infrastructure for unusual or malformed traffic.

URGENCY: This vulnerability is rated Critical and can be targeted remotely without authentication or user interaction. Although Microsoft assesses exploitation as less likely and exploitation requires winning a race condition, successful exploitation could result in remote code execution on a critical DNS server. Organizations should prioritize deployment of the official security update.

CVE-2026-62823 is a remote code execution vulnerability in Windows DHCP Server caused by a heap-based buffer overflow. An unauthenticated attacker on an adjacent network could send a specially crafted packet to an affected DHCP service and potentially execute code on the target system. The attack requires no privileges, no authentication, and no user interaction.

CVSS Score: 8.8

SEVERITY: Critical

THREAT: The vulnerability presents a serious threat to Windows DHCP infrastructure because an attacker does not need an account or any existing privileges. A specially crafted network packet sent from an adjacent network could trigger the flaw and potentially result in remote code execution on the DHCP server.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation More Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm publicly available proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-62823 affects Windows DHCP Server and is caused by a heap-based buffer overflow. The vulnerability can be triggered when the DHCP service processes a specially crafted network packet. Because memory is written outside the intended heap buffer boundary, an attacker may be able to corrupt memory and influence program execution. Exploitation has low attack complexity and requires no privileges or user interaction. Successful exploitation could allow arbitrary code execution on the target system and result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows DHCP Server. Specific affected Windows Server versions are not confirmed in the available data. An unauthenticated attacker on an adjacent network could exploit the vulnerability by sending a specially crafted packet to the affected DHCP service. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a DHCP server and potentially take control of a critical network infrastructure system. A compromised DHCP server could expose sensitive data, disrupt address assignment, interfere with network availability, install malicious software, or provide a foothold for further attacks. Because DHCP services are often central to enterprise connectivity, disruption or compromise could have broad operational consequences.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict network access to DHCP services, limit exposure to trusted network segments, and monitor DHCP servers for unusual or malformed traffic.

URGENCY: This vulnerability is rated Critical, requires no authentication or user interaction, and Microsoft assesses exploitation as More Likely. A successful attacker could remotely execute code by sending a specially crafted packet from an adjacent network. Organizations running Windows DHCP Server should prioritize deployment of the official security update, especially on systems supporting business-critical network services.

CVE-2026-62893 is a remote code execution vulnerability in Windows Deployment Services caused by a use-after-free condition. An unauthenticated attacker could send a specially crafted packet to an affected TFTP service over the network and potentially execute code on the target system. The attack requires no privileges, no authentication, and no user interaction.

CVSS Score: 9.8

SEVERITY: Critical

THREAT: The vulnerability presents a severe remote attack risk because an attacker does not need credentials or user interaction. With low attack complexity and network-based exploitation, an exposed Windows Deployment Services TFTP server could become a high-value target for remote compromise.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation More Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-62893 affects Windows Deployment Services and is caused by a use-after-free memory condition. This type of flaw occurs when software continues to access memory after it has already been released. An unauthenticated attacker could trigger the vulnerability by sending a specially crafted network packet to the affected TFTP service. Successful exploitation could allow arbitrary code execution on the target system. The attack has low complexity, requires no privileges, and requires no user interaction. The CVSS v3.1 metrics indicate high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows Deployment Services TFTP Server. Specific affected Windows Server versions are not confirmed in the available data. Exploitation can occur remotely over the network by sending a specially crafted packet to the vulnerable service, with no authentication or user interaction required.

BUSINESS IMPACT: Successful exploitation could allow an attacker to take control of a Windows Deployment Services server, install malware, steal sensitive data, alter deployment content, disrupt imaging and provisioning operations, or use the compromised server as a foothold for further attacks. Because deployment infrastructure often has broad access to enterprise systems, compromise could have significant operational and security consequences.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict network access to the TFTP service, limit exposure to trusted segments, and monitor for unusual or malformed traffic targeting Windows Deployment Services.

URGENCY: This vulnerability is rated Critical with a CVSS v3.1 score of 9.8. It is remotely exploitable, has low attack complexity, requires no privileges, and needs no user interaction. Microsoft also assesses exploitation as More Likely. Organizations running Windows Deployment Services TFTP Server should prioritize deployment of the official security update.

CVE-2026-65789 is a remote code execution vulnerability in Windows DNS caused by a use-after-free condition. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. Exploitation requires specific network configurations and timing conditions, making successful exploitation less reliable across all environments.

CVSS Score: 8.1

SEVERITY: Critical

THREAT: The vulnerability presents a serious remote attack risk because exploitation does not require credentials or user interaction. A successful attacker could potentially execute code on an affected Windows DNS Server, although the high attack complexity means exploitation depends on favorable network and timing conditions.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Unlikely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-65789 affects Windows DNS Server and is caused by a use-after-free condition. This type of memory safety issue can occur when the software continues to access memory after it has already been released. An unauthenticated attacker could attempt to trigger the flaw by sending a specially crafted network packet to the affected DNS service. Successful exploitation could allow remote code execution on the target system. The attack requires no privileges and no user interaction, but it has high attack complexity because exploitation depends on specific network configurations and timing conditions. The CVSS v3.1 metrics indicate high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows DNS Server. Specific affected Windows Server versions are not confirmed in the available data. Exploitation can be attempted remotely over the network without authentication or user interaction, but successful exploitation requires particular network and timing conditions.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a DNS server and potentially compromise a critical network infrastructure system. This could lead to unauthorized access, data exposure, service disruption, malware installation, or further attacks inside the environment. Because DNS is central to name resolution and network operations, compromise or downtime could have broad business consequences.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should restrict unnecessary network exposure of DNS services, limit access to trusted networks where practical, and closely monitor DNS servers for malformed or suspicious traffic.

URGENCY: This vulnerability is rated Critical and can be targeted remotely without authentication or user interaction. Although Microsoft assesses exploitation as unlikely and notes that specific network and timing conditions are required, successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impact. Organizations operating Windows DNS Server should prioritize deployment of the official security update.

SAP patches address three Critical vulnerabilities across Commerce Cloud, Manufacturing Integration and Intelligence, and NetWeaver and ABAP Platform. CVE-2026-58231 has a CVSS score of 10.0, Critical severity, and can allow an unauthenticated attacker to execute arbitrary code. CVE-2026-44758 has a CVSS score of 9.1, Critical severity, and can allow a highly privileged attacker to execute arbitrary operating-system commands. CVE-2026-34265 has a CVSS score of 9.8, Critical severity, and can allow an unauthenticated attacker to trigger memory corruption, potentially exposing sensitive information or crashing the system.

These vulnerabilities can significantly affect confidentiality, integrity, and availability across critical SAP environments.

Microsoft Exchange Server 2016 CU23 is affected by six vulnerabilities spanning remote code execution, privilege escalation, and other security weaknesses. CVE-2026-62913 has a CVSS score of 8.8, High severity. CVE-2026-62911 has a CVSS score of 8.0, High severity. CVE-2026-62910 has a CVSS score of 7.2, High severity. CVE-2026-62912 has a CVSS score of 6.5, Medium severity. CVE-2026-62914 has a CVSS score of 7.3, High severity. CVE-2026-62915 has a CVSS score of 6.5, Medium severity.

The patch addresses the affected Exchange Server components and reduces the risk of server compromise, unauthorized privilege gains, and disruption.

CVE-2026-81963 is an elevation of privilege vulnerability in the Windows Update Stack caused by improper link resolution before file access and improper access control. A local attacker with low privileges could exploit the weakness to gain SYSTEM privileges. Microsoft reports that exploitation has already been detected.

CVSS Score: 7.8

SEVERITY: Important

THREAT: The vulnerability creates a serious local privilege-escalation risk because an attacker with limited access could elevate to SYSTEM privileges. The threat is increased by confirmed exploitation and the presence of functional exploit code maturity in the CVSS v3.1 metrics.

EXPLOITS: Microsoft lists this vulnerability as Exploited: Yes with an exploitability assessment of Exploitation Detected. It is not publicly disclosed. The CVSS v3.1 metrics identify exploit code maturity as Functional. The available data does not specifically confirm whether public proof-of-concept code exists.

TECHNICAL SUMMARY: CVE-2026-81963 affects the Windows Update Stack and involves improper link resolution before file access, also known as link following, together with improper access control. The weakness can allow a local attacker to manipulate file access behavior in a way that bypasses intended security boundaries. Exploitation has low attack complexity, requires low privileges, and does not require user interaction. Successful exploitation can result in SYSTEM privileges and high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is the Windows Update Stack. Specific affected Windows versions cannot be confirmed from the available data. Exploitation requires local access with low privileges and no user interaction.

BUSINESS IMPACT: A successful attacker could gain SYSTEM-level privileges and potentially take extensive control of the affected Windows endpoint. This could enable theft of sensitive information, modification or deletion of data, installation of malware, disabling of security controls, credential access, or additional attacks across the environment. Because exploitation has already been detected, systems that remain unpatched present an immediate business risk.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should limit local code execution opportunities, enforce least privilege, and closely monitor endpoints for suspicious privilege-escalation activity.

URGENCY: This patch should be deployed urgently because Microsoft reports active exploitation and the CVSS v3.1 metrics identify exploit code maturity as Functional. The vulnerability can allow a low-privilege local attacker to obtain SYSTEM privileges without user interaction, making already-compromised endpoints especially vulnerable to full takeover.

A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) allows an authorized local attacker to elevate privileges. An attacker who can execute code from a low-privilege AppContainer can exploit the vulnerability to escape the sandbox and obtain SYSTEM privileges without requiring user interaction.

CVSS Score: 7.8

SEVERITY: Important

THREAT: The vulnerability creates a serious local privilege-escalation threat because successful exploitation can give an attacker SYSTEM-level privileges. The risk is elevated significantly because Microsoft reports that exploitation has already been detected.

EXPLOITS: Microsoft reports that this vulnerability is actively exploited. It is not publicly disclosed according to the available data. The CVSS v3.1 metrics list exploit code maturity as Unproven, and the data does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-85880 affects Windows Advanced Local Procedure Call (ALPC) and involves a heap-based buffer overflow together with use of an uninitialized resource. An attacker who already has low privileges and can execute code inside a low-privilege AppContainer can trigger the vulnerability locally. Successful exploitation can allow the attacker to escape the application sandbox and elevate privileges to SYSTEM. The attack has low complexity, requires low privileges, requires no user interaction, and can result in high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: The affected Microsoft product is Windows ALPC. Specific affected Windows versions are not identified in the available data. Exploitation requires local code execution with low privileges, including the ability to run code in a low-privilege AppContainer. No user interaction is required.

BUSINESS IMPACT: Successful exploitation can give an attacker SYSTEM privileges, potentially allowing complete control of an affected Windows endpoint. An attacker could access sensitive information, alter system configuration, install additional malicious software, disable security controls, or use the compromised device to support broader attacks inside an organization. Because exploitation has already been detected, vulnerable systems represent an immediate avenue for attackers who have obtained an initial foothold.

WORKAROUND: No specific workaround or mitigation is identified in the available data. Microsoft lists an official fix as the remediation. Where immediate patching is not possible, organizations should restrict opportunities for untrusted local code execution and closely monitor affected Windows systems for suspicious privilege-escalation activity.

URGENCY: Deployment should be prioritized because Microsoft reports active exploitation of this vulnerability. Although the severity is rated Important rather than Critical, successful exploitation can elevate an attacker from a low-privilege AppContainer to SYSTEM without user interaction. Systems where attackers may already have limited local access face particularly high risk.

CVE-2026-69678 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code. An attacker can send a specially crafted presentation, with exploitation occurring when a user opens the file or when it is rendered in a preview pane. Successful exploitation can execute code in the user's context and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can deliver a specially crafted PowerPoint presentation over a network. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not identified as exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Less Likely. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69678 is caused by a use-after-free weakness (CWE-416) in Microsoft Office PowerPoint. An attacker can create and send a specially crafted presentation to a target. When the presentation is opened or rendered in a preview pane, the memory-handling flaw can potentially be triggered and allow attacker-controlled code to execute in the user's context. The attack vector is Network, attack complexity is Low, privileges required are None, and user interaction is Required. Successful exploitation carries high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit; Microsoft Office 2019 32-bit and 64-bit; Microsoft Office LTSC 2021 32-bit and 64-bit; Microsoft Office LTSC 2024 32-bit and 64-bit; and Microsoft PowerPoint 2016 32-bit and 64-bit. Exploitation can occur when a specially crafted presentation is opened or rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow malicious code to execute in the user's context, creating the potential for loss of confidentiality, unauthorized changes, and disruption to availability. A weaponized presentation could therefore turn routine document handling into a route for compromising organizational systems and information.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified, so organizations should apply the applicable update rather than rely on an unconfirmed alternative mitigation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its low attack complexity, network attack vector, lack of required attacker privileges, and potential for remote code execution make prompt deployment important, even though exploitation is assessed as less likely and no exploitation is identified.

CVE-2026-69820 is a heap-based buffer overflow vulnerability in Windows Hello that allows an authorized local attacker to elevate privileges. Successful exploitation could give the attacker Virtual Trust Level 1 (VTL1) privileges. No exploitation or public disclosure is reported, and exploit code maturity is listed as unproven.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability creates a privilege-escalation threat on affected Windows systems. An attacker with existing high privileges and local access could exploit the Windows Hello heap-based buffer overflow to obtain VTL1 privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: Exploitation is assessed as unlikely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is unproven, so the source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69820 is a heap-based buffer overflow, classified as CWE-122, in Windows Hello. It allows an authorized attacker to perform local privilege escalation. The CVSS metrics specify a local attack vector, low attack complexity, high privileges required, no user interaction, and changed scope. A successful attacker could gain VTL1 privileges, with potentially high confidentiality, integrity, and availability impact. Although the CVSS metrics list attack complexity as Low, the supplied FAQ separately states that successful exploitation requires deep system knowledge and depends on factors such as the environment, configuration, and additional security measures.

EXPLOITABILITY: Affected products include Windows 10 versions 21H2 and 22H2 for listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for listed ARM64 and x64 systems. Exploitation requires local access and high privileges, but no user interaction.

BUSINESS IMPACT: Successful exploitation could elevate an authorized local attacker to VTL1 privileges. The potential high impact to confidentiality, integrity, and availability makes this flaw significant for organizations running affected Windows endpoints. “A foothold with high privileges could become access to an even more powerful trust level.”

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected-software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and potentially high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Windows systems despite exploitation currently being assessed as unlikely.

CVE-2026-81354 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a heap-based buffer overflow. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could submit malformed face data to the Windows Hello Face secure sensor adapter and potentially gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authorized local attacker to cross the VTL0-to-VTL1 security boundary and gain VTL1 privileges. The vulnerability has low attack complexity once the required high privileges or face-sensor adapter control are present. Public disclosure is No, and exploitation is assessed as less likely.

EXPLOITS: There is no confirmed exploitation. The vulnerability is not publicly disclosed, and exploit-code maturity is listed as Unproven. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is a CWE-122 heap-based buffer overflow in Windows Hello. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could send malformed face data to the Windows Hello Face secure sensor adapter. Successful exploitation could execute code across the VTL0-to-VTL1 security boundary and provide VTL1 privileges. The CVSS metrics indicate a local attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, including Server Core, across the architectures listed for each release. Exploitation requires administrative OS control or control of a face-sensor adapter and does not require user interaction.

BUSINESS IMPACT: Successful exploitation could enable code execution across an important Windows security boundary with high confidentiality, integrity, and availability impact. For organizations, this could allow an attacker who already has substantial control to extend that access into VTL1, increasing the potential impact of a compromised system.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can cross the VTL0-to-VTL1 security boundary. Although exploitation is assessed as less likely and no exploitation is confirmed, affected Windows systems should receive the official fix promptly because successful exploitation carries high confidentiality, integrity, and availability impact.

CVE-2026-69864 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness (CWE-416). An authorized local attacker with low privileges could exploit a race condition to elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high attack complexity but does not require user interaction. The vulnerability is not publicly disclosed and is not currently reported as exploited.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a low-privileged local attacker to gain VTL1 privileges. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, making privilege escalation the primary security threat.

EXPLOITS: The vulnerability is assessed as Exploitation Unlikely, with exploit-code maturity listed as Unproven. It is not publicly disclosed and is not reported as exploited. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-69864 is a use-after-free vulnerability in Windows Hello. Successful exploitation requires an authorized attacker with low privileges to execute an attack locally and win a race condition, resulting in high attack complexity. No user interaction is required. If successful, the attacker could elevate privileges to Virtual Trust Level 1 (VTL1). The vulnerability has a changed scope and is rated as having high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected software includes Windows 10 versions 21H2 and 22H2 and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across the 32-bit, x64, and/or ARM64 editions listed as applicable. Exploitation requires local access, low privileges, and successfully winning a race condition; no user interaction is required.

BUSINESS IMPACT: An attacker who already has limited local access could use this vulnerability to gain substantially stronger privileges. Successful exploitation could undermine security boundaries and expose organizations to high confidentiality, integrity, and availability impact, increasing the potential for unauthorized access or modification of protected resources.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and can enable elevation to VTL1 privileges with no user interaction. Although exploitation is assessed as unlikely and no active exploitation is reported, organizations should prioritize deployment because successful exploitation carries high confidentiality, integrity, and availability impact.

CVE-2026-69784 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness. An authorized local attacker with low privileges could exploit the vulnerability and gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker with existing low-privileged local access could attempt to exploit the Windows Hello use-after-free condition to elevate privileges. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. Exploit Code Maturity is Unproven, and the vulnerability is neither publicly disclosed nor known to be exploited. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is a use-after-free condition, identified as CWE-416, in Windows Hello. An authorized attacker can exploit the flaw locally to elevate privileges. Successful exploitation requires winning a race condition, according to the vulnerability FAQ, and could result in VTL1 privileges. The CVSS metrics specify a local attack vector, low privileges required, no user interaction, and changed scope, with high potential impact to confidentiality, integrity, and availability. The source contains conflicting attack-complexity information: the CVSS metrics specify Attack Complexity Low, while the FAQ describes Attack Complexity High and says exploitation requires winning a race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 21H2 and 22H2 on listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the listed ARM64 and x64 systems. Exploitation requires local access with low privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has authorized local access to gain VTL1 privileges. This privilege escalation creates the potential for serious compromise because the CVSS assessment identifies high confidentiality, integrity, and availability impact. For organizations, a foothold with limited privileges could therefore become a much more consequential system compromise.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified in the source, so affected systems should receive the applicable security update where possible.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in VTL1 privilege elevation. Although exploitation is assessed as unlikely and no active exploitation is reported, the high potential impact across confidentiality, integrity, and availability makes timely deployment important.

CVE-2026-66302 is a critical remote code execution vulnerability in affected Microsoft Skype for Business Server versions. External control of a file name or path allows an unauthenticated attacker to send a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server. Successful exploitation could allow code execution on the target server without authentication or user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability is remotely accessible over the network, has low attack complexity, and requires no privileges or user interaction. Successful exploitation could compromise confidentiality, integrity, and availability at a high level by allowing attacker-controlled code to execute on the affected server.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is caused by external control of a file name or path (CWE-73) in Skype for Business Server. An unauthenticated remote attacker can send a specially crafted request over the network that causes an attacker-controlled file to be written to an arbitrary location on the affected server. Successful exploitation can lead to execution of attacker-controlled code. The attack has low complexity, requires no existing privileges, and requires no action from a user. The security impact is rated High for confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, and Skype for Business Server Subscription Edition CU1. Exploitation can occur remotely through a specially crafted network request without authentication or user interaction.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on a Skype for Business server, potentially exposing sensitive information, altering server data or functionality, and disrupting service availability. Because no authentication or user interaction is required, an accessible vulnerable server could present a serious organizational risk.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, making patch deployment the documented remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and can be exploited over the network with low complexity, no privileges, and no user interaction. Although exploitation is currently assessed as less likely and no exploitation is reported, affected Skype for Business servers should be prioritized for deployment of the official fix because successful exploitation can result in remote code execution.

CVE-2026-72980 is a Windows Hello security feature bypass vulnerability caused by an uncontrolled search path element (CWE-427). An authorized local attacker with high privileges could exploit the issue to bypass the Windows Hello security feature. Successful exploitation can result in a high confidentiality impact, although no integrity or availability impact is identified.

CVSS SCORE: 4.4.

SEVERITY: Critical.

THREAT: The vulnerability creates a risk to Windows Hello protections on affected Windows systems. Exploitation requires local access and high privileges, but attack complexity is low and no user interaction is required. A successful attack could bypass a security feature and compromise confidentiality.

EXPLOITS: Exploitation is assessed as unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, so confirmed public exploit, zero-day exploitation, or proof-of-concept code cannot be established.

TECHNICAL SUMMARY: The vulnerability results from an uncontrolled search path element in Windows Hello, identified as CWE-427. An authorized attacker operating locally with high privileges could take advantage of this condition to bypass the Windows Hello security feature. The attack has low complexity and requires no user interaction. The CVSS metrics identify a high confidentiality impact, with no impact to integrity or availability and no change in security scope.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2016, 2019, 2022 and 2025, including the listed Server Core installations. Exploitation requires local access and high privileges but no user interaction.

BUSINESS IMPACT: A successful security feature bypass could weaken an organization's reliance on Windows Hello and expose confidential information on compromised systems. The need for high privileges limits the attack path, but the low attack complexity means an attacker who already has sufficient local privileges could potentially use the flaw without involving a user.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, making patch deployment the identified remediation path.

URGENCY: This vulnerability is rated Critical across the affected Windows products and should be prioritized for deployment. While it is not publicly disclosed or known to be exploited, successful exploitation could bypass Windows Hello protections and have a high confidentiality impact.

CVE-2026-69797 is a critical remote code execution vulnerability in Microsoft Office PowerPoint caused by a use-after-free weakness (CWE-416). An unauthorized attacker can send a specially crafted presentation that may trigger the vulnerability when a user opens the file or it is rendered in a preview pane. Successful exploitation could execute code in the user's context and result in significant confidentiality, integrity, and availability impact.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can deliver a specially crafted PowerPoint presentation over a network. Attack complexity is low and no privileges are required, although user interaction is required. Successful exploitation can allow code execution in the user's context, with high potential impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The presence of public exploit code, zero-day exploitation, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-69797 is a use-after-free vulnerability in Microsoft Office PowerPoint. The weakness occurs when software continues to use memory after it has been freed, creating an opportunity for unsafe memory operations. An attacker can craft a malicious presentation and send it to a target. Opening the presentation or rendering it in a preview pane can trigger the vulnerability and potentially allow attacker-controlled code to execute in the user's context. The vulnerability has a network attack vector, low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, Office LTSC 2024, and PowerPoint 2016. Exploitation requires a user to open a specially crafted presentation or have it rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution in a user's context, potentially exposing sensitive information, enabling unauthorized changes, and disrupting system availability. A malicious presentation can make an ordinary document workflow a path into business systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected installations should be updated.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Its low attack complexity and lack of required attacker privileges increase the risk presented by malicious presentation files. Organizations should prioritize deployment of the official fix across affected Microsoft Office and PowerPoint installations.

CVE-2026-69710 is a Critical elevation-of-privilege vulnerability in Windows Hello caused by improper synchronization of a shared resource during concurrent execution. An authorized local attacker who successfully wins a race condition could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high privileges and high attack complexity but does not require user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: An authorized attacker with high local privileges could exploit a race condition in Windows Hello to gain VTL1 privileges. A successful attack could have a high impact on system confidentiality, integrity, and availability.

EXPLOITS: No exploitation has been reported, and the vulnerability is not publicly disclosed. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Unlikely. No confirmed zero-day exploitation or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is classified as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, commonly known as a race condition. Windows Hello does not properly synchronize concurrent access to a shared resource. Successful exploitation requires a local attacker with high privileges to win this race condition. If successful, the attacker could elevate privileges to VTL1. The CVSS metrics rate confidentiality, integrity, and availability impacts as High, with Scope Changed.

EXPLOITABILITY: Affected systems include Windows 10 versions 21H2 and 22H2 for applicable 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for applicable ARM64 and x64 systems. Exploitation requires local access, high privileges, and successfully winning a high-complexity race condition. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has significant local privileges to reach VTL1 privileges. This privilege escalation could increase the attacker's ability to compromise sensitive system resources, with potentially high consequences for confidentiality, integrity, and availability. For organizations, a compromised privileged endpoint could increase security risk and complicate containment and recovery.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so patch deployment is the documented remediation path.

URGENCY: This vulnerability is rated Critical and has high potential impact across confidentiality, integrity, and availability. Although exploitation is assessed as unlikely and no active exploitation is reported, affected Windows systems should be prioritized for deployment of the official fix because successful exploitation could provide VTL1 privileges.

CVE-2026-80083 is a critical remote code execution vulnerability in Windows Hyper-V caused by an untrusted pointer dereference. An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code. No user interaction is required. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker operating from a Hyper-V guest to execute arbitrary code on the host operating system. The vulnerability has low attack complexity, requires low privileges, requires no user interaction, and can result in high impact to confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as unlikely. The source does not confirm the existence of public exploit or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference (CWE-822) in Windows Hyper-V. An authorized attacker can run a specially crafted application on a Hyper-V guest that causes the Hyper-V host operating system to execute arbitrary code. The attack vector is local, attack complexity is low, and low privileges are required. No user interaction is necessary, and the CVSS scope is changed, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the listed x64 and ARM64 systems, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. Exploitation requires low privileges and a specially crafted application running on a Hyper-V guest.

BUSINESS IMPACT: Successful exploitation could compromise a Hyper-V host and expose organizations to loss of confidentiality, unauthorized modification of data or systems, and disruption of availability. Because malicious activity originating in a guest can potentially result in arbitrary code execution on the host, this vulnerability can weaken an important virtualization security boundary.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected updates require a restart.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although exploitation is currently assessed as unlikely and no active exploitation is reported, the combination of low attack complexity, low privilege requirements, no required user interaction, and potential arbitrary code execution on the Hyper-V host makes timely deployment important.

CVE-2026-72961 is a Critical Windows Hyper-V elevation-of-privilege vulnerability. An authorized attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. Successful exploitation can cross a security boundary and grant Virtual Trust Level 1 (VTL1) privileges. The vulnerability requires local access and high privileges but does not require user interaction.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant privilege-escalation threat to affected Hyper-V environments. Attack complexity is Low, scope is Changed, and successful exploitation can have High impact on confidentiality, integrity, and availability. Exploitation requires high privileges and a local attack path, which limits the initial attack opportunity but makes the vulnerability important where an attacker already has administrative access to a Hyper-V host.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitability assessment is Exploitation Unlikely, and exploit code maturity is classified as Unproven. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72961 affects Windows Hyper-V and is associated with CWE-122, Heap-based Buffer Overflow. The vulnerability description identifies an out-of-bounds read that allows an authorized local attacker to elevate privileges. An attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. If exploitation succeeds, the attacker can cross a security boundary and obtain VTL1 privileges. The CVSS metrics identify a local attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and High confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. Exploitation requires administrative access to the Hyper-V host and specially crafted virtual TPM state data.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already controls an administrative account on a Hyper-V host to cross a security boundary and gain VTL1 privileges. Because the rated impact to confidentiality, integrity, and availability is High, exploitation could create serious security consequences for systems relying on the affected Hyper-V environment. *“High privileges are required to start the attack, but successful exploitation can push that access across another security boundary.”*

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and has a CVSS base score of 8.2. Although exploitation is assessed as unlikely and there is no identified active or public exploitation, successful exploitation can cross a security boundary and affect confidentiality, integrity, and availability at a High level. Organizations operating affected Hyper-V systems should prioritize deployment of the applicable security update.

CVE-2026-69829 is a Critical heap-based buffer overflow vulnerability in Windows Shell. An unauthorized attacker can exploit the flaw over a network by calling arbitrary endpoints, potentially gaining remote code execution. Successful exploitation could severely affect the confidentiality, integrity, and availability of an affected Windows system.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires neither privileges nor user interaction. Successful exploitation can allow an unauthorized attacker to execute code remotely, with high potential impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-69829 is caused by a heap-based buffer overflow (CWE-122) in Windows Shell. An in-network attacker can target arbitrary endpoints over the network to trigger the vulnerability. The attack has low complexity and does not require existing privileges or user interaction. Successful exploitation can result in remote code execution, with high confidentiality, integrity, and availability impacts. An official fix is identified.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. Exploitation can occur over a network through an in-network attacker calling arbitrary endpoints.

BUSINESS IMPACT: Successful exploitation could give an unauthorized attacker remote code execution on affected Windows systems. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, permit unauthorized system changes, and disrupt critical Windows services or business operations.

WORKAROUND: No mitigation or workaround is identified. An official fix is available, and affected systems require a restart according to the affected-software entries.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and can enable remote code execution with low attack complexity, no privileges, and no user interaction. Although exploitation is assessed as unlikely and no exploitation is reported, the potential impact makes timely deployment of the official fix important.

CVE-2026-69603 is a critical heap-based buffer overflow vulnerability in Windows Hyper-V. An authorized attacker running code inside a virtualized environment can issue a specially crafted hypercall containing a maliciously large or malformed payload size. This can trigger a buffer overflow in the hypervisor during memory operations and allow local code execution. The vulnerability requires low privileges and no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker with low privileges in a virtualized environment to execute code through the Hyper-V vulnerability. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, with scope changed. Exploitation requires local access but has low attack complexity and requires no user interaction.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Unlikely. The existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Hyper-V. An authorized attacker can run code within a virtualized environment and issue a specially crafted hypercall containing an excessively large or malformed payload size. Manipulation of this input can cause a buffer overflow in the hypervisor during memory operations, resulting in code execution. The attack has low complexity, requires low privileges, and requires no user interaction. Its CVSS scope is changed, with confidentiality, integrity, and availability impacts all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, and 25H2; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation involves running code in a virtualized environment and sending a specially crafted Hyper-V hypercall. Low privileges are required, with no user interaction.

BUSINESS IMPACT: Successful exploitation could compromise the confidentiality, integrity, and availability of affected Hyper-V environments. Because the flaw reaches the hypervisor through malicious input from a virtualized environment and carries changed scope, a compromised workload could become the starting point for a more serious security incident. For organizations relying on Hyper-V for critical workloads, successful code execution at this boundary could create significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart when the applicable update is installed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution impact through exploitation from a virtualized environment. Although exploitation is assessed as unlikely and no active exploitation is identified, the high confidentiality, integrity, and availability impacts make prompt deployment of the official fix important, particularly on systems hosting Hyper-V workloads.

CVE-2026-69595 is a critical use-after-free vulnerability (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. An unauthenticated remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and can be attacked without authentication. Successful exploitation can have a high impact on confidentiality, integrity, and availability, making vulnerable Windows Server systems a significant target when the affected service is reachable over a network.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69595 is caused by a use-after-free condition in the Windows Services for NFS ONCRPC XDR Driver. An unauthenticated attacker can send a specially crafted packet over the network to an affected service to trigger the vulnerability. Successful exploitation can result in remote code execution on the target system. The CVSS metrics identify network-based access, low attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. An unauthenticated attacker can exploit the flaw remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected Windows Server systems, potentially compromising sensitive information, system integrity, and service availability. Because no authentication or user interaction is required, reachable vulnerable services could expose organizations to serious server compromise.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This vulnerability should be prioritized for deployment because it carries a Critical severity rating and a CVSS base score of 9.8. Its network-based attack path, low attack complexity, and lack of authentication or user interaction requirements create a severe remote-code-execution risk, even though exploitation is currently assessed as Less Likely and no exploitation is reported.

CVE-2026-70585 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An authorized attacker with low privileges could exploit the flaw locally to execute code. Successful exploitation requires winning a race condition, making the attack complexity high, but no user interaction is required.

CVSS SCORE: 7.

SEVERITY: Critical.

THREAT: The vulnerability can enable local remote code execution and has high potential impact to confidentiality, integrity, and availability. An attacker must already have low-level privileges and successfully win a race condition. Exploitation is assessed as more likely, although the vulnerability was not publicly disclosed or known to be exploited at publication.

EXPLOITS: There is no confirmed exploitation and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-70585 is caused by a use-after-free weakness (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. An authorized attacker with low privileges can attempt to trigger the memory-safety condition locally. Successful exploitation requires the attacker to win a race condition, which accounts for the high attack complexity. If successful, the flaw allows code execution and can have high confidentiality, integrity, and availability impact. The attack scope remains unchanged and no user interaction is needed.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. Exploitation requires local access, low privileges, and successfully winning a race condition. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has limited access to execute code on an affected server. This could lead to compromise of sensitive information, unauthorized changes, and disruption of server availability, creating significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart after applying the listed updates.

URGENCY: This vulnerability carries a Critical severity rating and can result in code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the applicable security update across affected Windows Server systems, particularly systems running Services for NFS.

CVE-2026-78445 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An unauthorized remote attacker can exploit the flaw by sending a specially crafted, unauthenticated call to a Network File System (NFS) service, potentially achieving remote code execution. The vulnerability requires no privileges or user interaction and has low attack complexity.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target a vulnerable NFS service remotely over the network. Successful exploitation could compromise confidentiality, integrity, and availability, with all three rated High in the CVSS metrics. No authentication, privileges, or user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitation assessment is “Exploitation Less Likely.” No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. A remote attacker can make an unauthenticated, specially crafted call to a Network File System service that triggers the flaw and leads to remote code execution. The attack vector is network-based, attack complexity is Low, privileges are not required, and no user interaction is necessary. Successful exploitation can have a High impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. A remote, unauthenticated attacker can exploit the vulnerability through a specially crafted NFS service call.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected Windows servers, creating the potential for serious compromise of sensitive information, system integrity, and service availability. For organizations running affected NFS services, a network-reachable weakness requiring no credentials or user action can create significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart according to the affected-software information.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, and lack of authentication or user-interaction requirements make timely deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.

CVE-2026-69769 is a critical heap-based buffer overflow in the Windows HTTP Print Provider. Successful exploitation could allow an unauthorized, in-network attacker to execute code remotely by calling arbitrary endpoints. The vulnerability requires low attack complexity and can affect the confidentiality, integrity, and availability of a compromised system.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker with network access could exploit the vulnerable Windows HTTP Print Provider to execute code remotely. No privileges or user interaction are required, and successful exploitation could result in high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.

TECHNICAL SUMMARY: CVE-2026-69769 is a heap-based buffer overflow (CWE-122) affecting the Windows HTTP Print Provider. The flaw can be reached over a network with low attack complexity. An unauthorized in-network attacker can exploit the vulnerability by calling arbitrary endpoints, causing memory corruption that could lead to remote code execution. Exploitation requires neither privileges nor user interaction, and successful exploitation can have high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and supported architectures. An in-network attacker can potentially exploit the flaw by calling arbitrary endpoints.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected Windows systems. This creates significant business risk because an attacker could compromise sensitive information, alter system data or behavior, and disrupt system availability. A successful attack against important endpoints or servers could therefore lead to operational disruption and loss of data confidentiality and integrity.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and allows remote code execution over a network with low attack complexity, no privileges, and no user interaction. Although exploitation is assessed as unlikely and no exploitation is currently identified, the potential impact makes prompt deployment of the official fix important.

CVE-2026-69874 is a Critical elevation-of-privilege vulnerability in Windows ALPC caused by an untrusted pointer dereference. An authorized local attacker who successfully exploits the flaw could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high privileges and no user interaction. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: A successful attacker could elevate privileges locally and gain VTL1 privileges. The CVSS metrics identify high potential impact to confidentiality, integrity, and availability, with scope changed.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in Windows ALPC. An authorized attacker with local access and high privileges could attempt to exploit the flaw to elevate privileges. Successful exploitation could provide VTL1 privileges and result in high confidentiality, integrity, and availability impact. The CVSS metrics specify a local attack vector, low attack complexity, high privileges required, no user interaction, and changed scope. The accompanying FAQ states that exploitation requires deep knowledge of the system and is not guaranteed because success can depend on the environment, configuration, and additional security measures.

EXPLOITABILITY: Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across the listed architectures; and Windows Server 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires local access and high privileges; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow an attacker who already has authorized local access and high privileges to gain VTL1 privileges. The resulting elevation could have serious consequences for sensitive systems because confidentiality, integrity, and availability impacts are all rated High. “Privilege escalation can turn an existing foothold into a much deeper compromise.”

WORKAROUND: No workaround or mitigation is listed. An official fix is identified, so affected systems should receive the applicable security update. The listed updates require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and potentially high impact across confidentiality, integrity, and availability. Although exploitation is assessed as unlikely and no exploitation is reported, organizations should prioritize deployment of the official fix across affected Windows endpoints and servers.

CVE-2026-69799 is a critical elevation-of-privilege vulnerability in Windows Hello caused by improper synchronization when a shared resource is accessed concurrently. An authorized local attacker with low privileges could exploit a race condition to gain Virtual Trust Level 1 (VTL1) privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a local privilege-escalation threat. Exploitation requires an attacker with low privileges to successfully win a race condition. No user interaction is required, but the attack complexity is rated High.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: Windows Hello contains a concurrent execution weakness involving a shared resource with improper synchronization (CWE-362), resulting in a race condition. An authorized attacker with local access and low privileges must successfully win this race condition to exploit the vulnerability. Successful exploitation could elevate the attacker's privileges to Virtual Trust Level 1 (VTL1). The CVSS scope is Changed, with High potential impact to confidentiality, integrity, and availability. No user interaction is required.

EXPLOITABILITY: Affected software includes Windows 10 versions 21H2 and 22H2 for the listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 for the listed ARM64 and x64 systems. Exploitation requires local access, low privileges, and successfully winning a high-complexity race condition.

BUSINESS IMPACT: Successful exploitation could allow a low-privileged local attacker to gain VTL1 privileges, creating significant risk to protected systems and information. With High confidentiality, integrity, and availability impacts, exploitation could undermine security boundaries and increase the damage possible from an already compromised or malicious local account.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified in the source data, so affected systems should be updated where possible.

URGENCY: This vulnerability is rated Critical and can result in privilege elevation with High confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no exploitation is reported, affected Windows systems should be prioritized for deployment because no workaround or mitigation is specified.

CVE-2026-69767 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that could allow an unauthorized attacker to execute code. Exploitation requires a user to open a specially crafted file. The attack has low complexity and requires no attacker privileges, but user interaction is required. The vulnerability can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could create a specially crafted file and persuade a user to open it in an affected Microsoft Office or PowerPoint product. Successful exploitation could result in remote code execution, with potentially high impact to the confidentiality, integrity, and availability of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-69767 is a use-after-free vulnerability, classified as CWE-416, affecting Microsoft Office PowerPoint. The vulnerability involves improper use of memory after it has been freed. An attacker can prepare a specially crafted file and must convince a user to open it to trigger the vulnerability. The attack vector is network-based, attack complexity is low, and no attacker privileges are required. Successful exploitation can execute code and produce high confidentiality, integrity, and availability impacts. An official fix is identified for the vulnerability.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), Microsoft Office LTSC 2024 (32-bit and 64-bit), and Microsoft PowerPoint 2016 (32-bit and 64-bit). Exploitation requires the target user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected systems, potentially exposing sensitive information, altering data, and disrupting system availability. In a business environment, a malicious document could therefore become an entry point for serious compromise when opened by a user.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making patch deployment the identified remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with high confidentiality, integrity, and availability impact. Organizations using the affected Microsoft Office and PowerPoint products should prioritize deployment of the official fix, even though exploitation is currently assessed as less likely and no active exploitation is reported.

CVE-2026-81950 is a Critical remote code execution vulnerability in Microsoft Excel and affected Microsoft Office products. The vulnerability is caused by a double-free memory condition. An attacker must convince a user to open a malicious Office file, after which code execution may occur locally without the attacker requiring privileges. The Preview Pane is not an attack vector. The vulnerability is not publicly disclosed or known to be exploited.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation can allow an unauthorized attacker to execute code on an affected system. The vulnerability has high confidentiality, integrity, and availability impacts. Attack complexity is low and no privileges are required, although user interaction is necessary.

EXPLOITS: Exploitation is assessed as less likely. Exploit code maturity is Unproven, and the vulnerability is not publicly disclosed or known to be exploited. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-81950 is a double-free vulnerability (CWE-415) affecting Microsoft Excel and related Microsoft Office products. A double-free occurs when memory is freed more than once, potentially resulting in memory corruption that can enable code execution. Exploitation requires an attacker to send a malicious Office file and persuade the user to open it. The attack vector is rated Local with Low attack complexity, no privileges required, and user interaction required. Successful exploitation can result in high impact to confidentiality, integrity, and availability. The Preview Pane cannot be used as an attack vector.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Excel 2016 (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). Exploitation requires a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on affected systems, creating significant confidentiality, integrity, and availability risks. For organizations, a malicious document reaching an employee could become a path to code execution and potentially compromise sensitive information or disrupt operations.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impacts. Attack complexity is low and exploitation requires no privileges, although a user must open a malicious Office file. Organizations should prioritize deployment of the official fix across affected Microsoft Excel and Office installations.

CVE-2026-81953 is a Critical remote code execution vulnerability in Microsoft Excel caused by a stack-based buffer overflow. An attacker can send a specially crafted Office file and convince a user to open it, potentially allowing unauthorized code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker could use a malicious Office file to trigger a stack-based buffer overflow and execute code locally. The attack has low complexity and requires no attacker privileges, but user interaction is required because the targeted user must open the malicious file. The Preview Pane is not an attack vector.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a stack-based buffer overflow, classified as CWE-121, affecting Microsoft Office Excel. A malicious Office file can trigger improper memory handling when opened. The attack vector is local, attack complexity is low, privileges are not required, and user interaction is required. Successful exploitation can execute unauthorized code and has High confidentiality, integrity, and availability impact. Scope remains unchanged.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Microsoft Excel 2016 32-bit and 64-bit, Microsoft Office 2019 32-bit and 64-bit, Microsoft Office LTSC 2021 32-bit and 64-bit, and Microsoft Office LTSC 2024 32-bit and 64-bit. Exploitation requires convincing a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on an affected system, potentially compromising sensitive information, changing data, or disrupting system availability. A malicious document reaching an employee could therefore become an entry point for a serious endpoint compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely and no active exploitation is identified, organizations should prioritize the official fix because exploitation requires no attacker privileges and has low attack complexity.

CVE-2026-81959 is a Critical remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office releases. A heap-based buffer overflow involving integer overflow or wraparound can allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file, but the attacker does not require prior privileges. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker can send a specially crafted Office file and convince a user to open it. Successful exploitation can execute code and has the potential for high impact to confidentiality, integrity, and availability. Attack complexity is rated Low, and no attacker privileges are required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-81959 involves a heap-based buffer overflow and integer overflow or wraparound in Microsoft Office Excel. Processing a malicious Office file can trigger the vulnerability and allow an unauthorized attacker to execute code locally. The attack has Low complexity and requires no existing privileges, although user interaction is required because the victim must open the malicious file. Successful exploitation can have High confidentiality, integrity, and availability impact. The Preview Pane does not trigger the vulnerability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Excel 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Exploitation requires an attacker to convince a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run through a malicious Office document, potentially exposing sensitive information, modifying data, or disrupting affected systems. Organizations where users routinely receive Office documents may face increased exposure to file-based social-engineering attacks.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available. If patching cannot occur immediately, no source-confirmed workaround can be recommended.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is currently assessed as Less Likely and no active exploitation is identified, affected Microsoft 365, Excel, and Office installations should receive the official fix as a priority.

CVE-2026-81949 is a critical remote code execution vulnerability caused by an integer overflow or wraparound in Microsoft Office Excel. An unauthorized attacker can send a specially crafted Office file and convince a user to open it, potentially resulting in code execution. Exploitation requires no privileges but does require user interaction. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker could use a malicious Office file to trigger the vulnerability when a targeted user opens it. Successful exploitation can have a high impact on confidentiality, integrity, and availability. Attack complexity is rated Low, and the attacker requires no privileges.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is caused by an integer overflow or wraparound (CWE-190) in Microsoft Office Excel. A malicious Office file can trigger the vulnerable behavior after a user is convinced to open it, allowing an unauthorized attacker to execute code locally. The attack has low complexity and requires no existing privileges, although user interaction is required. Successful exploitation can result in high confidentiality, integrity, and availability impact. The Preview Pane cannot be used to trigger this vulnerability.

EXPLOITABILITY: Affected software includes 32-bit and 64-bit versions of Microsoft 365 Apps for Enterprise, Microsoft Excel 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires an attacker to deliver a malicious Office file and convince the user to open it.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to execute and cause significant compromise of affected endpoints. With high confidentiality, integrity, and availability impacts, organizations could face exposure or modification of information and disruption of affected systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability carries a Critical severity rating and can lead to remote code execution with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix across affected Microsoft 365, Excel, and Office installations.

CVE-2026-81948 is a critical Microsoft Excel remote code execution vulnerability caused by a heap-based buffer overflow. An unauthorized attacker can send a specially crafted Office file and convince a user to open it, potentially allowing attacker-controlled code to execute locally. No privileges are required, but successful exploitation requires user interaction.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: An attacker could use a malicious Office file to trigger a heap-based buffer overflow and execute code on an affected system. The attack has low complexity and requires no privileges, although the targeted user must open the malicious file. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploitation is assessed as less likely, and exploit code maturity is listed as unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-81948 is a heap-based buffer overflow vulnerability (CWE-122) affecting Microsoft Excel and supported Microsoft Office products listed below. A specially crafted Office file can trigger the memory corruption condition when opened by a user. The attack vector is local, attack complexity is low, privileges are not required, and user interaction is required. Successful exploitation allows code execution locally and can result in high confidentiality, integrity, and availability impact. The Preview Pane is explicitly not an attack vector.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Excel 2016 (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), and Microsoft Office LTSC 2024 (32-bit and 64-bit). Exploitation requires the attacker to send a malicious Office file and convince the user to open it.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on an affected endpoint, creating significant risks to sensitive information, data integrity, and system availability. In an organizational environment, a convincing malicious document could turn normal Office use into a serious endpoint compromise.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is currently identified, affected Microsoft Office and Excel installations should receive the official fix promptly to reduce exposure to malicious Office files.

CVE-2026-73010 is a critical use-after-free vulnerability in Microsoft Windows Failover Cluster. An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires no authentication, privileges, or user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant remote code execution threat because it is network accessible, has low attack complexity, and requires no privileges or user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Failover Cluster. An unauthenticated attacker can send a specially crafted packet to an affected service over the network. Successful exploitation can result in remote code execution on the target system. The attack has low complexity and requires neither privileges nor user interaction. The vulnerability can have a high impact on system confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. An unauthenticated attacker can exploit the flaw remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on vulnerable systems, potentially compromising sensitive information, changing system data, or disrupting availability. For organizations relying on affected Windows systems, a remote compromise could create serious operational and security consequences.

WORKAROUND: No mitigations or workarounds are specified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network-based attack path, low attack complexity, and lack of authentication or user-interaction requirements make timely deployment important, even though exploitation is currently assessed as Less Likely and no exploitation is reported.

CVE-2026-78444 is a critical remote code execution vulnerability in Microsoft Windows Failover Cluster. The issue is caused by an untrusted pointer dereference. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, after successfully winning a race condition, execute code on the target system. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a remote, unauthenticated attacker to execute code on an affected system. The potential impact to confidentiality, integrity, and availability is rated High. Attack complexity is High because exploitation requires winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is an untrusted pointer dereference (CWE-822) in Windows Failover Cluster. An unauthenticated attacker could send a specially crafted packet to an affected service over the network. Successful exploitation requires the attacker to win a race condition, resulting in High attack complexity. If successful, the attacker could execute code on the target system. No privileges or user interaction are required, and the potential confidentiality, integrity, and availability impacts are all High.

EXPLOITABILITY: Affected products include Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, Windows Server 2025, and the listed Server Core installations. Exploitation is assessed as Less Likely and requires a specially crafted network packet and successful race condition.

BUSINESS IMPACT: Successful exploitation could result in unauthorized remote code execution and create serious confidentiality, integrity, and availability risks. For organizations operating affected Windows and Windows Server systems, compromise could enable unauthorized activity on the target system and potentially disrupt critical services.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can be attacked remotely without authentication or user interaction. Although exploitation is assessed as Less Likely and no exploitation is reported, successful exploitation could execute code and have High confidentiality, integrity, and availability impact. The affected systems should therefore receive the applicable official fix as a priority.

CVE-2026-69725 is a Windows Hello elevation-of-privilege vulnerability caused by a double-free weakness. An authorized local attacker who successfully exploits the vulnerability could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires low privileges and no user interaction. The source information contains conflicting attack-complexity statements: the CVSS metrics specify Low, while the FAQ states High and says successful exploitation requires winning a race condition.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker with existing low-privileged local access to gain VTL1 privileges. The CVSS assessment rates confidentiality, integrity, and availability impacts as High, making successful privilege escalation potentially significant for affected Windows systems.

EXPLOITS: The vulnerability is marked as not publicly disclosed and not exploited. Exploit Code Maturity is Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is identified as CWE-415, Double Free, in Windows Hello. A double-free condition occurs when memory is freed more than once, and in this case the weakness can lead to local elevation of privilege. A successful attacker could obtain VTL1 privileges. The CVSS vector specifies a local attack vector, low privileges, and no user interaction, with High confidentiality, integrity, and availability impacts. The accompanying FAQ states that exploitation requires winning a race condition, although its statement that attack complexity is High conflicts with the supplied CVSS vector, which records Attack Complexity as Low.

EXPLOITABILITY: Affected products include Windows 10 versions 21H2 and 22H2 on listed 32-bit, ARM64, and x64 systems, and Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the listed ARM64 and x64 systems. Exploitation is local, requires low privileges and no user interaction, and successful exploitation can provide VTL1 privileges.

BUSINESS IMPACT: This vulnerability could enable an attacker who already has limited local access to gain substantially greater privileges. Successful exploitation carries High confidentiality, integrity, and availability impact ratings, creating risks to sensitive information, system integrity, and operational availability. Privilege escalation can turn an initial foothold into a much more serious security incident.

WORKAROUND: No mitigation or workaround is identified. An official fix is listed, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and affects multiple supported Windows 10 and Windows 11 versions. Although it is not marked as publicly disclosed or exploited and exploit maturity is Unproven, the potential for VTL1 privilege elevation and High impact across confidentiality, integrity, and availability makes prompt deployment important.

CVE-2026-78510 is a critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that can allow an unauthenticated attacker to execute arbitrary code over a network. An attacker can craft a malicious RTF file that triggers the vulnerability when opened or rendered in the Preview Pane. Successful exploitation can compromise confidentiality, integrity, and availability with code executing in the user's context.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, requires no privileges, and requires no user interaction according to its CVSS metrics. Successful exploitation can result in arbitrary code execution in the user's context, with high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-78510 is caused by a heap-based buffer overflow in Microsoft Office Outlook. An unauthenticated attacker can craft a malicious RTF file that triggers the vulnerability. The malicious content can execute when the file is opened or when it is rendered in the Outlook Preview Pane, which is explicitly identified as an attack vector. Successful exploitation allows arbitrary code execution in the user's context and can cause high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019, LTSC 2021, and LTSC 2024 for 32-bit and 64-bit editions; and Microsoft Word 2016 32-bit and 64-bit editions. Exploitation can occur through a crafted malicious RTF file opened or rendered in the Preview Pane.

BUSINESS IMPACT: Successful exploitation could allow arbitrary attacker-controlled code to run in a user's context, creating significant risk to organizational systems and information. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, permit unauthorized changes, and disrupt affected systems.

WORKAROUND: No mitigations or workarounds are specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of required privileges or user interaction, and ability to execute arbitrary code make timely deployment important, even though exploitation is currently assessed as Less Likely and is not reported as active.

CVE-2026-78520 is a Microsoft Office Outlook vulnerability caused by an out-of-bounds read. An unauthorized remote attacker can target the vulnerability over a network, and exploitation requires user interaction. Microsoft confirms that the Outlook Preview Pane is an attack vector. Successful exploitation could allow an attacker to read small portions of heap memory, potentially exposing sensitive information stored in memory.

CVSS Score: 6.5

SEVERITY: Critical

THREAT: The vulnerability creates a remote information disclosure risk in Microsoft Office Outlook. An attacker does not require privileges and can deliver malicious content over a network. Because the Preview Pane is an attack vector, users may be exposed while previewing a specially crafted Outlook item rather than deliberately opening it.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm the existence of public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-78520 is caused by an out-of-bounds read in Microsoft Office Outlook. The flaw can cause Outlook to access memory outside the intended buffer boundary when processing specially crafted content. An unauthorized attacker can target the issue remotely over a network without requiring existing privileges, although user interaction is required. Microsoft confirms that the Preview Pane can trigger the vulnerability. Successful exploitation could allow the attacker to read small portions of heap memory. The CVSS v3.1 metrics indicate a high confidentiality impact, with no confirmed integrity or availability impact. The supplied data labels the overall impact as Remote Code Execution, while the FAQ specifically confirms disclosure of heap memory.

EXPLOITABILITY: The affected Microsoft product is Microsoft Office Outlook. Microsoft Office LTSC for Mac 2021 and 2024 are also identified in the available information, but their security updates were not immediately available at the time of release. Specific affected Outlook versions beyond this cannot be confirmed from the available data. The attack can be delivered remotely and requires user interaction, with the Outlook Preview Pane confirmed as an attack vector.

BUSINESS IMPACT: Successful exploitation could expose portions of Outlook process memory containing sensitive information. Depending on what is present in memory at the time of exploitation, this could contribute to disclosure of confidential business data or other information useful for follow-on attacks. The Preview Pane attack path increases concern because malicious content may be processed during ordinary email review.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. Organizations should deploy available Outlook security updates and apply the corresponding updates for Microsoft Office LTSC for Mac 2021 and 2024 once they become available.

URGENCY: This vulnerability is rated Critical and can be targeted remotely without requiring attacker privileges. Although Microsoft reports no active exploitation and assesses exploitation as less likely, the Outlook Preview Pane is a confirmed attack vector and successful exploitation could expose sensitive heap memory. Organizations should prioritize patching affected Outlook installations, particularly systems that routinely process untrusted external email.

CVE-2026-78525 is a Critical remote code execution vulnerability caused by a use-after-free weakness (CWE-416) in Microsoft Office Outlook. An unauthorized attacker can send a specially crafted email, and exploitation may occur when the victim opens the email using an affected Outlook version or when Outlook displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: A specially crafted email can expose affected systems to remote code execution. The email-based attack path is particularly significant because displaying a malicious message in Outlook's preview may be sufficient to trigger exploitation.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Its exploitability assessment is “Exploitation Less Likely.” No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is a use-after-free weakness (CWE-416) in Microsoft Office Outlook. A use-after-free condition involves software incorrectly using memory after it has been released. In the documented email attack scenario, an unauthorized attacker sends a specially crafted email to a victim. Exploitation might occur when the victim opens that email with an affected version of Microsoft Outlook or when Outlook displays a preview of the crafted message. Successful exploitation can result in remote code execution on the victim’s machine.

EXPLOITABILITY: Affected software listed includes Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Microsoft Office LTSC 2021 (32-bit and 64-bit), Microsoft Office LTSC 2024 (32-bit and 64-bit), and Microsoft Word 2016 (32-bit and 64-bit). The attack can involve opening or previewing a specially crafted email. More specific affected Outlook versions cannot be confirmed from the source data.

BUSINESS IMPACT: Successful exploitation could allow remote code execution on a victim’s machine, creating a serious risk to affected organizational endpoints. A malicious email could become the entry point for executing attacker-controlled code, with potential consequences for the systems and information accessible from the compromised machine.

WORKAROUND: No workaround or mitigation is specified in the source data. Where the patch cannot be applied, no alternative mitigation can be confirmed without adding information absent from the source.

URGENCY: This vulnerability carries a Critical severity rating and can lead to remote code execution through a specially crafted email. Although exploitation is assessed as less likely and no active exploitation is reported, affected Microsoft Office deployments should be prioritized for patching because opening or previewing malicious email may result in attacker-controlled code executing on a victim’s machine.

CVE-2026-77493 is a critical remote code execution vulnerability caused by a double-free memory handling issue in Microsoft Office Outlook. An attacker can send a specially crafted email to a target, and simply viewing that message in the Outlook Reading Pane can trigger the vulnerability. Successful exploitation could allow attacker-controlled code to execute on the recipient's system. The affected Microsoft product is identified as Microsoft Office Outlook; the affected-software table specifically lists supported Windows client and Windows Server versions.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An unauthorized network attacker can target Outlook with a specially crafted email. Attack complexity is low, privileges are not required, and user interaction is not required. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitation assessment is “Exploitation Less Likely.” No confirmed public exploit, zero-day exploitation, or proof-of-concept code is identified.

TECHNICAL SUMMARY: CVE-2026-77493 is a CWE-415 double-free vulnerability in Microsoft Office Outlook. A double free occurs when memory is freed more than once, potentially creating memory corruption that can be leveraged for unintended code execution. An attacker can deliver a specially crafted email over the network. The vulnerability can be triggered when the email is displayed in the Outlook Reading Pane, without requiring the recipient to open the message or click its contents. Successful exploitation can result in remote code execution on the recipient's system, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software listed includes Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations. A specially crafted email viewed in the Outlook Reading Pane can trigger exploitation over the network without authentication or user interaction.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected systems, potentially compromising sensitive information, changing data, or disrupting system availability. Because a malicious email can trigger the flaw through the Reading Pane without requiring a click, normal email viewing could become an entry point for system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of required privileges, and lack of required user interaction make prompt deployment important, even though exploitation is currently assessed as less likely and no exploitation is identified.

CVE-2026-78519 is a critical remote code execution vulnerability in Microsoft Office Outlook caused by the use of an uninitialized resource. An unauthorized attacker can send a specially crafted email to a victim, and exploitation may occur when the victim opens the email or when an affected Outlook application displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can target affected Outlook users remotely with a specially crafted email. Successful exploitation could execute attacker-controlled code on the victim’s machine, making malicious email a direct route to system compromise.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Its exploitation assessment is “Exploitation Less Likely.” No zero-day exploitation or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is associated with CWE-908, Use of Uninitialized Resource, in Microsoft Office Outlook. An unauthorized attacker can exploit the flaw over a network by sending a specially crafted email. Exploitation may involve a victim opening the malicious email with an affected version of Outlook or Outlook displaying a preview of that email. Successful exploitation could result in remote code execution on the victim’s machine. The source does not specify the privileges or user interaction requirements beyond these email-based scenarios.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019, LTSC 2021, and LTSC 2024 in 32-bit and 64-bit editions; and Microsoft Outlook 2016 in 32-bit and 64-bit editions. The attack can use a specially crafted email that is opened or displayed in Outlook preview.

BUSINESS IMPACT: Successful remote code execution could allow malicious code to run on an employee’s machine, potentially compromising the endpoint and information accessible from it. For organizations, a crafted email that reaches an affected Outlook environment creates a serious security risk because normal email handling can become an avenue for code execution.

WORKAROUND: No workaround or mitigation is specified. Organizations unable to apply the patch cannot rely on a confirmed vendor workaround for this vulnerability.

URGENCY: This vulnerability carries a Critical severity rating and can result in remote code execution through a specially crafted email. Although exploitation is assessed as less likely and no active exploitation is reported, affected Outlook and Office installations should be prioritized for patching because successful exploitation could execute remote code on a victim’s machine.

CVE-2026-77898 is a critical heap-based buffer overflow vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code over a network. Exploitation requires no privileges but does require user interaction and has high attack complexity. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability creates a remote code execution threat through a heap-based buffer overflow in Microsoft Office PowerPoint. An attacker needs no existing privileges, although successful exploitation requires user interaction and a deep understanding of the target system. Attack complexity is rated High, and exploitation may depend on factors such as system configuration, environment, and existing security measures.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-77898 is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office PowerPoint. The flaw can allow an unauthorized network-based attacker to execute code. The CVSS metrics indicate that no privileges are required, but user interaction is required and attack complexity is High. Successful exploitation is not guaranteed and can depend on the target environment, system configuration, and additional security controls. A successful attack can have a High impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Microsoft Office 2019, Office LTSC 2021, Office LTSC 2024, and Microsoft PowerPoint 2016. Exploitation is network-based, requires no privileges, requires user interaction, and has High attack complexity.

BUSINESS IMPACT: Successful exploitation could allow remote code execution and significantly affect the confidentiality, integrity, and availability of business systems and information. This creates the potential for unauthorized activity, data exposure or modification, and disruption of affected systems. “One successful exploit can turn a PowerPoint vulnerability into a serious business security incident.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation. Fixed-build information is unknown or not specified for the affected products.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with High confidentiality, integrity, and availability impact. Although exploitation is assessed as Less Likely, is not publicly disclosed, and is not reported as exploited, affected Microsoft Office and PowerPoint installations should be prioritized for deployment of the official fix because no workaround or mitigation is identified.

A use-after-free vulnerability in Microsoft Office PowerPoint could allow an unauthorized attacker to execute code by sending a specially crafted presentation. Exploitation can occur when a user opens the malicious file or it is rendered in a preview pane. The vulnerability requires no attacker privileges but does require user interaction. It is not publicly disclosed and is not reported as exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could deliver a specially crafted PowerPoint presentation that triggers the vulnerability when opened or rendered in a preview pane. Successful exploitation could execute code in the user's context, with potentially high impact to confidentiality, integrity, and availability.

EXPLOITS: No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is rated Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69632 is a use-after-free vulnerability, classified as CWE-416, in Microsoft Office PowerPoint. The flaw involves improper use of memory after it has been freed. An attacker can craft a presentation designed to trigger this condition and send it to a target. Opening the file or rendering it in a preview pane can potentially trigger remote code execution in the user's context. The attack has network attack vector, low attack complexity, requires no attacker privileges, and requires user interaction. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2019 (32-bit and 64-bit), Office LTSC 2021 (32-bit and 64-bit), Office LTSC 2024 (32-bit and 64-bit), and Microsoft PowerPoint 2016 (32-bit and 64-bit). Exploitation requires the malicious presentation to be opened or rendered in a preview pane.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run in the targeted user's context. This creates risks to sensitive information, data integrity, and system availability. A malicious presentation sent through normal business communication could therefore become a path to compromise.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its low attack complexity, lack of required attacker privileges, and potential for remote code execution make prompt deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.

CVE-2026-73017 is a Critical heap-based buffer overflow vulnerability in the Windows Graphics Kernel. An authorized local attacker with high privileges could manipulate system components to trigger the flaw and execute code. Exploitation requires high attack complexity but no user interaction.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability can result in remote code execution impact after successful local exploitation. The CVSS assessment rates potential confidentiality, integrity, and availability impact as High, with scope changed. An attacker requires high privileges and must overcome high attack complexity.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-73017 is caused by a heap-based buffer overflow (CWE-122) in the Windows Graphics Kernel. Successful exploitation requires an authorized attacker with high privileges to operate locally and manipulate system components to trigger a specific condition. Attack complexity is High, meaning exploitation depends on factors such as the environment and system configuration and is not guaranteed. If successful, the vulnerability allows code execution and can have High impact on confidentiality, integrity, and availability. No user interaction is required.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. A local attacker needs high privileges and high attack complexity to exploit the vulnerability.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code execution and compromise sensitive information, system integrity, and service availability. On affected business systems and servers, this could increase the impact of an attacker who has already obtained significant local privileges.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical and has High potential impact across confidentiality, integrity, and availability. Although exploitation is assessed as Less Likely, is not publicly disclosed, and is not known to be exploited, affected Windows systems should receive the official security update according to the organization's priority deployment process.

CVE-2026-78509 is a Critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that could allow an unauthorized remote attacker to execute code on a target system. An attacker can send a specially crafted email, and simply viewing it in the Outlook Reading Pane can trigger the vulnerability without opening the message or clicking anything. The CVSS base score is 9.8, and exploitation requires neither authentication nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker could remotely deliver a specially crafted email that triggers a heap-based buffer overflow when Outlook processes the message. The vulnerability has network reachability, low attack complexity, requires no privileges or user interaction, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm a public exploit, zero-day exploitation, or publicly available proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-78509 is caused by a heap-based buffer overflow in Microsoft Office Outlook. A remote, unauthorized attacker can exploit the flaw by sending a specially crafted email to a target user. The Outlook Reading Pane is an attack vector, meaning processing the malicious message there can trigger the vulnerability without the recipient opening the email or clicking content. Network access is required, but authentication, privileges, and user interaction are not. Successful exploitation can execute code on the recipient's system and can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected software includes Microsoft 365 Apps for Enterprise for 32-bit and 64-bit systems; Microsoft Office 2019 for 32-bit and 64-bit editions; Microsoft Office LTSC 2021 and LTSC 2024 for 32-bit and 64-bit editions; and Microsoft Word 2016 for 32-bit and 64-bit editions. A specially crafted email can trigger exploitation through the Outlook Reading Pane.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on employee systems, putting sensitive information, system integrity, and system availability at risk. Because a malicious email can trigger the flaw without a click or other user interaction, normal user caution alone may not prevent an attack.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of privilege and user-interaction requirements, and potential for remote code execution make timely deployment important. Although exploitation is currently assessed as Less Likely and no exploitation is confirmed, affected systems should be prioritized for the official fix.

CVE-2026-73009 is a critical use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The primary threat is unauthenticated remote code execution over the network. Successful exploitation can have a high impact on confidentiality, integrity, and availability, creating the potential for system compromise without requiring credentials or action from a user.

EXPLOITS: The vulnerability is assessed as “Exploitation Less Likely.” It is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in Windows Secure Socket Tunneling Protocol (SSTP). An unauthenticated attacker can target an affected service over the network by sending a specially crafted packet. If exploitation succeeds, the attacker can execute code on the target system. The CVSS metrics identify a network attack vector, low attack complexity, no privileges required, no user interaction, and unchanged scope. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and supported architectures shown in the affected software list. Exploitation can occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on vulnerable Windows systems, potentially compromising sensitive information, system integrity, and service availability. Because neither authentication nor user interaction is required, exposed affected services can present a serious organizational risk. “No credentials and no user action means the vulnerable service itself can become the attack path.”

WORKAROUND: No workaround or mitigation is identified. An official fix is listed, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and supports network-based remote code execution with low attack complexity. No privileges or user interaction are required. Although exploitation is assessed as less likely and no exploitation is currently identified, the potential impact makes timely deployment of the applicable security update important.

A use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthorized remote attacker to execute code on an affected Windows system. Exploitation requires sending a specially crafted packet to an affected service and successfully winning a race condition. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: An unauthenticated attacker could target an affected RMCAST service over the network with a specially crafted packet. Successful exploitation could result in remote code execution with high impact to confidentiality, integrity, and availability. Attack complexity is high because exploitation requires winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept (PoC) exploit code.

TECHNICAL SUMMARY: CVE-2026-78450 is a use-after-free vulnerability (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker can send a specially crafted network packet to an affected service and attempt to trigger the memory-management flaw. Successful exploitation requires winning a race condition, resulting in high attack complexity. If successful, the vulnerability allows code execution on the target system and can have high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products are Windows 10 Version 1809 for 32-bit and x64-based systems, Windows Server 2019, Windows Server 2022, and Windows Server 2025, including the listed Server Core installations. Exploitation is assessed as less likely and requires a specially crafted network packet and successful race condition. No privileges or user interaction are required.

BUSINESS IMPACT: Successful exploitation could enable unauthorized remote code execution, potentially compromising sensitive information, system integrity, and service availability. For organizations running affected Windows systems, a successful attack could lead to system compromise and operational disruption.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can allow unauthenticated remote code execution without user interaction. Although exploitation is assessed as less likely and no exploitation is currently identified, affected systems should be prioritized for deployment of the official fix because successful exploitation could have high confidentiality, integrity, and availability impacts.

CVE-2026-83939 is a Critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an untrusted pointer dereference. An authorized attacker who already has kernel-level access can submit a specially crafted Code Integrity policy to an affected system. Successful exploitation can allow code execution in Virtual Trust Level 1 (VTL1), with high potential impact to confidentiality, integrity, and availability.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability creates a path for an attacker with existing kernel-level access to cross into VTL1. Attack complexity is low, although exploitation requires local access and high privileges. No user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in Windows Secure Kernel Mode. An attacker who already has kernel-level access could submit a specially crafted Code Integrity policy to the affected system. Successful exploitation allows the attacker to execute code in Virtual Trust Level 1 (VTL1). The vulnerability has a changed scope and can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Windows 11 Version 26H1 for ARM64-based systems and Windows 11 Version 26H1 for x64-based systems. Exploitation requires local access, low attack complexity, and high privileges, with no user interaction. An attacker with kernel-level access could exploit the flaw using a specially crafted Code Integrity policy.

BUSINESS IMPACT: Successful exploitation could give an attacker VTL1 privileges, increasing the impact of an already privileged compromise. This could expose sensitive information, undermine system integrity, and affect system availability. The ability to cross this security boundary makes the vulnerability particularly significant on compromised Windows endpoints.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impact. Organizations should prioritize deployment of the official fix to affected Windows 11 Version 26H1 systems, particularly where protection against privilege escalation is important.

CVE-2026-58599 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Windows Codecs Library. An unauthorized attacker can execute code locally by exploiting the flaw. Exploitation requires user interaction, but no privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a risk of arbitrary code execution through unsafe memory handling. Its low attack complexity and lack of privilege requirements increase the potential impact when the required user interaction occurs. Successful exploitation could compromise data confidentiality and integrity and disrupt system availability.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven; the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-58599 is a CWE-122 heap-based buffer overflow affecting the Microsoft Windows Codecs Library and HEVC Video Extensions. Improper handling of memory can allow an unauthorized attacker to trigger memory corruption and execute code locally. Attack complexity is low, no privileges are required, and user interaction is required. The security impact is rated High for confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, and Device Manufacturer editions on listed Windows 10 1809, 21H2, and 22H2 systems; Windows 11 23H2, 24H2, 25H2, and 26H1 systems; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires local attack conditions and user interaction but does not require privileges.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code execution and lead to loss of sensitive information, unauthorized modification of data, or disruption of affected systems. For organizations with vulnerable HEVC components deployed across endpoints or servers, a successful attack could turn media-processing functionality into a path for system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the HEVC package version can be checked with PowerShell using `Get-AppxPackage -Name Microsoft.HEVCVideoExtension*`.

URGENCY: This vulnerability is rated Critical and can result in code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as less likely and no exploitation is reported, affected HEVC components should be updated promptly because there is no documented workaround or mitigation.

CVE-2026-81352 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Windows Codecs Library and affecting Web Media Extensions. An unauthorized attacker can target the vulnerability over a network. Exploitation requires user interaction but does not require attacker privileges. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. User interaction is required. Successful exploitation could allow remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and the exploitability assessment is Exploitation Unlikely.

TECHNICAL SUMMARY: CVE-2026-81352 is a heap-based buffer overflow, classified as CWE-122, in the Microsoft Windows Codecs Library. The flaw can be reached over a network with low attack complexity and without prior privileges, although user interaction is required. Successful exploitation allows an unauthorized attacker to execute code and can significantly affect the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Web Media Extensions is affected; specific affected versions and the fixed build cannot be confirmed. Exploitation can occur over a network with low complexity and no privileges, but requires user interaction.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to exposure of sensitive information, unauthorized modification of data or systems, and disruption of affected services. The combination of remote reachability and high confidentiality, integrity, and availability impact makes this a significant organizational risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and carries a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of privilege requirements, and potential for high confidentiality, integrity, and availability impact make prompt deployment important, even though exploitation is currently assessed as unlikely.

CVE-2026-69601 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Microsoft Windows Media Foundation. An unauthorized attacker can target the vulnerability over a network, but successful exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation could allow attacker-controlled code to execute on an affected Windows system.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. User interaction is required to trigger exploitation. Successful remote code execution could result in high impact to confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a heap-based buffer overflow, identified as CWE-122, in Microsoft Windows Media Foundation. An unauthorized attacker can exploit the issue over a network by getting a user to open a specially crafted file. Processing that file can trigger the memory corruption condition and lead to remote code execution. The attack complexity is low, no privileges are required, and the scope remains unchanged. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected Windows systems, creating significant risk to sensitive information, system integrity, and service availability. In an organizational environment, compromise of vulnerable endpoints or servers could disrupt business operations and expose systems or information accessible from the affected machine.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution. Although it is not reported as exploited or publicly disclosed, its low attack complexity, network attack vector, and lack of required privileges make timely deployment important. Prioritize the applicable security updates across affected Windows endpoints and servers.

CVE-2026-70203 is a critical heap-based buffer overflow vulnerability in Windows Media Player. An unauthorized attacker can attempt exploitation by convincing a user to open a specially crafted media file. Processing that file can cause memory corruption and potentially allow attacker-controlled code to execute on the affected system. The vulnerability is not publicly disclosed and is not reported as exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, requires no privileges, and requires user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability. An attacker must convince a user to open a specially crafted media file before the vulnerable component processes it.

EXPLOITS: Exploitation is assessed as less likely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is listed as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-70203 is caused by a heap-based buffer overflow in Windows Media Player. An attacker can create a specially crafted media file and convince a user to open it. When the vulnerable component processes the file, improper memory handling can result in memory corruption. Successful exploitation may allow code to execute on the affected Windows system. The CVSS metrics identify network access, low attack complexity, no privileges required, required user interaction, unchanged scope, and high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Architectures vary by release. Exploitation requires a user to open a specially crafted media file; no privileges are required.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on an affected system, creating significant confidentiality, integrity, and availability risks. For organizations, a convincing malicious media file could lead to system compromise and expose sensitive information or enable unauthorized changes and disruption. “A single malicious media file could become the entry point for a high-impact system compromise.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, so affected systems should receive the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with no privileges required. Although exploitation is assessed as less likely and no exploitation is reported, the high potential impact makes timely deployment important across affected Windows endpoints and servers.

CVE-2026-72960 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Media Player. An unauthorized attacker can exploit the issue over a network by convincing a user to open a specially crafted file. Successful exploitation can allow attacker-controlled code to execute on the affected system. No privileges are required, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability. The attack still requires user interaction because the targeted user must open a specially crafted file.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and the exploitation assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72960 is a heap-based buffer overflow, identified as CWE-122, affecting Windows Media Player. An attacker can prepare a specially crafted file and cause remote code execution when a user opens it. The attack vector is network-based, attack complexity is low, and no privileges are required, although user interaction is necessary. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. An attacker must get a user to open a specially crafted file to trigger remote code execution.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and create serious confidentiality, integrity, and availability risks. For organizations, a malicious file reaching a user could result in compromise of an affected Windows system and disruption to business operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation, and affected systems require a restart.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for high confidentiality, integrity, and availability impact make timely deployment important. Exploitation still requires a user to open a specially crafted file.

CVE-2026-69579 is a critical use-after-free vulnerability in Windows Message Queuing. An unauthorized, unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires low attack complexity, no privileges, and no user interaction. It is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target an affected Windows Message Queuing service remotely with a specially crafted network packet. Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability. The network-based attack path, low complexity, and lack of authentication requirements make this a significant security threat.

EXPLOITS: No exploitation is currently reported, and the vulnerability is not publicly disclosed. Exploit Code Maturity is listed as Unproven, and exploitation is assessed as Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-69579 is caused by a use-after-free weakness (CWE-416) in Windows Message Queuing. A use-after-free condition occurs when software continues to use memory after it has been released. For this vulnerability, an unauthenticated attacker can send a specially crafted packet over the network to an affected service and trigger the flaw. Successful exploitation can allow code execution on the target system. The CVSS metrics rate confidentiality, integrity, and availability impacts as High, with a Network attack vector, Low attack complexity, no required privileges, and no required user interaction.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. An unauthenticated attacker can exploit the vulnerability by sending a specially crafted packet to an affected service over the network.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause serious compromise of affected Windows endpoints or servers. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, enable unauthorized changes, and disrupt business services. The absence of authentication and user-interaction requirements increases the potential organizational risk.

WORKAROUND: No workaround or mitigation is identified. The official fix should be applied to affected systems.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and can be attacked remotely without authentication or user interaction. Although exploitation is currently assessed as Unlikely and no exploitation is reported, the potential for remote code execution and high impact across confidentiality, integrity, and availability makes timely deployment of the official security update important.

CVE-2026-67636 is a critical remote code execution vulnerability in Microsoft SQL Server caused by an out-of-bounds read. An authenticated attacker with low privileges could connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers a memory corruption condition. Successful exploitation could allow code execution on the server and result in high confidentiality, integrity, and availability impact. Exploitation requires specific conditions because attack complexity is high, and no user interaction is required.

CVSS SCORE: 8.5.

SEVERITY: Critical.

THREAT: An authorized attacker could target a vulnerable SQL Server remotely and attempt to trigger memory corruption through a specially crafted query or request. Successful exploitation could lead to remote code execution with high impact to the confidentiality, integrity, and availability of the affected system.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. The exploitability assessment is Exploitation Unlikely, and exploit code maturity is Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-67636 is an out-of-bounds read vulnerability, classified as CWE-125, in Microsoft SQL Server. An authenticated attacker can connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers a memory corruption condition. Successful exploitation can result in remote code execution. Attack complexity is high because particular protocol settings, configurations, or other specific conditions must be present for an attack to succeed. Authentication and low privileges are required, but user interaction is not required. The vulnerability has changed scope and carries high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2019 x64 (CU 32 and GDR), SQL Server 2022 x64 (CU 26 and GDR), and SQL Server 2025 x64 (CU8 and GDR). An authenticated, low-privileged attacker could exploit the issue over the network using a specially crafted query or request under the required conditions.

BUSINESS IMPACT: Successful exploitation could allow an attacker with authorized SQL Server access to execute code remotely, potentially compromising sensitive information, changing data, and disrupting database availability. For organizations that depend on SQL Server for critical applications and business data, server compromise could lead to significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected SQL Server updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no exploitation is currently identified, affected SQL Server installations should be prioritized for patching because no workaround or mitigation is identified.

An integer overflow or wraparound in the Microsoft WebP Image Extension can lead to a heap-based buffer overflow and remote code execution. An unauthorized attacker can target the vulnerability over a network, but exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could craft a malicious file designed to trigger the memory corruption vulnerability. If a user opens that file, the attacker could execute code in the affected context. The attack complexity is low, requires no privileges, and can result in significant compromise of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-70351 is a remote code execution vulnerability in Microsoft WebP Image Extension involving integer overflow or wraparound and a heap-based buffer overflow. A specially crafted file can trigger the flaw when opened by a user. The attack vector is network-based, attack complexity is low, and no attacker privileges are required. Successful exploitation could execute code and cause high confidentiality, integrity, and availability impact. An official fix is identified.

EXPLOITABILITY: Microsoft WebP Image Extension is affected. Specific affected version or build numbers cannot be confirmed. Exploitation requires a user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to loss of sensitive information, unauthorized system changes, or disruption of affected systems. For organizations, a malicious file reaching a user could become an entry point for a serious endpoint compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified, but the fixed build cannot be confirmed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution with no attacker privileges required. Although exploitation is currently assessed as Unlikely and user interaction is required, the potential impact to confidentiality, integrity, and availability makes timely deployment important.

CVE-2026-70586 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Paint. An unauthorized attacker can trigger the vulnerability by convincing a user to open a specially crafted file. The attack requires no privileges but does require user interaction. Successful exploitation can execute code and has a high potential impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation could allow unauthorized code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is assessed as Exploitation Unlikely. It is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-70586 is a heap-based buffer overflow (CWE-122) affecting Windows Paint. The flaw can be triggered when a user opens a specially crafted attacker-controlled file. The vulnerability has network attack vector characteristics, low attack complexity, requires no privileges, and requires user interaction. Successful exploitation enables remote code execution and can result in high impact to the confidentiality, integrity, and availability of the affected system. An official fix is identified for this vulnerability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable architectures. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on an affected system, potentially compromising sensitive information, altering data, or disrupting system availability. Because no attacker privileges are required and the technical impact is high across confidentiality, integrity, and availability, a successful attack could create significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, so affected systems should be updated through the applicable security patch where possible.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Although exploitation is assessed as unlikely and no active exploitation is identified, the low attack complexity, lack of required privileges, and high confidentiality, integrity, and availability impacts make timely deployment important.

A critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthenticated attacker to execute code remotely. Exploitation requires winning a race condition, which increases attack complexity, but a successful attack could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: An attacker can target an affected RMCAST service over the network with a specially crafted packet. Successful exploitation could result in remote code execution on the target system. The attack requires no privileges and no user interaction, although successful exploitation depends on winning a race condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and attempt to trigger a race condition. If successful, the attacker could execute code on the target system. The CVSS metrics identify high potential impact to confidentiality, integrity, and availability, with network-based access, no required privileges, and no required user interaction.

EXPLOITABILITY: Affected products are Windows 10 Version 1809 for 32-bit and x64-based systems; Windows Server 2019, 2022, and 2025, including their Server Core installations. Exploitation can occur remotely by sending a specially crafted packet to an affected service, but the attacker must successfully win a race condition.

BUSINESS IMPACT: Successful exploitation could give an unauthenticated remote attacker the ability to execute code on affected Windows systems. This creates significant risk to the confidentiality, integrity, and availability of business systems and data, particularly where affected services are reachable over a network.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and enables network-based remote code execution without authentication or user interaction. Although exploitation is assessed as Less Likely and requires winning a race condition, affected systems should be prioritized for patch deployment because successful exploitation could have high confidentiality, integrity, and availability impacts.

CVE-2026-78449 is a critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation is considered less likely because attack complexity is high and successful exploitation depends on multiple environmental and system factors.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability creates a network-based remote code execution threat affecting multiple Windows client and server releases. A successful attack could have a high impact on confidentiality, integrity, and availability. No privileges or user interaction are required, although successful exploitation requires high attack complexity.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free weakness (CWE-416) in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially trigger the memory-management flaw, resulting in remote code execution. The CVSS metrics indicate a network attack vector, no privileges required, no user interaction, unchanged scope, and high potential impact to confidentiality, integrity, and availability. Exploitation has high complexity and requires a deep understanding of the system; success can depend on system configuration, environment, and additional security measures.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including listed Server Core installations and supported architectures shown in the source. Exploitation could occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and severely affect the confidentiality, integrity, and availability of an affected Windows system. For organizations, compromise of exposed or reachable systems could lead to unauthorized activity, data exposure or modification, and service disruption.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can potentially allow remote code execution across affected Windows clients and servers without authentication or user interaction. Although exploitation is assessed as less likely and no exploitation is reported, the high potential impact makes timely deployment of the official security update important.

CVE-2026-65669 is an elevation-of-privilege vulnerability involving improper neutralization of special elements in output used by a downstream component. An unauthorized attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and access or modify database data with the connected user's permissions.

CVSS SCORE: 9.6.

SEVERITY: Critical.

THREAT: The vulnerability can be reached over a network, has low attack complexity, and requires no attacker privileges. User interaction is required for exploitation. A successful attack can have a high impact on confidentiality, integrity, and availability, with the security scope changing as part of exploitation.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-65669 is caused by improper neutralization of special elements in output used by a downstream component, categorized as CWE-74 injection. An attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and cause database operations to occur using the connected user's permissions. This may allow unauthorized access to or modification of database data. The attack vector is network-based, attack complexity is low, no attacker privileges are required, and user interaction is required.

EXPLOITABILITY: SQL Server Management Studio 22 is affected. Exploitation requires an attacker to convince a user to submit specially crafted instructions to SQL Copilot. No attacker privileges are required, but user interaction is necessary.

BUSINESS IMPACT: Successful exploitation could undermine database access controls and expose organizations to unauthorized data access or modification. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could affect sensitive information, business-critical records, and the reliability of database-backed operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.6. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for high confidentiality, integrity, and availability impact make prompt deployment of the official fix important, even though exploitation is currently assessed as Less Likely.

CVE-2026-67631 is a critical heap-based buffer overflow vulnerability in Microsoft SQL Server. An authenticated attacker with low privileges can connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers memory corruption, potentially allowing code execution on the server. No user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute code remotely on an affected SQL Server. The vulnerability has low attack complexity and can be reached over the network with low privileges. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is listed as Unproven, and the exploitability assessment is Exploitation Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-67631 is caused by a heap-based buffer overflow (CWE-122) in Microsoft SQL Server. An authenticated attacker can connect to an affected SQL Server and send a specially crafted query or request that triggers a memory corruption condition. The attack can be performed over the network with low attack complexity and requires low privileges but no user interaction. Successful exploitation can allow the attacker to execute code on the server, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2017 for x64-based Systems (CU 31 and GDR), SQL Server 2019 (CU 32 and GDR), SQL Server 2022 (CU 26 and GDR), and SQL Server 2025 (CU8 and GDR). Exploitation requires an authenticated attacker with low privileges to submit a specially crafted query or request over the network. No user interaction is required.

BUSINESS IMPACT: Remote code execution on a database server can put sensitive business information and critical database services at risk. Successful exploitation could compromise data confidentiality and integrity or disrupt SQL Server availability. For organizations that depend on SQL Server for important applications and business processes, compromise of a database server could have significant operational consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected SQL Server installations should be updated where operationally possible.

URGENCY: This vulnerability is rated Critical and can lead to remote code execution over the network with low attack complexity. Although exploitation is assessed as less likely and no active exploitation is reported, affected SQL Server systems should be prioritized for deployment of the official fix because successful exploitation can have high confidentiality, integrity, and availability impact.

CVE-2026-72982 is a critical stack-based buffer overflow vulnerability in Windows Netlogon. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires no privileges or user interaction and can result in high impact to confidentiality, integrity, and availability.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: An attacker can target the vulnerable Netlogon service remotely over the network. Attack complexity is low, and successful exploitation can allow remote code execution with high confidentiality, integrity, and availability impact. No authentication or user interaction is required.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as Unproven, and the exploitation assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a stack-based buffer overflow (CWE-121) in Windows Netlogon. An unauthenticated remote attacker could send a specially crafted packet to an affected service over the network. Successful exploitation could trigger the memory corruption condition and allow the attacker to execute code on the target system. The attack has low complexity, requires no privileges, requires no user interaction, and does not change security scope. Successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation can occur remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on an affected Windows system. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized changes, and disrupt system availability. The lack of authentication and user interaction significantly reduces the barriers an attacker must overcome.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, so affected systems should be updated using their applicable security update.

URGENCY: This vulnerability carries a Critical severity and a CVSS base score of 9.8. Its network attack vector, low attack complexity, lack of authentication, and lack of user interaction create a serious remote-code-execution risk. Although exploitation is currently assessed as unlikely and no active exploitation is identified, affected systems should be prioritized for deployment of the official fix.

CVE-2026-77505 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker with network access could send specially timed DNS queries to a DNS server configured with a server-level DNS plug-in and attempt to trigger a race condition. Successful exploitation could result in remote code execution with SYSTEM privileges. The vulnerability is not publicly disclosed and is not currently reported as exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability presents a remote code execution threat to affected Windows systems running the relevant DNS Server configuration. An attacker does not require authentication, privileges, or user interaction. Exploitation has high complexity because the attacker must successfully win a timing-dependent race condition. A successful attack could compromise confidentiality, integrity, and availability.

EXPLOITS: Exploitation is assessed as less likely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven; the existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-77505 is caused by a use-after-free weakness (CWE-416) in Windows DNS Server. An unauthenticated attacker could send DNS queries over the network to a Windows DNS Server configured with a server-level DNS plug-in. By winning a timing-dependent race condition in the server's record-handling logic, the attacker could cause the server to operate on memory after it has been freed. Successful exploitation could allow attacker-controlled code to execute with SYSTEM privileges. Attack complexity is rated High because exploitation depends on winning this race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires network access but no privileges or user interaction. The target DNS Server must be configured with a server-level DNS plug-in.

BUSINESS IMPACT: Successful exploitation could give an attacker SYSTEM-level code execution on a vulnerable DNS server, creating serious confidentiality, integrity, and availability risks. Compromise of infrastructure providing DNS services could affect critical business operations and expose the affected server to unauthorized control. *“When a DNS server falls at SYSTEM privilege, a core infrastructure service can become a high-impact point of compromise.”*

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and enables remote code execution with SYSTEM privileges if successfully exploited. Although exploitation is assessed as less likely and is not currently reported, affected DNS servers should be prioritized for deployment of the official fix because successful exploitation could result in a high-impact server compromise.

Spring Cloud Azure contains an improper authentication vulnerability that could allow an unauthenticated attacker to elevate privileges over a network. In an affected multi-tenant application, an attacker could use an identity token issued by a tenant they control to obtain an authenticated session. Successful exploitation could expose protected data and allow actions normally restricted to authenticated users. The affected Microsoft product is Spring Cloud Azure.

CVSS SCORE: 9.

SEVERITY: Critical.

THREAT: This vulnerability presents a significant authentication and privilege-elevation threat to affected multi-tenant applications. An attack can originate over the network without existing privileges or user interaction. Attack complexity is high because specific protocol settings, configurations, or other conditions must be present for exploitation to succeed.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, while the exploitability assessment is Exploitation More Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is caused by improper authentication (CWE-287) in Spring Cloud Azure. An unauthenticated attacker could obtain an identity token from a tenant under their control and use that token to sign in to an affected multi-tenant application. If the required conditions are present, the application could accept the attacker and establish an authenticated session for an unauthorized tenant. The attacker could then access protected resources and perform operations available to authenticated users. The vulnerability has network attack vector, high attack complexity, no privilege requirement, no user-interaction requirement, changed scope, and high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Spring Cloud Azure is affected; specific affected versions are not confirmed from the source. Exploitation can occur remotely over the network by using an identity token from an attacker-controlled tenant against an affected multi-tenant application. No privileges or user interaction are required.

BUSINESS IMPACT: Successful exploitation could allow unauthorized access to protected application data and authenticated operations. For organizations running affected multi-tenant applications, this creates risks to confidentiality, integrity, and availability. An unauthorized authenticated session could effectively turn a trust boundary failure into access to sensitive resources and business functions.

WORKAROUND: No mitigation or workaround is identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9. Although exploitation is not currently reported and exploit code maturity is Unproven, exploitation is assessed as More Likely. The ability to attack over the network without privileges or user interaction makes deployment of the official fix a high priority, particularly for affected multi-tenant applications.

CVE-2026-67643 is a Critical heap-based buffer overflow vulnerability affecting Microsoft SQL Server 2022 and SQL Server 2025. An authenticated attacker with low privileges can connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution on the server. The vulnerability can be attacked over the network with low complexity and requires no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute code remotely on an affected SQL Server. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability. Exploitation requires low privileges but no user interaction.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-67643 is a heap-based buffer overflow (CWE-122) in Microsoft SQL Server. An authenticated attacker can connect over the network and send a specially crafted query or request that causes a memory corruption condition. Successful exploitation can result in remote code execution on the SQL Server. Attack complexity is low, low privileges are required, and no user interaction is necessary. The scope is unchanged, while potential confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2022 for x64-based Systems (CU 26 and GDR) and Microsoft SQL Server 2025 for x64-based Systems (CU8 and GDR). Exploitation requires an authenticated attacker with low privileges to send a specially crafted query or request over the network.

BUSINESS IMPACT: Successful remote code execution on a database server could expose sensitive information, enable unauthorized modification of data, or disrupt database availability. For organizations that depend on SQL Server for business-critical applications, exploitation could affect both data security and operational continuity.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation, and the listed updates require a restart.

URGENCY: This vulnerability is rated Critical and carries a CVSS base score of 8.8. Although exploitation is assessed as unlikely and no exploitation is reported, the combination of network accessibility, low attack complexity, low privilege requirements, no required user interaction, and potential remote code execution makes timely deployment important.

CVE-2026-67378 is a critical remote code execution vulnerability caused by an untrusted pointer dereference in Microsoft SQL Server. An authenticated attacker with low privileges could connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution. Successful exploitation requires specific conditions because attack complexity is high, but no user interaction is required.

CVSS SCORE: 8.5.

SEVERITY: Critical.

THREAT: An attacker with authenticated, low-privilege access could remotely target an affected SQL Server. Successful exploitation could compromise confidentiality, integrity, and availability at a high level. Attack complexity is high because particular protocol settings, configurations, or other specific conditions must exist before exploitation can succeed.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in SQL Server. An authenticated attacker can connect over the network and send a specially crafted query or request that triggers a memory corruption condition. If the required conditions are present, this can allow the attacker to execute code on the server. The CVSS metrics indicate network-based attack access, high attack complexity, low privileges required, no user interaction, and changed scope. A successful attack can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products are Microsoft SQL Server 2019 for x64-based Systems (CU 32 and GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 26 and GDR), Microsoft SQL Server 2025 for x64-based Systems (CU8 and GDR), and Microsoft SQL Server Integration Services. Exploitation requires authenticated access, low privileges, specific conditions, and a specially crafted query or request. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow remote code execution on a database server, creating a serious risk to sensitive business information and service availability. With high potential impact to confidentiality, integrity, and availability, compromise could result in unauthorized access to information, modification of data or systems, and disruption of database-dependent business services.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can lead to remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is considered less likely and requires specific conditions, affected SQL Server environments should prioritize the official fix because successful exploitation could compromise a critical database server.

CVE-2026-69712 is a critical use-after-free vulnerability in the Windows Key Distribution Center (KDC). An authenticated attacker with low-level access to an affected server could send a specially crafted request over the network and execute code on that server. Successful exploitation could have a high impact on confidentiality, integrity, and availability, and no user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a network-based remote code execution threat against affected Windows Server systems. Attack complexity is low, although the attacker must be authenticated with low-level privileges. Successful exploitation could allow code execution and result in significant compromise of the targeted server.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69712 is caused by a use-after-free memory condition (CWE-416) in the Windows Key Distribution Center. An authenticated attacker with low-level access could send a specially crafted request to an affected server over the network, triggering the vulnerability and executing code. The attack requires low privileges but has low attack complexity and requires no user interaction. A successful attack can have a high impact on the confidentiality, integrity, and availability of the affected server.

EXPLOITABILITY: Affected products include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their listed Server Core installations. An authenticated attacker with low privileges can exploit the issue remotely using a specially crafted request. User interaction is not required.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on a vulnerable Windows Server, potentially exposing sensitive information, modifying systems or data, and disrupting server availability. For organizations relying on affected servers for critical services, server compromise could create significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical and carries a CVSS base score of 8.8. Its network attack vector, low attack complexity, low privilege requirement, and lack of required user interaction make timely deployment important. Although exploitation is assessed as Less Likely and no active exploitation is reported, affected Windows Servers should be prioritized for patching because successful exploitation can result in remote code execution with high confidentiality, integrity, and availability impact.

CVE-2026-69518 is a critical heap-based buffer overflow vulnerability in Windows Remote Desktop. An unauthorized attacker could join a Remote Desktop sharing session and send specially crafted clipboard data to the sharing host. Successful exploitation could execute code on the host system, potentially affecting the confidentiality, integrity, and availability of the system. The attack requires no privileges, but user interaction is required to initiate or participate in the sharing session.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability is remotely reachable over a network, has low attack complexity, and requires no attacker privileges. A successful attack can result in remote code execution with high confidentiality, integrity, and availability impact. User interaction is required through participation in or initiation of a Remote Desktop sharing session.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Remote Desktop. An unauthorized attacker could participate in a Remote Desktop sharing session and send specially crafted clipboard data to the sharing host. Processing that malicious data can trigger the vulnerability and allow execution of code on the host. The attack vector is network-based, attack complexity is low, no privileges are required, and user interaction is required. Successful exploitation carries high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. An attacker can attempt exploitation by sending specially crafted clipboard data while participating in a Remote Desktop sharing session.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on an affected host, creating significant risk to sensitive information, system integrity, and service availability. For organizations using vulnerable Remote Desktop environments, compromise of a host could disrupt business operations and expose data or systems accessible from that host.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, making patch deployment the documented remediation path.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for remote code execution make timely deployment important. Although exploitation is assessed as Less Likely and no exploitation is reported, affected Windows clients and servers should be prioritized for the official security update.

CVE-2026-69501 is an elevation-of-privilege vulnerability caused by an untrusted pointer dereference in Windows Secure Kernel Mode. An authorized local attacker with low privileges could exploit the issue to gain SYSTEM privileges. Exploitation is considered less likely because successful exploitation requires high attack complexity and sustained low-memory conditions on the target.

CVSS SCORE: 7.

SEVERITY: Critical.

THREAT: Successful exploitation could give a local attacker SYSTEM privileges, providing a high level of control over the affected Windows system. The vulnerability carries high potential impact to confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as unproven, and the exploitability assessment is Exploitation Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference in Windows Secure Kernel Mode. Exploitation requires local access with low privileges and no user interaction. Attack complexity is high because the target must be under sustained memory pressure, a condition that is not commonly present during normal operation. An attacker must induce or wait for this constrained memory state before reliably triggering the vulnerability. Successful exploitation could elevate the attacker to SYSTEM privileges, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected systems include Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 26H1 across the listed architectures, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. Exploitation requires local, low-privileged access, high-complexity memory-pressure conditions, and no user interaction.

BUSINESS IMPACT: A successful attack could convert limited local access into SYSTEM-level privileges. This could expose sensitive information, permit unauthorized system changes, and disrupt affected Windows endpoints or servers. Systems already accessible to a low-privileged attacker carry the primary risk.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and can result in SYSTEM-level privilege escalation. Although exploitation is assessed as less likely, is not publicly disclosed, and is not known to be exploited, the potential impact is high. Organizations should prioritize deployment of the applicable security updates across affected Windows endpoints and servers.

CVE-2026-69846 is a critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an integer overflow or wraparound. An authorized attacker who already has kernel-level access could submit a specially crafted Code Integrity policy and potentially execute code with Virtual Trust Level 1 (VTL1) privileges. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker with existing kernel-level access to cross a security boundary and gain VTL1 privileges. Confidentiality, integrity, and availability impacts are all rated High, making successful exploitation potentially significant for a compromised Windows system.

EXPLOITS: The vulnerability is assessed as Exploitation Less Likely. It is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is listed as Unproven; the source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability results from an integer overflow or wraparound in Windows Secure Kernel Mode. An attacker who already has kernel-level access could submit a specially crafted Code Integrity policy to an affected machine. Successful exploitation could permit execution of code in Virtual Trust Level 1 (VTL1), resulting in elevation of privilege. The attack is local, has low attack complexity, requires high privileges, requires no user interaction, and changes security scope.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Architectures vary by release and include affected 32-bit, x64, and ARM64 systems. Exploitation requires local access with existing kernel-level privileges and a specially crafted Code Integrity policy.

BUSINESS IMPACT: This vulnerability could deepen an existing system compromise by allowing an attacker with kernel-level access to reach VTL1 privileges. Successful exploitation carries High confidentiality, integrity, and availability impacts, creating risks to sensitive information, trusted system operations, and system availability. “A kernel compromise is serious; a path from the kernel into VTL1 can make that compromise even more powerful.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed for the vulnerability, and affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can result in VTL1 privilege elevation. Although exploitation is assessed as less likely, is not publicly disclosed, and is not currently known to be exploited, affected Windows systems should receive the official fix promptly because successful exploitation has High confidentiality, integrity, and availability impacts.

CVE-2026-69906 is a critical elevation-of-privilege vulnerability caused by a heap-based buffer overflow in Windows Secure Kernel Mode. An authorized local attacker who successfully exploits the flaw could execute code in the Windows kernel. The vulnerability requires high privileges but does not require user interaction.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability provides a path for an already highly privileged local attacker to elevate access and execute code in the kernel. Its CVSS metrics rate the potential impact to confidentiality, integrity, and availability as High, with a Changed scope. Attack complexity is Low once the required local access and privileges are present.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Its exploit code maturity is Unproven, and the exploitability assessment is “Exploitation Less Likely.” The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69906 is a heap-based buffer overflow in Windows Secure Kernel Mode. The vulnerability is locally accessible, has Low attack complexity, requires High privileges, and requires no user interaction. Successful exploitation could allow an authorized attacker to execute code in the kernel. The CVSS assessment identifies High confidentiality, integrity, and availability impacts and a Changed scope, meaning successful exploitation can cross a security boundary and have significant consequences for the affected system.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations and supported architectures shown for each release. Exploitation is local, requires High privileges, has Low attack complexity, and requires no user interaction.

BUSINESS IMPACT: Successful exploitation could enable kernel-level code execution and cause High impacts to confidentiality, integrity, and availability. For an organization, an attacker who has already obtained sufficiently privileged local access could use this vulnerability to deepen control over a compromised Windows endpoint or server. Kernel-level execution can significantly increase the security consequences of an existing compromise.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified, and affected systems require a restart when the applicable update is installed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can result in kernel-level code execution. Although exploitation is assessed as less likely and no active exploitation or public disclosure is reported, organizations should prioritize deployment of the applicable security update because successful exploitation carries High confidentiality, integrity, and availability impacts.

A heap-based buffer overflow in the Windows Imaging Component could allow an unauthorized attacker to execute code on an affected Windows system. Exploitation occurs over a network but requires a user to open a specially crafted file. No privileges are required, attack complexity is low, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can create a specially crafted file and convince a user on an affected Windows system to open it. This can trigger the heap-based buffer overflow and lead to remote code execution. The vulnerability has a network attack vector, low attack complexity, requires no privileges, and does require user interaction.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-73013 is a heap-based buffer overflow (CWE-122) in the Windows Imaging Component. An unauthorized attacker can supply a specially crafted file that, when opened by a user, triggers the vulnerability and can result in remote code execution. The attack can originate over a network, requires low attack complexity and no prior privileges, but depends on user interaction. Successful exploitation can significantly affect confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Supported architectures vary by version and include 32-bit, x64, and ARM64 systems. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on an affected system, creating serious risks to sensitive information, system integrity, and service availability. In an organization, a compromised endpoint or server could disrupt business operations or expose information accessible through the affected system.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation, so affected systems should receive the applicable security update.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity, network attack vector, lack of privilege requirements, and potential for remote code execution make prompt deployment important. Although exploitation requires user interaction and current exploitation is assessed as Less Likely, successful exploitation can have high confidentiality, integrity, and availability impact.

CVE-2026-70296 is a critical remote code execution vulnerability in the Windows Imaging Component caused by an out-of-bounds write. An attacker can craft a malicious RAW image and convince a user to navigate to a folder containing it. Windows can trigger the vulnerability while generating the image thumbnail or preview, meaning the file does not need to be opened. Successful exploitation can allow unauthorized code execution over a network.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges or user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability. A specially crafted RAW image can trigger the flaw through Windows thumbnail or preview processing.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is listed as unproven, so the source does not confirm public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: The Windows Imaging Component contains an out-of-bounds write vulnerability, identified as CWE-787. An attacker can create a specially crafted RAW image file and cause a Windows system to process it when generating a thumbnail or preview. The victim does not need to manually open the image. The attack has low complexity, requires no attacker privileges, and requires no user interaction according to the CVSS metrics. Successful exploitation can result in remote code execution, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. Exploitation can occur when Windows generates a thumbnail or preview for a specially crafted RAW image.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on affected systems, potentially compromising sensitive information, changing data, or disrupting system availability. The combination of remote code execution, low attack complexity, and no privilege requirement makes exposure particularly significant for organizations operating affected Windows systems.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making deployment of the applicable security update the identified remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network attack vector, low attack complexity, no privilege requirement, no user-interaction requirement, and potential for remote code execution make timely patch deployment important. Although exploitation is assessed as less likely and no exploitation is reported, affected Windows systems should be prioritized for the applicable security update.

CVE-2026-73023 is a critical heap-based buffer overflow vulnerability in the Windows Imaging Component. An unauthorized attacker can target the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can result in remote code execution. Exploitation requires no attacker privileges but does require user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. A user must open a specially crafted file supplied by an attacker to trigger the vulnerability. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Less Likely. The existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-73023 is caused by a heap-based buffer overflow (CWE-122) in the Windows Imaging Component. The attack can originate over a network and has low attack complexity. An attacker requires no privileges but must persuade a user to open a specially crafted file. Processing that file can trigger the buffer overflow and allow unauthorized remote code execution. Successful exploitation can significantly affect the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Architectures vary by release and include 32-bit, x64, and ARM64 systems. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code on an affected Windows system, creating serious risks to sensitive information, system integrity, and service availability. For organizations, compromise of vulnerable endpoints or servers could disrupt operations and expose systems or information to unauthorized activity.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified, making deployment of the applicable security update the available remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as less likely and no exploitation is reported, affected Windows systems should be prioritized for deployment of the official fix because opening a maliciously crafted file can trigger the vulnerability.

CVE-2026-69852 is a Critical remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS). It is caused by a heap-based buffer overflow. An attacker with low privileges could potentially exploit the vulnerability over a network without requiring user interaction. Successful exploitation has high attack complexity and is not guaranteed, but could result in unauthorized access with high impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: The vulnerability presents a network-based remote code execution threat. Successful exploitation requires low privileges and no user interaction, but the attack complexity is high and depends on factors such as system configuration, environment, and existing security measures. A successful attack could compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITS: There is no confirmed public disclosure or known exploitation. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-69852 is a heap-based buffer overflow, identified as CWE-122, affecting Windows Routing and Remote Access Service (RRAS). The attack vector is network-based, with low privileges required and no user interaction. Exploitation requires high attack complexity and a deep understanding of the target system, with success potentially depending on environmental and configuration factors. If successfully exploited, the flaw allows remote code execution and unauthorized access to the victim's machine, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Relevant 32-bit, x64, and ARM64 editions are affected as specified for each Windows release. Exploitation is assessed as “Exploitation More Likely” and requires network access, low privileges, high attack complexity, and no user interaction.

BUSINESS IMPACT: Successful exploitation could allow an attacker to gain unauthorized access and execute code on an affected Windows machine. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized system changes, and disrupt affected services or systems. For organizations running RRAS on affected Windows platforms, a successful attack could turn a remotely reachable weakness into a significant system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and could lead to remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is not currently reported and exploit code maturity is Unproven, exploitation is assessed as more likely. Organizations should prioritize deployment of the applicable security updates, particularly on affected systems running RRAS.

CVE-2026-69860 is a heap-based buffer overflow vulnerability in the Windows Imaging Component that can allow an unauthorized attacker to execute code on an affected Windows system. Exploitation occurs over a network but requires a user to open a specially crafted file. No privileges are required. The vulnerability can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could prepare a specially crafted file and persuade a user on an affected system to open it. Successful exploitation could result in remote code execution, potentially allowing the attacker to compromise sensitive information, alter data, or disrupt system availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. The exploitability assessment is “Exploitation Unlikely,” and exploit code maturity is classified as “Unproven.” The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69860 is caused by a heap-based buffer overflow (CWE-122) in the Windows Imaging Component. It has a network attack vector, low attack complexity, and requires no privileges. Exploitation requires user interaction: a user must open a specially crafted file supplied by an attacker to initiate remote code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability. The CVSS scope remains unchanged.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow remote code execution on affected Windows endpoints and servers. With high confidentiality, integrity, and availability impacts, a successful attack could expose sensitive information, permit unauthorized changes, and interrupt important systems or business services. A malicious file that reaches the right user could therefore turn into a significant system compromise.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation, so affected systems should receive the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution without requiring attacker privileges. Although exploitation requires user interaction and current exploitation is assessed as unlikely, the potential impact is high across confidentiality, integrity, and availability. Organizations should prioritize deployment of the applicable security updates across affected Windows clients and servers.

This critical vulnerability is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted request to an affected server and potentially execute code. The attack can be performed over the network with low complexity and requires no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker with low-level authenticated access could target RRAS remotely using a specially crafted request. Successful exploitation could compromise confidentiality, integrity, and availability, each of which is rated High in the CVSS metrics.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept code.

TECHNICAL SUMMARY: CVE-2026-72959 is a heap-based buffer overflow (CWE-122) affecting Windows Routing and Remote Access Service. An authenticated attacker with low privileges can send a specially crafted request over the network to an affected server. The vulnerability has low attack complexity, requires no user interaction, and can result in remote code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability. An official fix is identified in the source.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable architectures. Exploitation requires authenticated low-level access and a specially crafted network request; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on an affected server, potentially exposing sensitive information, enabling unauthorized changes, and disrupting system availability. For organizations operating affected RRAS systems, a compromised server could create significant security and operational consequences.

WORKAROUND: No mitigations or workarounds are identified. The source identifies an official fix, and affected software entries indicate that a restart is required.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its network-based, low-complexity attack path and lack of required user interaction increase the potential impact. Although exploitation is assessed as Less Likely and no exploitation is reported, affected systems should receive the applicable security update with high priority.

CVE-2026-77504 is a Critical remote code execution vulnerability caused by a double-free weakness (CWE-415) in Microsoft Office Word. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. No privileges are required, but user interaction is required. The affected Microsoft product is identified as Microsoft Office Word; however, the affected-software table lists Windows versions rather than specific Office Word versions, so affected Word versions cannot be confirmed.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could use a specially crafted file to trigger remote code execution through Microsoft Office Word. Successful exploitation has a High impact on confidentiality, integrity, and availability. The attack complexity is Low and no attacker privileges are required, although a user must open the malicious file.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-77504 results from a double-free memory-management weakness in Microsoft Office Word. A double free occurs when allocated memory is freed more than once, potentially causing memory corruption. In this case, an unauthorized remote attacker can prepare a specially crafted file and persuade a user to open it. Triggering the vulnerability can allow remote code execution. The CVSS metrics identify a Network attack vector, Low attack complexity, no privileges required, required user interaction, unchanged scope, and High confidentiality, integrity, and availability impacts.

EXPLOITABILITY: The source identifies Microsoft Office Word as the affected product but does not identify specific affected Word versions. The affected-software table lists Windows 10, Windows 11, and Windows Server releases from Windows Server 2012 through Windows Server 2025. Exploitation requires the target user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to significant loss of data confidentiality, integrity, and system availability. For organizations, a malicious document could create a path to system compromise, unauthorized changes, data exposure, or operational disruption.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified, so affected systems should be updated through the applicable security update.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although it is not currently reported as exploited or publicly disclosed, the combination of remote code execution, Low attack complexity, no required privileges, and High impact across confidentiality, integrity, and availability makes timely deployment important.

CVE-2026-72950 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted network request to an affected server and execute code without requiring user interaction. The vulnerability has not been publicly disclosed or exploited, and its exploitation assessment is Exploitation Unlikely.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a remote code execution threat over the network. Attack complexity is low, and successful exploitation can have a high impact on confidentiality, integrity, and availability. An attacker must already have low-level authenticated access, but no user interaction is required.

EXPLOITS: Exploited: No. Publicly Disclosed: No. Exploit Code Maturity is Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72950 is caused by a heap-based buffer overflow (CWE-122) in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network to trigger the vulnerability and execute code on the server. Attack complexity is rated Low, privileges required are Low, and no user interaction is necessary. Successful exploitation can have a high impact on the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable architectures. Exploitation requires an authenticated attacker with low-level access to send a specially crafted request to the affected server.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected systems. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could expose sensitive information, enable unauthorized modification of system resources, and disrupt affected services. This makes vulnerable RRAS systems a significant security concern even though exploitation has not been observed.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified in the source, so affected systems should be updated using the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, and lack of required user interaction increase the potential exposure of affected systems. Although exploitation is currently assessed as unlikely and no exploitation is reported, organizations should prioritize deployment of the applicable security updates because successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impacts.

CVE-2026-77495 is a heap-based buffer overflow in Windows Imaging Component that can allow an unauthorized attacker to execute code over a network. Exploitation requires a user to open a specially crafted file. The vulnerability requires no privileges, has low attack complexity, and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can create a specially crafted file and convince a user on an affected Windows system to open it. Successful exploitation can result in remote code execution, creating the potential for unauthorized actions and significant compromise of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Imaging Component. It has a network attack vector, low attack complexity, requires no privileges, and requires user interaction. An attacker must get a user to open a specially crafted file to trigger the vulnerability. Successful exploitation can execute code on the affected system, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Supported architectures vary by release and include 32-bit, x64, and ARM64 systems. Exploitation requires the target user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on vulnerable Windows endpoints or servers. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized modification of data or systems, and disrupt affected services. A malicious file that reaches a user therefore has the potential to become a serious system compromise.

WORKAROUND: No workaround or mitigation is listed. An official fix is available, so affected systems should be updated through the applicable security update.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can lead to remote code execution. Although it is not reported as exploited and exploitation is assessed as Less Likely, the combination of low attack complexity, no privilege requirement, and high confidentiality, integrity, and availability impact makes timely deployment important.

CVE-2026-69590 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a significant remote code execution threat because an attacker can target an affected RRAS service over the network without authentication. Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69590 is a heap-based buffer overflow (CWE-122) affecting Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can trigger the vulnerability by sending a specially crafted packet to an affected service over the network. The attack vector is network-based, attack complexity is low, privileges are not required, and no user interaction is necessary. Successful exploitation can allow remote code execution on the target and can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. An unauthenticated attacker can exploit an affected service by sending a specially crafted network packet.

BUSINESS IMPACT: Successful exploitation could give an attacker unauthorized ability to execute code on a vulnerable Windows system. For organizations, this creates the potential for serious system compromise affecting sensitive information, system integrity, and service availability. Because exploitation requires no authentication or user action, exposed vulnerable services can represent a particularly important attack surface.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8 and enables unauthenticated remote code execution with low attack complexity. Although exploitation is assessed as Less Likely and no exploitation is reported, the combination of network reachability, no required privileges, and no required user interaction makes timely deployment important.

CVE-2026-72983 is a critical use-after-free vulnerability in Windows Internet Connection Sharing (ICS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a serious remote code execution threat because exploitation can occur over the network with low attack complexity. Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system, all of which are rated High in the CVSS metrics.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is rated Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72983 is caused by a use-after-free weakness (CWE-416) in Windows Internet Connection Sharing. This type of memory-safety issue occurs when software continues to use memory after it has been freed. An unauthenticated attacker can target the affected ICS service by sending a specially crafted packet across the network. Successful exploitation can result in remote code execution on the target system. The CVSS characteristics show a network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and High impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including the listed Server Core installations and supported architectures shown for each release. Exploitation can be attempted remotely by sending a specially crafted packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized remote attacker to execute code on a vulnerable system. This creates the potential for significant compromise of sensitive information, system integrity, and service availability. Because authentication and user interaction are not required, vulnerable systems with an affected service reachable over the network present a particularly significant organizational risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 9.8. Its network-based attack path, low complexity, and ability to be exploited without authentication or user interaction make prompt patch deployment important, even though exploitation is currently assessed as Less Likely and no active exploitation is identified.

CVE-2026-81952 is a critical Microsoft Word remote code execution vulnerability caused by a heap-based buffer overflow. An unauthenticated attacker can craft a malicious RTF file that executes arbitrary code in the user's context when the file is opened or rendered in the Preview Pane. The vulnerability requires no attacker privileges but does require user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker to execute arbitrary code with the permissions of the affected user. The attack has network reachability, low attack complexity, and requires no privileges. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITS: This vulnerability was not publicly disclosed and was not known to be exploited at publication. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81952 is a heap-based buffer overflow (CWE-122) affecting Microsoft Office Word. An unauthenticated attacker can create a specially crafted malicious RTF file designed to trigger the memory corruption condition. Exploitation can occur when a user opens the file or when the file is rendered through the Preview Pane. Successful exploitation allows arbitrary code to execute in the user's context and can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires a user to open a malicious RTF file or have it rendered in the Preview Pane. No attacker privileges are required.

BUSINESS IMPACT: Successful exploitation could allow malicious code to run under the affected user's permissions, potentially exposing sensitive information, modifying data, or disrupting access to systems and information. Document-based delivery and the Preview Pane attack vector make malicious files particularly significant in environments where Office documents are routinely received and handled.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, making patch deployment the documented remediation.

URGENCY: This Critical vulnerability should be prioritized for patch deployment because it provides remote code execution with low attack complexity and requires no attacker privileges. A malicious RTF file can trigger exploitation when opened or rendered in the Preview Pane, creating a significant risk wherever untrusted Office documents may be processed.

CVE-2026-81355 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Virtual Hard Disk (VHD) Miniport Driver. An authorized attacker can exploit the vulnerability locally to execute code. Exploitation requires high privileges, high attack complexity, and no user interaction. The vulnerability is not publicly disclosed or known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: An attacker with high privileges and detailed knowledge of the target system could trigger the heap-based buffer overflow and execute code locally. Successful exploitation can have a high impact on confidentiality, integrity, and availability, with the security scope extending beyond the vulnerable component.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Less Likely. The existence of public exploit code, a zero-day exploit, or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-81355 is a heap-based buffer overflow (CWE-122) affecting the Virtual Hard Disk (VHD) Miniport Driver. An authorized local attacker can exploit improper handling of memory to cause a heap buffer overflow and execute code. Exploitation has high complexity and requires high privileges, but no user interaction is needed. Successful exploitation is not guaranteed and depends on factors including the environment, system configuration, and additional security measures. A successful attack can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation is local, requires high privileges and high attack complexity, and requires no user interaction.

BUSINESS IMPACT: Successful code execution could compromise sensitive information, alter data or system behavior, and disrupt affected Windows endpoints or servers. Because confidentiality, integrity, and availability impacts are all rated High, exploitation on business-critical systems could create significant operational and security consequences.

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified, and the applicable security update should be deployed where possible.

URGENCY: This vulnerability is rated Critical and can result in code execution with high confidentiality, integrity, and availability impact. Although exploitation is considered less likely and no active exploitation is reported, organizations should prioritize the official security update across affected Windows systems because no workaround or mitigation is identified.

CVE-2026-69676 is a Critical Windows Kerberos remote code execution vulnerability caused by an authentication bypass through capture-replay (CWE-294). An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network and execute code on that server. No user interaction is required. The vulnerability is not publicly disclosed and is not reported as exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires only low privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability. Because no user interaction is required, an attacker who already has low-level authenticated access could attempt exploitation without requiring a victim to open a file, click a link, or perform another action.

EXPLOITS: Exploitation is assessed as More Likely. The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is listed as Unproven. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability affects Windows Kerberos and is categorized as CWE-294, Authentication Bypass by Capture-replay. An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network to execute code on the server. The attack has low complexity, requires low privileges, and requires no user interaction. Successful exploitation can result in high confidentiality, integrity, and availability impact while leaving the security scope unchanged.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the architectures listed for each release; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. An authenticated attacker with low privileges can exploit the issue remotely by sending a specially crafted request to an affected server.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code remotely on an affected server, creating the potential for significant compromise of business systems and data. With high confidentiality, integrity, and availability impacts, exploitation could expose sensitive information, enable unauthorized modification, and disrupt affected services. The low attack complexity and absence of a user-interaction requirement increase the operational concern.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8, network-based exploitation, low attack complexity, and no user interaction requirement. Although it is not reported as exploited or publicly disclosed and exploit code maturity is Unproven, exploitation is assessed as More Likely. Organizations should prioritize deployment of the official fix across affected Windows client and server systems.

CVE-2026-81951 is a heap-based buffer overflow vulnerability in Microsoft Excel that can allow an unauthorized attacker to execute code locally. Exploitation requires a malicious Office file to be sent to a user and convincing that user to open it. No privileges are required, but user interaction is required. The Preview Pane is not an attack vector.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability. An attacker could use a specially crafted Office file as the delivery mechanism. Attack complexity is low and no privileges are required, although the targeted user must open the malicious file.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81951 is caused by a heap-based buffer overflow (CWE-122) in Microsoft Office Excel. An attacker can send a specially crafted Office file to a target and convince the user to open it. Processing the malicious content can trigger the memory corruption condition and allow the attacker to execute code locally. The attack has low complexity, requires no privileges, and requires user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise 32-bit and 64-bit, Excel 2016 32-bit and 64-bit, Office 2019 32-bit and 64-bit, Office LTSC 2021 32-bit and 64-bit, and Office LTSC 2024 32-bit and 64-bit. Exploitation requires a user to open a malicious Office file.

BUSINESS IMPACT: Successful exploitation could expose sensitive information, allow unauthorized modification of data, and disrupt system availability. Because malicious documents can be used as the attack mechanism, organizations handling Office files from external or untrusted sources face a significant risk if affected installations remain unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected Microsoft Office and Excel installations should be updated.

URGENCY: This vulnerability is rated Critical and can lead to code execution with high confidentiality, integrity, and availability impact. Although exploitation is currently assessed as Less Likely and no active exploitation is reported, the combination of low attack complexity and no privilege requirement makes timely deployment important.

CVE-2026-69499 is a Critical remote code execution vulnerability in the Windows Imaging Component caused by an integer overflow or wraparound. An unauthorized attacker can deliver a specially crafted file over a network, but a user must open that file to trigger remote code execution. The attack requires no prior privileges and has low attack complexity.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker could use a specially crafted file to trigger remote code execution on an affected Windows system. A successful attack can have a high impact on confidentiality, integrity, and availability. The attack vector is network-based, requires no privileges, and requires user interaction.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability results from an integer overflow or wraparound in the Windows Imaging Component. An attacker can create a specially crafted file and cause it to reach a vulnerable system over a network. Remote code execution occurs when a user opens the malicious file. The CVSS metrics identify low attack complexity, no privileges required, required user interaction, and an unchanged scope. Successful exploitation can produce high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation requires an attacker to get a specially crafted file opened by a user.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and cause significant compromise of affected Windows endpoints or servers. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could expose sensitive information, enable unauthorized changes, and disrupt system availability.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified as the remediation, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although it is not reported as exploited or publicly disclosed, successful exploitation could result in remote code execution with high confidentiality, integrity, and availability impacts. Prioritize deployment of the applicable security updates across affected Windows systems.

A use-after-free vulnerability in Windows Hello could allow an authorized local attacker to elevate privileges. Successful exploitation could grant Virtual Trust Level 1 (VTL1) privileges and result in high impact to confidentiality, integrity, and availability. The vulnerability affects multiple Windows 11 releases on both x64 and ARM64 systems.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability creates a privilege-escalation threat on affected Windows 11 systems. An attacker requires local access and low privileges, but no user interaction is required. Successful exploitation could cross a security boundary and provide VTL1 privileges, with potentially high confidentiality, integrity, and availability impact.

EXPLOITS: Microsoft assesses exploitation as unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, so no confirmed public or zero-day exploitation or proof-of-concept exploit code can be established.

TECHNICAL SUMMARY: CVE-2026-69740 is caused by a use-after-free weakness (CWE-416) in Windows Hello. This type of memory-safety issue occurs when software continues to reference memory after it has been freed. The vulnerability can be used by an authorized attacker to elevate privileges locally. The CVSS metrics identify a local attack vector, low privileges required, no user interaction, and changed scope. Successful exploitation could provide VTL1 privileges and have high impact on confidentiality, integrity, and availability. The source contains conflicting attack-complexity information: the CVSS metrics specify Low, while the FAQ describes attack complexity as High and says exploitation requires deep system knowledge and depends on environmental and configuration factors.

EXPLOITABILITY: Affected systems are Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on x64 and ARM64 architectures. Exploitation requires an authorized attacker with local access and low privileges; no user interaction is required.

BUSINESS IMPACT: Successful privilege escalation could give an attacker powerful access beyond their existing permissions, potentially exposing sensitive information, enabling unauthorized changes, and disrupting affected systems. For organizations, compromising a privileged Windows security boundary can significantly increase the impact of an attacker who already has limited local access.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Although exploitation is assessed as unlikely and no active exploitation is identified, successful exploitation could grant VTL1 privileges with high confidentiality, integrity, and availability impact. With no workaround identified, deploying the official security update should be prioritized.

CVE-2026-81380 is an information disclosure vulnerability involving improper neutralization of special command elements in GitHub Copilot and Visual Studio Code. An unauthorized attacker could potentially cause GitHub Copilot agent mode to send sensitive information from a user's development environment to an attacker-controlled service. Exploitation requires no privileges but does require user interaction and has high attack complexity.

CVSS SCORE: 5.3.

SEVERITY: Critical.

THREAT: The primary threat is unauthorized disclosure of sensitive development information. Successful exploitation could expose workspace data and environment variables over a network, potentially revealing information that organizations expect to remain within their development environments.

EXPLOITS: The exploit code maturity is classified as Unproven. The vulnerability is not publicly disclosed and is not reported as exploited. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: The vulnerability is caused by improper neutralization of special elements used in a command (CWE-77, Command Injection). An attacker could potentially manipulate GitHub Copilot agent mode into transmitting sensitive information from the user's development environment to an attacker-controlled service. The attack vector is network-based, requires no privileges, and requires user interaction. Attack complexity is high, meaning successful exploitation depends on factors such as the environment, system configuration, and security measures. A successful attack has a high confidentiality impact, while the recorded integrity and availability impacts are none.

EXPLOITABILITY: Visual Studio Code is confirmed as affected, with GitHub Copilot also identified in the vulnerability title and description. Specific affected versions or builds cannot be confirmed from the source information. Exploitation requires network access, no privileges, user interaction, and a high-complexity attack.

BUSINESS IMPACT: Successful exploitation could result in sensitive workspace data or environment variables leaving a development environment and reaching an attacker-controlled service. For organizations, disclosure of development information can create confidentiality risks and potentially expose sensitive operational or project data. "Development secrets can become business risks when sensitive workspace information escapes its trusted environment."

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability carries a Critical severity rating and could expose sensitive development-environment information. Although exploitation is not reported and exploit maturity is Unproven, organizations using affected software should prioritize the official fix to reduce the risk of confidential workspace data or environment variables being disclosed.

CVE-2026-69285 is a Critical remote code execution vulnerability in affected Microsoft Office products caused by a heap-based buffer overflow. An unauthorized attacker can exploit the vulnerability by convincing a user to open a specially crafted file. Successful exploitation could allow attacker-controlled code to execute, with high potential impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution and high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69285 is a heap-based buffer overflow (CWE-122) affecting Microsoft Office. The vulnerability can occur when a user opens a specially crafted file supplied by an attacker. The attack vector is network-based, attack complexity is low, and no privileges are required, although user interaction is necessary. Successful exploitation can allow an unauthorized attacker to execute code and potentially compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products include Microsoft 365 Apps for Enterprise (32-bit and 64-bit), Microsoft Office 2016 and 2019 (32-bit and 64-bit), and Microsoft Office LTSC 2021 and 2024 (32-bit and 64-bit). Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run on affected systems, creating significant risks to sensitive information, system integrity, and business operations. Because Office applications are widely used to handle business documents, a malicious file could provide an effective path for compromising targeted endpoints.

WORKAROUND: No workaround or mitigation is identified. An official fix is identified as the remediation.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity and lack of required attacker privileges increase the potential exposure, although exploitation still requires a user to open a malicious file. Organizations using affected Microsoft Office products should prioritize deployment of the official fix.

CVE-2026-69858 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, if exploitation succeeds, execute code on the target system. Exploitation requires winning a race condition, making attack complexity high. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability can be attacked remotely over the network and requires no privileges or user interaction. Successful exploitation could have a high impact on confidentiality, integrity, and availability. Attack complexity is high because successful exploitation requires the attacker to win a race condition.

EXPLOITS: The exploitability assessment is Exploitation Unlikely, with exploit code maturity listed as Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69858 is a CWE-416 use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network. Successful exploitation requires winning a race condition and could result in remote code execution on the target system. No authentication or user interaction is required, and successful exploitation could significantly affect confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products are Windows Server 2022, Windows Server 2022 Server Core installation, Windows Server 2025, and Windows Server 2025 Server Core installation. Exploitation can be attempted remotely with a specially crafted network packet, but attack complexity is high.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on an affected Windows DNS Server, creating risks to sensitive information, system integrity, and service availability. For organizations relying on affected DNS servers, compromise could disrupt critical infrastructure and expose server resources to attacker-controlled code.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed as the remediation, and installation requires a restart.

URGENCY: This vulnerability is rated Critical and can permit unauthenticated remote code execution without user interaction. Although exploitation is assessed as unlikely and no exploitation is reported, the potential impact is high across confidentiality, integrity, and availability. The official fix should therefore be prioritized for affected Windows Server systems.

CVE-2026-72987 is a critical use-after-free vulnerability (CWE-416) in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires high attack complexity and specific conditions, but successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: The vulnerability presents a network-based remote code execution threat. An attacker requires no privileges and no user interaction. Successful exploitation is not guaranteed because attack complexity is high and requires manipulation of system components to trigger a specific condition.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitability assessment is Exploitation Unlikely. The source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free condition in Windows DNS. An unauthenticated remote attacker could send a specially crafted packet to an affected service over the network, triggering the memory-management flaw. Successful exploitation could result in remote code execution on the target system. The attack requires no privileges or user interaction, although its high attack complexity means an attacker needs detailed knowledge of the system and must trigger specific conditions. A successful attack could cause high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations and applicable 32-bit/x64 Windows 10 editions. Exploitation can occur remotely through a specially crafted network packet without authentication.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution, creating serious risks to affected Windows systems. Because confidentiality, integrity, and availability impacts are all rated High, compromise could expose sensitive information, enable unauthorized changes, and disrupt system availability. Systems providing DNS-related services may therefore represent significant organizational risk if left unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This vulnerability is rated Critical and allows potential remote code execution without authentication or user interaction. Although exploitation is assessed as unlikely and no exploitation is currently identified, the potentially severe confidentiality, integrity, and availability consequences make prompt deployment of the applicable security update important.

CVE-2026-78505 is a heap-based buffer overflow vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code in the context of the user. An attacker can convince a user to open and save a specially crafted Microsoft Office document, and the Preview Pane is also identified as an attack vector. Authentication and prior privileges are not required, although successful exploitation requires user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation can provide an attacker with remote code execution in the context of the affected user. The vulnerability has low attack complexity, requires no privileges, and can result in high impact to confidentiality, integrity, and availability. A specially crafted Office document is used in the exploitation scenario.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and exploitation is assessed as less likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-78505 is caused by a heap-based buffer overflow in Microsoft Office. The vulnerability can be reached over a network using a specially crafted Office document. An attacker could convince a user to open and save the malicious document, resulting in code execution in the user's context. The Microsoft Office Preview Pane is also an attack vector. Attack complexity is low, authentication and privileges are not required, but user interaction is required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include 32-bit and 64-bit Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2019, Microsoft Office LTSC 2021, and Microsoft Office LTSC 2024. Exploitation requires user interaction with a specially crafted Office document. No privileges are required.

BUSINESS IMPACT: Successful exploitation could allow malicious code to run with the affected user's permissions, threatening sensitive information, data integrity, and system availability. In organizations where Office documents are routinely exchanged, a malicious document could create a significant security risk if users interact with it.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected Microsoft Office installations should be updated.

URGENCY: This patch should be prioritized because the vulnerability is rated Critical and enables remote code execution with low attack complexity and no privileges required. Although exploitation is currently assessed as less likely and no active exploitation is identified, interaction with a specially crafted Office document can lead to high confidentiality, integrity, and availability impact.

CVE-2026-78439 is a critical stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. An unauthorized remote attacker can trigger the vulnerability by convincing a user to open a specially crafted file. Successful exploitation can execute code in the target context and can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation could allow remote code execution with high confidentiality, integrity, and availability impact.

EXPLOITS: Microsoft assesses exploitation as less likely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, so the existence of public exploit or proof-of-concept code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-78439 is caused by a stack-based buffer overflow in the Microsoft Office Graphics Component. An attacker can prepare a specially crafted file and persuade a user to open it, triggering the vulnerable component. The attack uses a network attack vector with low complexity and requires no attacker privileges, although user interaction is necessary. Successful exploitation can result in remote code execution in the target context and compromise the confidentiality, integrity, and availability of the affected system.

EXPLOITABILITY: Affected products are Microsoft Office 365 for Mac, Microsoft Office for Android, Microsoft Office LTSC for Mac 2021, and Microsoft Office LTSC for Mac 2024. Exploitation requires a user to open a specially crafted attacker-controlled file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution and lead to exposure or modification of sensitive information and disruption of affected systems. Organizations using the affected Office products face potentially significant security and operational consequences if users open malicious files.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation, so organizations unable to patch immediately have no confirmed workaround from the source information.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Its low attack complexity, lack of required attacker privileges, and potential for remote code execution make timely deployment important, even though exploitation is currently assessed as less likely and no active exploitation is identified.

CVE-2026-73006 is a critical remote code execution vulnerability caused by a stack-based buffer overflow in the Microsoft Graphics Component. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can execute code while creating high confidentiality, integrity, and availability impact.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no attacker privileges. User interaction is required because the targeted user must open a specially crafted file. Successful exploitation can result in remote code execution with high impact to confidentiality, integrity, and availability.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-73006 is a stack-based buffer overflow, classified as CWE-121, affecting the Microsoft Graphics Component and identified as a DirectWrite remote code execution vulnerability. An attacker can deliver a specially crafted file over a network and persuade a user to open it. Processing that file can trigger the buffer overflow and enable unauthorized code execution. The attack has low complexity and requires no privileges, but successful exploitation depends on user interaction. Confidentiality, integrity, and availability impacts are all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025, including listed Server Core installations. Applicable 32-bit, x64, and ARM64 editions vary by Windows version. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute unauthorized code on an affected system, potentially compromising sensitive information, changing data, or disrupting system availability. Because no attacker privileges are required and attack complexity is low, malicious file delivery presents a significant organizational risk when vulnerable systems remain unpatched.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This patch should receive high deployment priority because the vulnerability is rated Critical, supports remote code execution, requires no attacker privileges, and has low attack complexity. Although exploitation is currently assessed as Less Likely and no active exploitation is reported, opening a specially crafted file can expose affected systems to high confidentiality, integrity, and availability impact.

CVE-2026-72958 is a Critical elevation-of-privilege vulnerability in Windows Credential Guard caused by a double-free weakness. An authorized local attacker who successfully exploits the flaw could gain Virtual Trust Level 1 (VTL1) privileges. Exploitation requires high existing privileges and no user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: A local attacker with high privileges could exploit the vulnerability to elevate privileges to VTL1. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as unlikely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: The vulnerability is a double-free memory-management weakness (CWE-415) in Windows Credential Guard. It can allow an authorized attacker operating locally to elevate privileges. The CVSS metrics specify a local attack vector, high privileges required, no user interaction, and changed scope. Successful exploitation can grant VTL1 privileges, with high potential impact to confidentiality, integrity, and availability. The executive summary states that exploitation requires winning a race condition, although the supplied CVSS metrics list attack complexity as Low.

EXPLOITABILITY: Affected systems are Windows 11 versions 24H2, 25H2, and 26H1 on ARM64 and x64, plus Windows Server 2025, including Server Core installations. Exploitation requires local access with high privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could enable an attacker with existing privileged local access to gain VTL1 privileges. This creates serious risk to sensitive information, system integrity, and service availability. In an enterprise environment, additional privilege gained on a compromised endpoint or server can increase the potential impact of an existing security breach.

WORKAROUND: No mitigations or workarounds are identified. An official fix is listed, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no exploitation is currently identified, affected Windows 11 and Windows Server 2025 systems should receive the official security fix promptly.

CVE-2026-72962 is a heap-based buffer overflow in the Windows USB Video Driver. An authenticated local attacker can send specially crafted requests to the affected USB video component and, if successful, cross a security boundary and gain elevated Virtual Trust Level 1 (VTL1) privileges. No user interaction is required, although exploitation requires high privileges.

CVSS SCORE: 8.2.

SEVERITY: Critical.

THREAT: The vulnerability threatens the confidentiality, integrity, and availability of affected Windows systems, with each rated High in the CVSS metrics. Successful exploitation can allow an attacker who already has authenticated local access and high privileges to cross a security boundary and obtain VTL1 privileges.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Its exploitation assessment is “Exploitation Unlikely,” and exploit code maturity is listed as Unproven. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-72962 is caused by a heap-based buffer overflow (CWE-122) in the Windows USB Video Driver. An authenticated attacker can send specially crafted requests to the USB video component on the local system. The attack has low complexity but requires local access and high privileges. Successful exploitation changes security scope, allowing the attacker to cross a security boundary and gain VTL1 privileges, with potentially high impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation requires an authenticated local attacker with high privileges to send specially crafted requests. No user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable an attacker with existing privileged local access to cross an additional Windows security boundary and obtain VTL1 privileges. This creates potentially serious consequences for organizations because exploitation carries high confidentiality, integrity, and availability impacts. “When privileged access crosses another security boundary, the potential damage can extend well beyond the original foothold.”

WORKAROUND: No mitigations or workarounds are identified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.2 and can result in VTL1 privilege elevation with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no active exploitation is identified, affected Windows systems should receive the applicable security update as a priority.

CVE-2026-69890 is a use-after-free vulnerability in the Windows Virtual Trusted Platform Module that allows an authorized local attacker to elevate privileges. Successful exploitation requires high existing privileges and winning a race condition, but could give the attacker Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: Successful exploitation could allow a local, highly privileged attacker to cross a security boundary and gain VTL1 privileges. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, with scope changed.

EXPLOITS: This vulnerability is not publicly disclosed and is not known to be exploited. Exploitation is assessed as unlikely, and exploit code maturity is rated Unproven. The existence of public exploit code, zero-day exploitation, or proof-of-concept code cannot be confirmed from the source data.

TECHNICAL SUMMARY: The vulnerability is caused by a use-after-free weakness (CWE-416) in the Windows Virtual Trusted Platform Module. An authorized attacker with high local privileges can attempt to trigger the flaw by successfully winning a race condition. Successful exploitation can result in elevation to Virtual Trust Level 1 (VTL1) privileges. The vulnerability has changed scope and is rated as having high impact on confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the architectures listed in the affected-software data; and Windows Server 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires local access, high privileges, and winning a race condition. No user interaction is required.

BUSINESS IMPACT: Organizations running affected Windows systems face the risk of a privileged attacker gaining VTL1 privileges. Successful exploitation could have serious consequences for sensitive information, system integrity, and service availability. Although exploitation is considered unlikely, compromise at this privilege level can significantly increase the impact of an existing foothold.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified as the remediation, and affected systems require a restart after installation.

URGENCY: This vulnerability is rated Critical and can affect confidentiality, integrity, and availability at a high level. Although it is not known to be exploited and exploitation is assessed as unlikely, affected Windows systems should be prioritized for deployment of the official fix because successful exploitation could grant VTL1 privileges.

CVE-2026-72979 is a critical use-after-free vulnerability in Windows DHCP Server. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires low attack complexity, no privileges, and no user interaction, with potential high impact to confidentiality, integrity, and availability.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability exposes affected Windows DHCP Server environments to unauthenticated network-based remote code execution. Successful exploitation could give an attacker the ability to execute code on the target system and cause significant confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not currently reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified in the source information.

TECHNICAL SUMMARY: CVE-2026-72979 is caused by a use-after-free memory-management weakness (CWE-416) in Windows DHCP Server. An unauthenticated attacker can target an affected service over the network with a specially crafted packet. The attack has low complexity and requires neither privileges nor user interaction. Successful exploitation can result in remote code execution on the target system, with high potential impact to confidentiality, integrity, and availability. An official fix is available.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025; and the listed Server Core installations. Exploitation can occur remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthenticated attacker to execute code on a vulnerable system. For organizations operating affected DHCP Server environments, this creates a critical risk to system confidentiality, integrity, and availability and could lead to compromise of important infrastructure.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This patch should be prioritized because the vulnerability is rated Critical with a CVSS base score of 9.8 and permits network-based remote code execution with low attack complexity. No privileges or user interaction are required, substantially reducing the barriers an attacker must overcome.

CVE-2026-69845 is a Critical remote code execution vulnerability in Windows DHCP Server caused by improper input validation leading to a heap-based buffer overflow. An unauthorized in-network attacker could exploit the flaw by calling arbitrary endpoints and potentially execute code remotely. The vulnerability has a CVSS base score of 9.8. It is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability can be attacked over a network with low attack complexity. Successful exploitation could result in remote code execution and carries High impact to confidentiality, integrity, and availability. No privileges or user interaction are required.

EXPLOITS: The exploitability assessment is Exploitation Less Likely. Exploit code maturity is classified as Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. The existence of public exploit code, a zero-day exploit, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: CVE-2026-69845 involves improper input validation and a heap-based buffer overflow in Windows DHCP Server, identified as CWE-20 and CWE-122. An unauthorized in-network attacker can call arbitrary endpoints to trigger the vulnerability. Successful exploitation can allow remote code execution over the network. Attack complexity is Low, privileges are not required, and no user interaction is necessary. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809, Windows Server 2012 and 2012 R2, and Windows Server 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation can occur through an in-network attacker calling arbitrary endpoints.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution on affected systems, creating the potential for serious compromise of confidentiality, integrity, and availability. For organizations operating affected DHCP servers, compromise of this infrastructure could create significant security and operational risk.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation.

URGENCY: This patch should receive urgent deployment priority because the vulnerability is rated Critical with a CVSS base score of 9.8 and enables network-based remote code execution with low attack complexity. No privileges and no user interaction are required, increasing the potential exposure of affected systems.

Microsoft Dynamics 365 (on-premises) version 9.1 contains a remote code execution vulnerability caused by deserialization of untrusted data. An authorized attacker with low privileges can exploit the issue over a network with low attack complexity and without user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability provides a network-accessible path to remote code execution. Exploitation requires low privileges but no user interaction, and a successful attack can result in high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is listed as unproven, and exploitation is assessed as less likely. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is associated with CWE-502, Deserialization of Untrusted Data. Microsoft Dynamics 365 can deserialize untrusted data in a manner that allows an authorized attacker to execute code over a network. The attack has low complexity, requires low privileges, and requires no user interaction. Scope remains unchanged, while successful exploitation can have high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Microsoft Dynamics 365 (on-premises) version 9.1 is affected. An attacker with low privileges can exploit the vulnerability remotely over a network without user interaction. Exploitation is assessed as less likely.

BUSINESS IMPACT: Successful exploitation could allow an attacker to execute code remotely, potentially exposing sensitive business information, modifying data, and disrupting Dynamics 365 availability. For organizations relying on on-premises Dynamics 365 for critical operations, compromise could affect both business data and service continuity.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified, and customer action is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, low privilege requirement, and absence of required user interaction make timely deployment important, even though exploitation is currently assessed as less likely and no exploitation is reported.

CVE-2026-72981 is a Critical remote code execution vulnerability in Microsoft Windows IP Helper caused by a use-after-free weakness (CWE-416). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires winning a race condition, which increases attack complexity. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: Successful exploitation could compromise the confidentiality, integrity, and availability of an affected Windows system, with each rated High in the CVSS metrics. The network attack vector, combined with no authentication or user interaction requirements, makes this a significant remote threat despite the high attack complexity.

EXPLOITS: The exploitability assessment is “Exploitation Less Likely.” Exploit code maturity is Unproven. The vulnerability is not publicly disclosed and is not known to be exploited. No public exploit, zero-day exploitation, or proof-of-concept code is confirmed.

TECHNICAL SUMMARY: The vulnerability is a use-after-free condition in Windows IP Helper. This type of flaw occurs when memory is referenced after it has been freed. An unauthenticated attacker could target an affected service over the network with a specially crafted packet. Successful exploitation requires the attacker to win a race condition, resulting in High attack complexity. If successful, the attacker could execute code on the target system. The CVSS metrics indicate no privileges and no user interaction are required, with potential High impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable 32-bit, x64, and ARM64 editions. Exploitation can occur remotely by sending a specially crafted packet, but requires winning a race condition.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause serious compromise of affected Windows endpoints and servers. Because confidentiality, integrity, and availability impacts are all rated High, exploitation could expose sensitive information, permit unauthorized system changes, or disrupt system availability.

WORKAROUND: No workaround or mitigation is identified. An official fix is available.

URGENCY: This vulnerability is rated Critical and can enable unauthenticated remote code execution over a network without user interaction. Although exploitation is assessed as less likely and no exploitation is currently identified, organizations should prioritize deployment of the official fix because successful exploitation could have High confidentiality, integrity, and availability impacts.

CVE-2026-72986 is a critical remote code execution vulnerability in Microsoft Windows Graphic Fonts. A heap-based buffer overflow and integer overflow or wraparound can allow an unauthorized attacker to execute code when a user opens a specially crafted file. The attack requires no privileges, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: An attacker can target affected Windows systems over a network using a specially crafted file. Attack complexity is low and no privileges are required, although the targeted user must open the malicious file. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: CVE-2026-72986 involves heap-based buffer overflow and integer overflow or wraparound weaknesses in Graphic Fonts. An unauthorized attacker can deliver a specially crafted file to a target over a network. When the user opens that file, the vulnerable font-processing behavior can trigger the memory corruption condition and allow remote code execution. The CVSS metrics identify network attack vector, low attack complexity, no privileges required, required user interaction, unchanged scope, and high confidentiality, integrity, and availability impacts.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized code execution on affected Windows systems, with high potential impact to data confidentiality, system integrity, and availability. In an organizational environment, a malicious file opened by a user could result in compromise of the affected system and disruption of business operations.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, so organizations unable to patch immediately should recognize that no alternative mitigation is confirmed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with no attacker privileges required. Although exploitation is assessed as Less Likely and no exploitation is reported, affected Windows systems should be prioritized for deployment of the official fix because successful exploitation can have high confidentiality, integrity, and availability impacts.

CVE-2026-73018 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Graphic Fonts. An unauthorized remote attacker can target the vulnerability by getting a user to open a specially crafted file. Successful exploitation can allow code execution on the affected system. The vulnerability requires no attacker privileges, but user interaction is required.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. A successful attack requires a user to open a specially crafted file. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit Code Maturity is rated Unproven, and exploitation is assessed as Less Likely. No public exploit, zero-day exploitation, or proof-of-concept exploit code is confirmed.

TECHNICAL SUMMARY: CVE-2026-73018 is a heap-based buffer overflow vulnerability in Graphic Fonts. An unauthorized attacker can remotely deliver a specially crafted file, but a targeted user must open that file to initiate remote code execution. The attack has low complexity and requires no privileges. Successful exploitation can execute code while causing high impact to confidentiality, integrity, and availability. The scope remains unchanged.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Supported architectures shown include 32-bit, x64, and ARM64 depending on the Windows version. Exploitation requires a user to open a specially crafted file.

BUSINESS IMPACT: Successful exploitation could allow unauthorized remote code execution and cause high confidentiality, integrity, and availability impact. For organizations, a malicious file reaching an affected Windows endpoint or server could create a serious security event once opened by a user.

WORKAROUND: No workaround or mitigation is listed. An official fix is identified as the remediation, and the affected software entries indicate that a restart is required.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8. Its network attack vector, low attack complexity, lack of required attacker privileges, and potential for remote code execution make timely deployment important, even though exploitation is currently assessed as Less Likely and is not reported as active.

CVE-2026-72954 is a critical use-after-free vulnerability in Windows Deployment Services. An authorized attacker with low privileges could exploit the flaw over a network to execute code. Successful exploitation requires winning a race condition, which increases attack complexity. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS SCORE: 7.5.

SEVERITY: Critical.

THREAT: Successful exploitation could allow remote code execution with high impact to confidentiality, integrity, and availability. The attack vector is network-based, requires low privileges, and requires no user interaction, although successful exploitation depends on a high-complexity race condition.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, so the source does not confirm a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-72954 is caused by a use-after-free weakness (CWE-416) in Windows Deployment Services. The flaw can occur when software continues using memory after it has been freed. An authorized attacker can target the vulnerability over a network and attempt to trigger a race condition. If successful, the attacker can execute code, with the CVSS metrics identifying high potential impact to confidentiality, integrity, and availability. Attack complexity is rated High because exploitation requires the attacker to win the race condition.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809 for 32-bit and x64 systems, and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations. Exploitation requires network access, low privileges, and a successful race condition; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable an attacker to execute code on affected systems, potentially leading to exposure of sensitive information, unauthorized modification of data, and disruption of system availability. For organizations running affected Windows Deployment Services environments, a successful attack could turn limited authorized access into a much more serious system compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation, and affected updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although exploitation is assessed as unlikely and no active exploitation is reported, affected Windows systems should be updated promptly because no workaround or mitigation is identified.

CVE-2026-69730 is a critical use-after-free vulnerability in Windows DNS that can allow an unauthenticated remote attacker to execute code on an affected system. Exploitation can be performed over the network with low attack complexity by sending a specially crafted packet to an affected service. No privileges or user interaction are required.

CVSS SCORE: 9.8.

SEVERITY: Critical.

THREAT: The vulnerability presents a serious remote code execution threat to affected Windows DNS services. An attacker can target the service over the network without authentication, privileges, or user interaction. Successful exploitation could have a high impact on system confidentiality, integrity, and availability.

EXPLOITS: This vulnerability was not publicly disclosed and was not reported as exploited at publication. Exploit code maturity is classified as Unproven, so the source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-69730 is caused by a use-after-free memory-management weakness (CWE-416) in Windows DNS. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and trigger the vulnerability. The attack has low complexity, requires no privileges, and needs no user interaction. Successful exploitation can result in remote code execution on the target system, with potentially high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected products include Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. The vulnerability can be exploited remotely by sending a specially crafted network packet to an affected service.

BUSINESS IMPACT: Successful exploitation could allow an unauthorized attacker to execute code on a vulnerable system, creating the potential for serious compromise of affected infrastructure. Because exploitation requires neither authentication nor user interaction and can occur over the network, exposed vulnerable services represent a significant organizational risk. Confidentiality, integrity, and availability can all be affected at a high level.

WORKAROUND: No mitigations or workarounds are listed. An official fix is available, so affected systems should be updated with the applicable security update.

URGENCY: This Critical vulnerability carries a CVSS base score of 9.8 and is assessed as “Exploitation More Likely.” Its network-based, low-complexity attack path requires no privileges and no user interaction. Although exploitation was not reported at publication and exploit maturity is Unproven, affected systems should be prioritized for deployment because successful exploitation can result in remote code execution.

CVE-2026-81955 is a critical heap-based buffer overflow vulnerability in the Microsoft Graphics Component. An unauthorized attacker can send a specially crafted RTF file and convince a user to open it in Microsoft Word and save it as a filtered web page. Successful exploitation can execute code in the user's context. Authentication and prior privileges are not required, although user interaction is required. The Preview Pane is not an attack vector.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: The vulnerability has a network attack vector, low attack complexity, and requires no privileges. An attacker must convince a user to interact with a specially crafted RTF document. Successful exploitation can have a high impact on confidentiality, integrity, and availability by executing attacker-controlled code in the user's context.

EXPLOITS: The exploitability assessment is Exploitation Unlikely. The vulnerability is not publicly disclosed and is not known to be exploited. Exploit Code Maturity is Unproven; no confirmed public exploit, zero-day exploitation, or proof-of-concept exploit code is identified.

TECHNICAL SUMMARY: CVE-2026-81955 is caused by a heap-based buffer overflow (CWE-122) in the Microsoft Graphics Component. An attacker can craft an RTF file and persuade a user to open it in Microsoft Word and save it as a filtered web page. This processing can trigger the vulnerability and allow code execution in the user's context. The attack does not require authentication or existing privileges, but user interaction is necessary. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY: Affected products include 32-bit and 64-bit editions of Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Office 2019, Office LTSC 2021, and Office LTSC 2024. Exploitation requires a user to open a malicious RTF file in Microsoft Word and save it as a filtered web page.

BUSINESS IMPACT: Successful exploitation could allow attacker-controlled code to run with the affected user's permissions, potentially exposing sensitive information, allowing unauthorized changes, and disrupting system availability. A convincing malicious document could turn normal document handling into a path for compromise.

WORKAROUND: No workaround or mitigation is identified. An official fix is listed as the remediation.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution with high confidentiality, integrity, and availability impacts. Although exploitation is assessed as unlikely and no active exploitation is identified, organizations should prioritize deployment of the official fix because no workaround or mitigation is identified.

CVE-2026-72957 is a critical heap-based buffer overflow vulnerability (CWE-122) in Windows Deployment Services. An authenticated attacker with low privileges can trigger the vulnerability locally and execute code without requiring user interaction. Although the title describes remote code execution, the attack vector is local; “Remote” refers to the location of the attacker, while exploitation requires code to be executed on the local machine.

CVSS SCORE: 7.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an authenticated attacker to execute arbitrary code on an affected Windows system. The vulnerability has low attack complexity, requires only low privileges, and requires no user interaction. A successful attack can have a high impact on confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is classified as Unproven, so the source does not confirm the existence of a public exploit, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow in Windows Deployment Services. An authenticated attacker can trigger the flaw with low privileges, potentially causing memory corruption that results in arbitrary code execution. The CVSS attack vector is Local with Low attack complexity, Low privileges required, and no user interaction. Scope remains unchanged, while successful exploitation can have High confidentiality, integrity, and availability impacts. An official fix is available.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809 (32-bit and x64), Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation requires an authenticated attacker with low privileges to trigger the vulnerability locally; no user interaction is required.

BUSINESS IMPACT: Successful exploitation could enable arbitrary code execution and lead to serious compromise of affected Windows systems. With confidentiality, integrity, and availability all rated High for impact, organizations could face exposure or modification of sensitive information and disruption of critical systems or services. The low attack complexity and lack of required user interaction increase the importance of addressing affected systems promptly.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the listed updates require a restart.

URGENCY: This vulnerability is rated Critical and can result in arbitrary code execution with High impact across confidentiality, integrity, and availability. Although exploitation is not currently reported and exploit maturity is Unproven, affected systems should be prioritized for deployment because exploitation requires only low privileges, has low attack complexity, and requires no user interaction.

CVE-2026-69813 is a critical use-after-free vulnerability in Windows DNS that can allow an unauthorized attacker to execute code over a network. Exploitation requires winning a race condition, making the attack complexity high. The vulnerability requires no privileges and no user interaction, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVSS SCORE: 8.1.

SEVERITY: Critical.

THREAT: An unauthorized network attacker could exploit the Windows DNS use-after-free condition to achieve remote code execution. Although exploitation is rated less likely because the attacker must successfully win a race condition, a successful attack could severely affect the compromised system.

EXPLOITS: This vulnerability is not publicly disclosed and is not reported as exploited. Exploit code maturity is rated Unproven, so confirmed public exploit or proof-of-concept code cannot be established.

TECHNICAL SUMMARY: CVE-2026-69813 is caused by a use-after-free weakness (CWE-416) in Windows DNS. The flaw occurs when software continues to use memory after it has been freed. An unauthorized attacker can target the vulnerability over a network and, with successful exploitation, execute code remotely by calling arbitrary endpoints. Exploitation has high complexity because the attacker must win a race condition. The attack requires no privileges or user interaction, with scope remaining unchanged. Successful exploitation can result in high confidentiality, integrity, and availability impact.

EXPLOITABILITY: Affected software includes Windows 10 versions 1607 and 1809; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including the listed Server Core installations. Exploitation is possible over a network without privileges or user interaction but requires winning a race condition.

BUSINESS IMPACT: Successful remote code execution could expose sensitive information, compromise system integrity, and disrupt availability. For organizations operating affected Windows systems, compromise of systems providing DNS functionality could create significant operational and security consequences.

WORKAROUND: No workaround or mitigation is specified. An official fix is identified as the remediation.

URGENCY: This vulnerability is rated Critical and can result in remote code execution with high confidentiality, integrity, and availability impact. Although it is not reported as exploited and exploitation is assessed as less likely, affected systems should receive the official fix promptly because a successful attack requires neither privileges nor user interaction.

CVE-2026-83498 is an elevation of privilege vulnerability in Windows Virtualization-Based Security (VBS) Enclave caused by an untrusted pointer dereference. A local attacker with low privileges could potentially exploit the flaw to leak data from a target enclave or execute code within the context of that enclave. The vulnerability requires no user interaction and has low attack complexity.

CVSS Score: 7.8

SEVERITY: Critical

THREAT: The vulnerability threatens the isolation provided by Windows VBS Enclaves. Successful exploitation could allow an attacker to access information that should remain protected inside an enclave or execute code within the enclave’s trusted context. This creates a serious risk to systems that depend on VBS Enclaves to isolate sensitive workloads and security-critical data.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation Less Likely. The CVSS v3.1 metrics list exploit code maturity as Unproven. The available data does not confirm the existence of publicly available proof-of-concept exploit code.

TECHNICAL SUMMARY: CVE-2026-83498 affects Windows Virtualization-Based Security Enclaves and is caused by an untrusted pointer dereference. The issue can occur when enclave-related code dereferences a pointer that cannot be fully trusted, potentially allowing an authorized local attacker to influence memory access in an unsafe manner. Exploitation requires local access and low privileges, has low attack complexity, and requires no user interaction. A successful attacker could potentially leak sensitive information from the target enclave or execute code within the security context of that enclave. The CVSS v3.1 metrics indicate high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected products include Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on supported x64 and ARM64 platforms, as well as Windows Server 2025 and Windows Server 2025 Server Core installations. Exploitation requires local access with low privileges and does not require user interaction.

BUSINESS IMPACT: VBS Enclaves are designed to protect sensitive code and data from less-trusted parts of the operating system. A vulnerability that allows enclave data leakage or code execution could weaken this protection and expose information that organizations expect to remain isolated. Successful exploitation could compromise sensitive workloads, reduce trust in protected execution environments, and increase the impact of an existing local compromise.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should minimize untrusted local code execution and tightly restrict access to systems that rely on VBS Enclave protections.

URGENCY: This vulnerability is rated Critical and affects a security boundary designed to protect highly sensitive workloads. Although Microsoft reports no known exploitation and assesses exploitation as less likely, successful exploitation could expose protected enclave data or allow code execution inside the target enclave. Organizations using VBS Enclaves should prioritize deployment of the available security updates.

CVE-2026-83501 is an information disclosure vulnerability in Windows Virtualization-Based Security (VBS) Enclave caused by an out-of-bounds read. An authorized local attacker with low privileges could exploit the flaw without user interaction and potentially view Virtual Trust Level 1 (VTL1) data from Virtual Trust Level 0 (VTL0), the least privileged trust level.

CVSS Score: 5.5

SEVERITY: Critical

THREAT: The vulnerability threatens the confidentiality boundary between Windows Virtual Trust Levels. Successful exploitation could allow a low-privilege attacker operating in VTL0 to access data belonging to the more privileged VTL1 environment, exposing information that should remain isolated by VBS protections.

EXPLOITS: Microsoft reports that the vulnerability is not publicly disclosed and not currently exploited. The exploitability assessment is Exploitation More Likely. CVSS v3.1 lists exploit code maturity as Unproven. The available data does not confirm public proof-of-concept exploit code or active zero-day exploitation.

TECHNICAL SUMMARY: CVE-2026-83501 affects Windows Virtualization-Based Security Enclave and is caused by an out-of-bounds read. The flaw can allow software to read memory beyond its intended boundary, potentially exposing protected information across Windows trust levels. Exploitation is local, has low attack complexity, requires low privileges, and does not require user interaction. Microsoft states that successful exploitation could allow an attacker in VTL0 to view VTL1 data. The CVSS v3.1 metrics indicate high confidentiality impact, with no confirmed integrity or availability impact.

EXPLOITABILITY: The affected Microsoft product is Windows Virtualization-Based Security Enclave. Specific affected Windows versions are not confirmed in the available data. Exploitation requires local access with low privileges and no user interaction.

BUSINESS IMPACT: Successful exploitation could expose sensitive information protected within a higher-trust VBS environment. This may weaken security controls that depend on virtualization-based isolation and could reveal data useful for follow-on attacks. Organizations relying on VBS to protect sensitive workloads, credentials, or security-sensitive processes could face increased risk if affected systems remain unpatched.

WORKAROUND: No specific workaround is confirmed in the available data. Microsoft identifies an official fix as the remediation. If immediate patching is not possible, organizations should limit untrusted local code execution and restrict access to systems that depend heavily on VBS protections.

URGENCY: This vulnerability is rated Critical, and Microsoft assesses exploitation as More Likely. Although there is no confirmed active exploitation, the flaw can expose higher-trust VTL1 data to a lower-trust VTL0 context. Organizations using VBS protections should prioritize deployment of the official security update.