Patch Tuesday September 2026

CVE-2026-62878 is a remote code execution vulnerability in Windows DNS Server caused by a stack-based buffer overflow. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. The attack has low complexity, requires no privileges, and requires no user interaction.

CVE-2026-62817 is a remote code execution vulnerability in Windows DNS Server caused by an out-of-bounds write. An unauthenticated attacker on an adjacent network could exploit the flaw by interacting with arbitrary endpoints and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction.

CVE-2026-62820 is a remote code execution vulnerability in Windows DNS Server caused by improper synchronization during concurrent access to a shared resource. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. Successful exploitation requires the attacker to win a race condition, which increases attack complexity.

CVE-2026-62823 is a remote code execution vulnerability in Windows DHCP Server caused by a heap-based buffer overflow. An unauthenticated attacker on an adjacent network could send a specially crafted packet to an affected DHCP service and potentially execute code on the target system. The attack requires no privileges, no authentication, and no user interaction.

CVE-2026-62893 is a remote code execution vulnerability in Windows Deployment Services caused by a use-after-free condition. An unauthenticated attacker could send a specially crafted packet to an affected TFTP service over the network and potentially execute code on the target system. The attack requires no privileges, no authentication, and no user interaction.

CVE-2026-65789 is a remote code execution vulnerability in Windows DNS caused by a use-after-free condition. An unauthenticated attacker could send a specially crafted packet to an affected DNS service over the network and potentially execute code on the target system. Exploitation requires specific network configurations and timing conditions, making successful exploitation less reliable across all environments.

SAP patches address three Critical vulnerabilities across Commerce Cloud, Manufacturing Integration and Intelligence, and NetWeaver and ABAP Platform. CVE-2026-58231 has a CVSS score of 10.0, Critical severity, and can allow an unauthenticated attacker to execute arbitrary code. CVE-2026-44758 has a CVSS score of 9.1, Critical severity, and can allow a highly privileged attacker to execute arbitrary operating-system commands. CVE-2026-34265 has a CVSS score of 9.8, Critical severity, and can allow an unauthenticated attacker to trigger memory corruption, potentially exposing sensitive information or crashing the system.

These vulnerabilities can significantly affect confidentiality, integrity, and availability across critical SAP environments.

Microsoft Exchange Server 2016 CU23 is affected by six vulnerabilities spanning remote code execution, privilege escalation, and other security weaknesses. CVE-2026-62913 has a CVSS score of 8.8, High severity. CVE-2026-62911 has a CVSS score of 8.0, High severity. CVE-2026-62910 has a CVSS score of 7.2, High severity. CVE-2026-62912 has a CVSS score of 6.5, Medium severity. CVE-2026-62914 has a CVSS score of 7.3, High severity. CVE-2026-62915 has a CVSS score of 6.5, Medium severity.

The patch addresses the affected Exchange Server components and reduces the risk of server compromise, unauthorized privilege gains, and disruption.

CVE-2026-81963 is an elevation of privilege vulnerability in the Windows Update Stack caused by improper link resolution before file access and improper access control. A local attacker with low privileges could exploit the weakness to gain SYSTEM privileges. Microsoft reports that exploitation has already been detected.

A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) allows an authorized local attacker to elevate privileges. An attacker who can execute code from a low-privilege AppContainer can exploit the vulnerability to escape the sandbox and obtain SYSTEM privileges without requiring user interaction.

CVE-2026-69678 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code. An attacker can send a specially crafted presentation, with exploitation occurring when a user opens the file or when it is rendered in a preview pane. Successful exploitation can execute code in the user's context and can have a high impact on confidentiality, integrity, and availability.

CVE-2026-69820 is a heap-based buffer overflow vulnerability in Windows Hello that allows an authorized local attacker to elevate privileges. Successful exploitation could give the attacker Virtual Trust Level 1 (VTL1) privileges. No exploitation or public disclosure is reported, and exploit code maturity is listed as unproven.

CVE-2026-81354 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a heap-based buffer overflow. An attacker with administrative control of the operating system, or control of a face-sensor adapter, could submit malformed face data to the Windows Hello Face secure sensor adapter and potentially gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVE-2026-69864 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness (CWE-416). An authorized local attacker with low privileges could exploit a race condition to elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high attack complexity but does not require user interaction. The vulnerability is not publicly disclosed and is not currently reported as exploited.

CVE-2026-69784 is a critical elevation-of-privilege vulnerability in Windows Hello caused by a use-after-free weakness. An authorized local attacker with low privileges could exploit the vulnerability and gain Virtual Trust Level 1 (VTL1) privileges. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-66302 is a critical remote code execution vulnerability in affected Microsoft Skype for Business Server versions. External control of a file name or path allows an unauthenticated attacker to send a specially crafted network request that writes an attacker-controlled file to an arbitrary location on the server. Successful exploitation could allow code execution on the target server without authentication or user interaction.

CVE-2026-72980 is a Windows Hello security feature bypass vulnerability caused by an uncontrolled search path element (CWE-427). An authorized local attacker with high privileges could exploit the issue to bypass the Windows Hello security feature. Successful exploitation can result in a high confidentiality impact, although no integrity or availability impact is identified.

CVE-2026-69797 is a critical remote code execution vulnerability in Microsoft Office PowerPoint caused by a use-after-free weakness (CWE-416). An unauthorized attacker can send a specially crafted presentation that may trigger the vulnerability when a user opens the file or it is rendered in a preview pane. Successful exploitation could execute code in the user's context and result in significant confidentiality, integrity, and availability impact.

CVE-2026-69710 is a Critical elevation-of-privilege vulnerability in Windows Hello caused by improper synchronization of a shared resource during concurrent execution. An authorized local attacker who successfully wins a race condition could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high privileges and high attack complexity but does not require user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-80083 is a critical remote code execution vulnerability in Windows Hyper-V caused by an untrusted pointer dereference. An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code. No user interaction is required. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVE-2026-72961 is a Critical Windows Hyper-V elevation-of-privilege vulnerability. An authorized attacker with administrative access to an affected Hyper-V host can supply specially crafted virtual TPM state data to a virtual machine. Successful exploitation can cross a security boundary and grant Virtual Trust Level 1 (VTL1) privileges. The vulnerability requires local access and high privileges but does not require user interaction.

CVE-2026-69829 is a Critical heap-based buffer overflow vulnerability in Windows Shell. An unauthorized attacker can exploit the flaw over a network by calling arbitrary endpoints, potentially gaining remote code execution. Successful exploitation could severely affect the confidentiality, integrity, and availability of an affected Windows system.

CVE-2026-69603 is a critical heap-based buffer overflow vulnerability in Windows Hyper-V. An authorized attacker running code inside a virtualized environment can issue a specially crafted hypercall containing a maliciously large or malformed payload size. This can trigger a buffer overflow in the hypervisor during memory operations and allow local code execution. The vulnerability requires low privileges and no user interaction.

CVE-2026-69595 is a critical use-after-free vulnerability (CWE-416) in the Windows Services for NFS ONCRPC XDR Driver. An unauthenticated remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires neither privileges nor user interaction.

CVE-2026-70585 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An authorized attacker with low privileges could exploit the flaw locally to execute code. Successful exploitation requires winning a race condition, making the attack complexity high, but no user interaction is required.

CVE-2026-78445 is a critical use-after-free vulnerability in the Windows Services for NFS ONCRPC XDR Driver. An unauthorized remote attacker can exploit the flaw by sending a specially crafted, unauthenticated call to a Network File System (NFS) service, potentially achieving remote code execution. The vulnerability requires no privileges or user interaction and has low attack complexity.

CVE-2026-69769 is a critical heap-based buffer overflow in the Windows HTTP Print Provider. Successful exploitation could allow an unauthorized, in-network attacker to execute code remotely by calling arbitrary endpoints. The vulnerability requires low attack complexity and can affect the confidentiality, integrity, and availability of a compromised system.

CVE-2026-69874 is a Critical elevation-of-privilege vulnerability in Windows ALPC caused by an untrusted pointer dereference. An authorized local attacker who successfully exploits the flaw could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires high privileges and no user interaction. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVE-2026-69799 is a critical elevation-of-privilege vulnerability in Windows Hello caused by improper synchronization when a shared resource is accessed concurrently. An authorized local attacker with low privileges could exploit a race condition to gain Virtual Trust Level 1 (VTL1) privileges. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-69767 is a critical use-after-free vulnerability in Microsoft Office PowerPoint that could allow an unauthorized attacker to execute code. Exploitation requires a user to open a specially crafted file. The attack has low complexity and requires no attacker privileges, but user interaction is required. The vulnerability can have a high impact on confidentiality, integrity, and availability.

CVE-2026-81950 is a Critical remote code execution vulnerability in Microsoft Excel and affected Microsoft Office products. The vulnerability is caused by a double-free memory condition. An attacker must convince a user to open a malicious Office file, after which code execution may occur locally without the attacker requiring privileges. The Preview Pane is not an attack vector. The vulnerability is not publicly disclosed or known to be exploited.

CVE-2026-81953 is a Critical remote code execution vulnerability in Microsoft Excel caused by a stack-based buffer overflow. An attacker can send a specially crafted Office file and convince a user to open it, potentially allowing unauthorized code execution. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-81959 is a Critical remote code execution vulnerability affecting Microsoft Excel and multiple Microsoft Office releases. A heap-based buffer overflow involving integer overflow or wraparound can allow an unauthorized attacker to execute code locally. Exploitation requires a user to open a malicious Office file, but the attacker does not require prior privileges. The Preview Pane is not an attack vector.

CVE-2026-81949 is a critical remote code execution vulnerability caused by an integer overflow or wraparound in Microsoft Office Excel. An unauthorized attacker can send a specially crafted Office file and convince a user to open it, potentially resulting in code execution. Exploitation requires no privileges but does require user interaction. The Preview Pane is not an attack vector.

CVE-2026-81948 is a critical Microsoft Excel remote code execution vulnerability caused by a heap-based buffer overflow. An unauthorized attacker can send a specially crafted Office file and convince a user to open it, potentially allowing attacker-controlled code to execute locally. No privileges are required, but successful exploitation requires user interaction.

CVE-2026-73010 is a critical use-after-free vulnerability in Microsoft Windows Failover Cluster. An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. Exploitation requires no authentication, privileges, or user interaction.

CVE-2026-78444 is a critical remote code execution vulnerability in Microsoft Windows Failover Cluster. The issue is caused by an untrusted pointer dereference. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, after successfully winning a race condition, execute code on the target system. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-69725 is a Windows Hello elevation-of-privilege vulnerability caused by a double-free weakness. An authorized local attacker who successfully exploits the vulnerability could elevate privileges to Virtual Trust Level 1 (VTL1). Exploitation requires low privileges and no user interaction. The source information contains conflicting attack-complexity statements: the CVSS metrics specify Low, while the FAQ states High and says successful exploitation requires winning a race condition.

CVE-2026-78510 is a critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that can allow an unauthenticated attacker to execute arbitrary code over a network. An attacker can craft a malicious RTF file that triggers the vulnerability when opened or rendered in the Preview Pane. Successful exploitation can compromise confidentiality, integrity, and availability with code executing in the user's context.

CVE-2026-78520 is a Microsoft Office Outlook vulnerability caused by an out-of-bounds read. An unauthorized remote attacker can target the vulnerability over a network, and exploitation requires user interaction. Microsoft confirms that the Outlook Preview Pane is an attack vector. Successful exploitation could allow an attacker to read small portions of heap memory, potentially exposing sensitive information stored in memory.

CVE-2026-78525 is a Critical remote code execution vulnerability caused by a use-after-free weakness (CWE-416) in Microsoft Office Outlook. An unauthorized attacker can send a specially crafted email, and exploitation may occur when the victim opens the email using an affected Outlook version or when Outlook displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVE-2026-77493 is a critical remote code execution vulnerability caused by a double-free memory handling issue in Microsoft Office Outlook. An attacker can send a specially crafted email to a target, and simply viewing that message in the Outlook Reading Pane can trigger the vulnerability. Successful exploitation could allow attacker-controlled code to execute on the recipient's system. The affected Microsoft product is identified as Microsoft Office Outlook; the affected-software table specifically lists supported Windows client and Windows Server versions.

CVE-2026-78519 is a critical remote code execution vulnerability in Microsoft Office Outlook caused by the use of an uninitialized resource. An unauthorized attacker can send a specially crafted email to a victim, and exploitation may occur when the victim opens the email or when an affected Outlook application displays its preview. Successful exploitation could allow the attacker to execute remote code on the victim’s machine.

CVE-2026-77898 is a critical heap-based buffer overflow vulnerability in Microsoft Office PowerPoint that can allow an unauthorized attacker to execute code over a network. Exploitation requires no privileges but does require user interaction and has high attack complexity. Successful exploitation could have a high impact on confidentiality, integrity, and availability.

A use-after-free vulnerability in Microsoft Office PowerPoint could allow an unauthorized attacker to execute code by sending a specially crafted presentation. Exploitation can occur when a user opens the malicious file or it is rendered in a preview pane. The vulnerability requires no attacker privileges but does require user interaction. It is not publicly disclosed and is not reported as exploited.

CVE-2026-73017 is a Critical heap-based buffer overflow vulnerability in the Windows Graphics Kernel. An authorized local attacker with high privileges could manipulate system components to trigger the flaw and execute code. Exploitation requires high attack complexity but no user interaction.

CVE-2026-78509 is a Critical heap-based buffer overflow vulnerability in Microsoft Office Outlook that could allow an unauthorized remote attacker to execute code on a target system. An attacker can send a specially crafted email, and simply viewing it in the Outlook Reading Pane can trigger the vulnerability without opening the message or clicking anything. The CVSS base score is 9.8, and exploitation requires neither authentication nor user interaction.

CVE-2026-73009 is a critical use-after-free vulnerability in Windows Secure Socket Tunneling Protocol (SSTP). An unauthorized remote attacker can send a specially crafted packet to an affected service and potentially execute code on the target system. The attack has low complexity and requires no privileges or user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

A use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthorized remote attacker to execute code on an affected Windows system. Exploitation requires sending a specially crafted packet to an affected service and successfully winning a race condition. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-83939 is a Critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an untrusted pointer dereference. An authorized attacker who already has kernel-level access can submit a specially crafted Code Integrity policy to an affected system. Successful exploitation can allow code execution in Virtual Trust Level 1 (VTL1), with high potential impact to confidentiality, integrity, and availability.

CVE-2026-58599 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Windows Codecs Library. An unauthorized attacker can execute code locally by exploiting the flaw. Exploitation requires user interaction, but no privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-81352 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Windows Codecs Library and affecting Web Media Extensions. An unauthorized attacker can target the vulnerability over a network. Exploitation requires user interaction but does not require attacker privileges. Successful exploitation could result in high impact to confidentiality, integrity, and availability.

CVE-2026-69601 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Microsoft Windows Media Foundation. An unauthorized attacker can target the vulnerability over a network, but successful exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation could allow attacker-controlled code to execute on an affected Windows system.

CVE-2026-70203 is a critical heap-based buffer overflow vulnerability in Windows Media Player. An unauthorized attacker can attempt exploitation by convincing a user to open a specially crafted media file. Processing that file can cause memory corruption and potentially allow attacker-controlled code to execute on the affected system. The vulnerability is not publicly disclosed and is not reported as exploited.

CVE-2026-72960 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Media Player. An unauthorized attacker can exploit the issue over a network by convincing a user to open a specially crafted file. Successful exploitation can allow attacker-controlled code to execute on the affected system. No privileges are required, but user interaction is required.

CVE-2026-69579 is a critical use-after-free vulnerability in Windows Message Queuing. An unauthorized, unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires low attack complexity, no privileges, and no user interaction. It is not publicly disclosed and is not known to be exploited.

CVE-2026-67636 is a critical remote code execution vulnerability in Microsoft SQL Server caused by an out-of-bounds read. An authenticated attacker with low privileges could connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers a memory corruption condition. Successful exploitation could allow code execution on the server and result in high confidentiality, integrity, and availability impact. Exploitation requires specific conditions because attack complexity is high, and no user interaction is required.

An integer overflow or wraparound in the Microsoft WebP Image Extension can lead to a heap-based buffer overflow and remote code execution. An unauthorized attacker can target the vulnerability over a network, but exploitation requires a user to open a specially crafted file. No privileges are required. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-70586 is a critical remote code execution vulnerability caused by a heap-based buffer overflow in Windows Paint. An unauthorized attacker can trigger the vulnerability by convincing a user to open a specially crafted file. The attack requires no privileges but does require user interaction. Successful exploitation can execute code and has a high potential impact on confidentiality, integrity, and availability.

A critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST) could allow an unauthenticated attacker to execute code remotely. Exploitation requires winning a race condition, which increases attack complexity, but a successful attack could have a high impact on confidentiality, integrity, and availability.

CVE-2026-78449 is a critical use-after-free vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation is considered less likely because attack complexity is high and successful exploitation depends on multiple environmental and system factors.

CVE-2026-65669 is an elevation-of-privilege vulnerability involving improper neutralization of special elements in output used by a downstream component. An unauthorized attacker could convince a user to submit specially crafted instructions to SQL Copilot in SQL Server Management Studio. Successful exploitation could bypass intended read-only restrictions and access or modify database data with the connected user's permissions.

CVE-2026-67631 is a critical heap-based buffer overflow vulnerability in Microsoft SQL Server. An authenticated attacker with low privileges can connect to an affected SQL Server over the network and submit a specially crafted query or request that triggers memory corruption, potentially allowing code execution on the server. No user interaction is required.

CVE-2026-72982 is a critical stack-based buffer overflow vulnerability in Windows Netlogon. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The vulnerability requires no privileges or user interaction and can result in high impact to confidentiality, integrity, and availability.

CVE-2026-77505 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker with network access could send specially timed DNS queries to a DNS server configured with a server-level DNS plug-in and attempt to trigger a race condition. Successful exploitation could result in remote code execution with SYSTEM privileges. The vulnerability is not publicly disclosed and is not currently reported as exploited.

Spring Cloud Azure contains an improper authentication vulnerability that could allow an unauthenticated attacker to elevate privileges over a network. In an affected multi-tenant application, an attacker could use an identity token issued by a tenant they control to obtain an authenticated session. Successful exploitation could expose protected data and allow actions normally restricted to authenticated users. The affected Microsoft product is Spring Cloud Azure.

CVE-2026-67643 is a Critical heap-based buffer overflow vulnerability affecting Microsoft SQL Server 2022 and SQL Server 2025. An authenticated attacker with low privileges can connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution on the server. The vulnerability can be attacked over the network with low complexity and requires no user interaction.

CVE-2026-67378 is a critical remote code execution vulnerability caused by an untrusted pointer dereference in Microsoft SQL Server. An authenticated attacker with low privileges could connect to an affected SQL Server and submit a specially crafted query or request that triggers memory corruption and allows code execution. Successful exploitation requires specific conditions because attack complexity is high, but no user interaction is required.

CVE-2026-69712 is a critical use-after-free vulnerability in the Windows Key Distribution Center (KDC). An authenticated attacker with low-level access to an affected server could send a specially crafted request over the network and execute code on that server. Successful exploitation could have a high impact on confidentiality, integrity, and availability, and no user interaction is required.

CVE-2026-69518 is a critical heap-based buffer overflow vulnerability in Windows Remote Desktop. An unauthorized attacker could join a Remote Desktop sharing session and send specially crafted clipboard data to the sharing host. Successful exploitation could execute code on the host system, potentially affecting the confidentiality, integrity, and availability of the system. The attack requires no privileges, but user interaction is required to initiate or participate in the sharing session.

CVE-2026-69501 is an elevation-of-privilege vulnerability caused by an untrusted pointer dereference in Windows Secure Kernel Mode. An authorized local attacker with low privileges could exploit the issue to gain SYSTEM privileges. Exploitation is considered less likely because successful exploitation requires high attack complexity and sustained low-memory conditions on the target.

CVE-2026-69846 is a critical elevation-of-privilege vulnerability in Windows Secure Kernel Mode caused by an integer overflow or wraparound. An authorized attacker who already has kernel-level access could submit a specially crafted Code Integrity policy and potentially execute code with Virtual Trust Level 1 (VTL1) privileges. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-69906 is a critical elevation-of-privilege vulnerability caused by a heap-based buffer overflow in Windows Secure Kernel Mode. An authorized local attacker who successfully exploits the flaw could execute code in the Windows kernel. The vulnerability requires high privileges but does not require user interaction.

A heap-based buffer overflow in the Windows Imaging Component could allow an unauthorized attacker to execute code on an affected Windows system. Exploitation occurs over a network but requires a user to open a specially crafted file. No privileges are required, attack complexity is low, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-70296 is a critical remote code execution vulnerability in the Windows Imaging Component caused by an out-of-bounds write. An attacker can craft a malicious RAW image and convince a user to navigate to a folder containing it. Windows can trigger the vulnerability while generating the image thumbnail or preview, meaning the file does not need to be opened. Successful exploitation can allow unauthorized code execution over a network.

CVE-2026-73023 is a critical heap-based buffer overflow vulnerability in the Windows Imaging Component. An unauthorized attacker can target the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can result in remote code execution. Exploitation requires no attacker privileges but does require user interaction.

CVE-2026-69852 is a Critical remote code execution vulnerability in Windows Routing and Remote Access Service (RRAS). It is caused by a heap-based buffer overflow. An attacker with low privileges could potentially exploit the vulnerability over a network without requiring user interaction. Successful exploitation has high attack complexity and is not guaranteed, but could result in unauthorized access with high impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-69860 is a heap-based buffer overflow vulnerability in the Windows Imaging Component that can allow an unauthorized attacker to execute code on an affected Windows system. Exploitation occurs over a network but requires a user to open a specially crafted file. No privileges are required. The vulnerability can have a high impact on confidentiality, integrity, and availability.

This critical vulnerability is a heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted request to an affected server and potentially execute code. The attack can be performed over the network with low complexity and requires no user interaction.

CVE-2026-77504 is a Critical remote code execution vulnerability caused by a double-free weakness (CWE-415) in Microsoft Office Word. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. No privileges are required, but user interaction is required. The affected Microsoft product is identified as Microsoft Office Word; however, the affected-software table lists Windows versions rather than specific Office Word versions, so affected Word versions cannot be confirmed.

CVE-2026-72950 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An authenticated attacker with low-level access can send a specially crafted network request to an affected server and execute code without requiring user interaction. The vulnerability has not been publicly disclosed or exploited, and its exploitation assessment is Exploitation Unlikely.

CVE-2026-77495 is a heap-based buffer overflow in Windows Imaging Component that can allow an unauthorized attacker to execute code over a network. Exploitation requires a user to open a specially crafted file. The vulnerability requires no privileges, has low attack complexity, and can have a high impact on confidentiality, integrity, and availability.

CVE-2026-69590 is a critical heap-based buffer overflow vulnerability in Windows Routing and Remote Access Service (RRAS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVE-2026-72983 is a critical use-after-free vulnerability in Windows Internet Connection Sharing (ICS). An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. The attack has low complexity and requires neither privileges nor user interaction.

CVE-2026-81952 is a critical Microsoft Word remote code execution vulnerability caused by a heap-based buffer overflow. An unauthenticated attacker can craft a malicious RTF file that executes arbitrary code in the user's context when the file is opened or rendered in the Preview Pane. The vulnerability requires no attacker privileges but does require user interaction.

CVE-2026-81355 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in the Microsoft Virtual Hard Disk (VHD) Miniport Driver. An authorized attacker can exploit the vulnerability locally to execute code. Exploitation requires high privileges, high attack complexity, and no user interaction. The vulnerability is not publicly disclosed or known to be exploited.

CVE-2026-69676 is a Critical Windows Kerberos remote code execution vulnerability caused by an authentication bypass through capture-replay (CWE-294). An authenticated attacker with low-level access to an affected server can send a specially crafted request over the network and execute code on that server. No user interaction is required. The vulnerability is not publicly disclosed and is not reported as exploited.

CVE-2026-81951 is a heap-based buffer overflow vulnerability in Microsoft Excel that can allow an unauthorized attacker to execute code locally. Exploitation requires a malicious Office file to be sent to a user and convincing that user to open it. No privileges are required, but user interaction is required. The Preview Pane is not an attack vector.

CVE-2026-69499 is a Critical remote code execution vulnerability in the Windows Imaging Component caused by an integer overflow or wraparound. An unauthorized attacker can deliver a specially crafted file over a network, but a user must open that file to trigger remote code execution. The attack requires no prior privileges and has low attack complexity.

A use-after-free vulnerability in Windows Hello could allow an authorized local attacker to elevate privileges. Successful exploitation could grant Virtual Trust Level 1 (VTL1) privileges and result in high impact to confidentiality, integrity, and availability. The vulnerability affects multiple Windows 11 releases on both x64 and ARM64 systems.

CVE-2026-81380 is an information disclosure vulnerability involving improper neutralization of special command elements in GitHub Copilot and Visual Studio Code. An unauthorized attacker could potentially cause GitHub Copilot agent mode to send sensitive information from a user's development environment to an attacker-controlled service. Exploitation requires no privileges but does require user interaction and has high attack complexity.

CVE-2026-69285 is a Critical remote code execution vulnerability in affected Microsoft Office products caused by a heap-based buffer overflow. An unauthorized attacker can exploit the vulnerability by convincing a user to open a specially crafted file. Successful exploitation could allow attacker-controlled code to execute, with high potential impact to confidentiality, integrity, and availability. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-69858 is a critical use-after-free vulnerability in Windows DNS Server. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and, if exploitation succeeds, execute code on the target system. Exploitation requires winning a race condition, making attack complexity high. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-72987 is a critical use-after-free vulnerability (CWE-416) in Windows DNS. An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires high attack complexity and specific conditions, but successful exploitation could have a high impact on confidentiality, integrity, and availability.

CVE-2026-78505 is a heap-based buffer overflow vulnerability in Microsoft Office that can allow an unauthorized attacker to execute code in the context of the user. An attacker can convince a user to open and save a specially crafted Microsoft Office document, and the Preview Pane is also identified as an attack vector. Authentication and prior privileges are not required, although successful exploitation requires user interaction.

CVE-2026-78439 is a critical stack-based buffer overflow (CWE-121) in the Microsoft Office Graphics Component. An unauthorized remote attacker can trigger the vulnerability by convincing a user to open a specially crafted file. Successful exploitation can execute code in the target context and can have a high impact on confidentiality, integrity, and availability.

CVE-2026-73006 is a critical remote code execution vulnerability caused by a stack-based buffer overflow in the Microsoft Graphics Component. An unauthorized attacker can exploit the vulnerability over a network by convincing a user to open a specially crafted file. Successful exploitation can execute code while creating high confidentiality, integrity, and availability impact.

CVE-2026-72958 is a Critical elevation-of-privilege vulnerability in Windows Credential Guard caused by a double-free weakness. An authorized local attacker who successfully exploits the flaw could gain Virtual Trust Level 1 (VTL1) privileges. Exploitation requires high existing privileges and no user interaction. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-72962 is a heap-based buffer overflow in the Windows USB Video Driver. An authenticated local attacker can send specially crafted requests to the affected USB video component and, if successful, cross a security boundary and gain elevated Virtual Trust Level 1 (VTL1) privileges. No user interaction is required, although exploitation requires high privileges.

CVE-2026-69890 is a use-after-free vulnerability in the Windows Virtual Trusted Platform Module that allows an authorized local attacker to elevate privileges. Successful exploitation requires high existing privileges and winning a race condition, but could give the attacker Virtual Trust Level 1 (VTL1) privileges. No user interaction is required.

CVE-2026-72979 is a critical use-after-free vulnerability in Windows DHCP Server. An unauthenticated attacker can send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires low attack complexity, no privileges, and no user interaction, with potential high impact to confidentiality, integrity, and availability.

CVE-2026-69845 is a Critical remote code execution vulnerability in Windows DHCP Server caused by improper input validation leading to a heap-based buffer overflow. An unauthorized in-network attacker could exploit the flaw by calling arbitrary endpoints and potentially execute code remotely. The vulnerability has a CVSS base score of 9.8. It is not publicly disclosed and is not known to be exploited.

Microsoft Dynamics 365 (on-premises) version 9.1 contains a remote code execution vulnerability caused by deserialization of untrusted data. An authorized attacker with low privileges can exploit the issue over a network with low attack complexity and without user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-72981 is a Critical remote code execution vulnerability in Microsoft Windows IP Helper caused by a use-after-free weakness (CWE-416). An unauthenticated attacker could send a specially crafted packet to an affected service over the network and potentially execute code on the target system. Exploitation requires winning a race condition, which increases attack complexity. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-72986 is a critical remote code execution vulnerability in Microsoft Windows Graphic Fonts. A heap-based buffer overflow and integer overflow or wraparound can allow an unauthorized attacker to execute code when a user opens a specially crafted file. The attack requires no privileges, but user interaction is required.

CVE-2026-73018 is a Critical remote code execution vulnerability caused by a heap-based buffer overflow in Graphic Fonts. An unauthorized remote attacker can target the vulnerability by getting a user to open a specially crafted file. Successful exploitation can allow code execution on the affected system. The vulnerability requires no attacker privileges, but user interaction is required.

CVE-2026-72954 is a critical use-after-free vulnerability in Windows Deployment Services. An authorized attacker with low privileges could exploit the flaw over a network to execute code. Successful exploitation requires winning a race condition, which increases attack complexity. No user interaction is required. The vulnerability is not publicly disclosed and is not known to be exploited.

CVE-2026-69730 is a critical use-after-free vulnerability in Windows DNS that can allow an unauthenticated remote attacker to execute code on an affected system. Exploitation can be performed over the network with low attack complexity by sending a specially crafted packet to an affected service. No privileges or user interaction are required.

CVE-2026-81955 is a critical heap-based buffer overflow vulnerability in the Microsoft Graphics Component. An unauthorized attacker can send a specially crafted RTF file and convince a user to open it in Microsoft Word and save it as a filtered web page. Successful exploitation can execute code in the user's context. Authentication and prior privileges are not required, although user interaction is required. The Preview Pane is not an attack vector.

CVE-2026-72957 is a critical heap-based buffer overflow vulnerability (CWE-122) in Windows Deployment Services. An authenticated attacker with low privileges can trigger the vulnerability locally and execute code without requiring user interaction. Although the title describes remote code execution, the attack vector is local; “Remote” refers to the location of the attacker, while exploitation requires code to be executed on the local machine.

CVE-2026-69813 is a critical use-after-free vulnerability in Windows DNS that can allow an unauthorized attacker to execute code over a network. Exploitation requires winning a race condition, making the attack complexity high. The vulnerability requires no privileges and no user interaction, and successful exploitation can have a high impact on confidentiality, integrity, and availability.

CVE-2026-83498 is an elevation of privilege vulnerability in Windows Virtualization-Based Security (VBS) Enclave caused by an untrusted pointer dereference. A local attacker with low privileges could potentially exploit the flaw to leak data from a target enclave or execute code within the context of that enclave. The vulnerability requires no user interaction and has low attack complexity.

CVE-2026-83501 is an information disclosure vulnerability in Windows Virtualization-Based Security (VBS) Enclave caused by an out-of-bounds read. An authorized local attacker with low privileges could exploit the flaw without user interaction and potentially view Virtual Trust Level 1 (VTL1) data from Virtual Trust Level 0 (VTL0), the least privileged trust level.