Microsoft Makers of the Windows Operating System and hundreds of products that run on it.
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Microsoft product.
RSS Feeds for Microsoft security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Microsoft products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Microsoft Sorted by Most Security Vulnerabilities since 2018
Recent Microsoft Security Advisories
| Advisory | Title | Published |
|---|---|---|
| CVE-2026-87491 | Chromium CVE-2026-87491: Out of bounds write in V8 | September 12, 2026 |
| CVE-2026-76023 | Chromium CVE-2026-76023: Improper resource control in Linux Toolkit Theming | September 12, 2026 |
| CVE-2026-76022 | Chromium CVE-2026-76022: Buffer overflow in Network | September 12, 2026 |
| CVE-2026-76021 | Chromium CVE-2026-76021: Use after free in DOM | September 12, 2026 |
| CVE-2026-76019 | Chromium CVE-2026-76019: Incorrect authorization in Workers | September 12, 2026 |
| CVE-2026-76018 | Chromium CVE-2026-76018: Privilege elevation in Import | September 12, 2026 |
| CVE-2026-76017 | Chromium CVE-2026-76017: Use after free in Chromoting | September 12, 2026 |
| CVE-2026-76039 | Chromium CVE-2026-76039: Incorrect reference resolution in Core | September 11, 2026 |
| CVE-2026-76036 | Chromium CVE-2026-76036: Buffer overflow in Dawn | September 11, 2026 |
| CVE-2026-85053 | Chromium CVE-2026-85053: Improper resource exposure in CacheStorage | September 11, 2026 |
Known Exploited Microsoft Vulnerabilities
The following Microsoft vulnerabilities have recently been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| Microsoft Windows Heap-Based Buffer Overflow Vulnerability |
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. CVE-2026-85880 |
September 8, 2026 |
| Microsoft Windows Link Following Vulnerability |
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CVE-2026-81963 |
September 8, 2026 |
| Microsoft SQL Server Remote Code Execution Vulnerability |
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. CVE-2019-1068 Exploit Probability: 52.8% |
August 26, 2026 |
| Microsoft SharePoint Weak Authentication Vulnerability |
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. CVE-2026-55040 Exploit Probability: 1.3% |
August 18, 2026 |
| Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability |
Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. CVE-2026-33824 Exploit Probability: 55.9% |
August 18, 2026 |
| Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability |
Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-68820 |
August 11, 2026 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. CVE-2026-50522 Exploit Probability: 57.1% |
July 22, 2026 |
| Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. CVE-2026-58644 |
July 16, 2026 |
| Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability |
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. CVE-2026-56164 Exploit Probability: 18.4% |
July 14, 2026 |
| Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerabil |
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-56155 Exploit Probability: 2.3% |
July 14, 2026 |
| Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. CVE-2026-45659 Exploit Probability: 9.1% |
July 1, 2026 |
| Microsoft Defender Denial of Service Vulnerability |
Microsoft Defender contains an unspecified vulnerability that allows for denial of service. CVE-2026-45498 Exploit Probability: 63.1% |
May 20, 2026 |
| Microsoft Defender Link Following Vulnerability |
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2026-41091 Exploit Probability: 9.6% |
May 20, 2026 |
| Microsoft Internet Explorer Use-After-Free Vulnerability |
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0806 Exploit Probability: 82.2% |
May 20, 2026 |
| Microsoft DirectX NULL Byte Overwrite Vulnerability |
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file. CVE-2009-1537 Exploit Probability: 51.2% |
May 20, 2026 |
| Microsoft Windows Buffer Overflow Vulnerability |
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization. CVE-2008-4250 Exploit Probability: 98.8% |
May 20, 2026 |
| Microsoft Internet Explorer Use-After-Free Vulnerability |
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2010-0249 Exploit Probability: 91.9% |
May 20, 2026 |
| Microsoft Exchange Server Cross-Site Scripting Vulnerability |
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. CVE-2026-42897 Exploit Probability: 5.6% |
May 15, 2026 |
| Microsoft Windows Protection Mechanism Failure Vulnerability |
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. CVE-2026-32202 Exploit Probability: 63.7% |
April 28, 2026 |
| Microsoft Defender Insufficient Granularity of Access Control Vulnerability |
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. CVE-2026-33825 Exploit Probability: 6.7% |
April 22, 2026 |
Of the known exploited vulnerabilities above, 5 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 5 known exploited Microsoft vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
Top 10 Riskiest Microsoft Vulnerabilities
Based on the current exploit probability, these Microsoft vulnerabilities are on CISA's Known Exploited vulnerabilities list (KEV) and are ranked by the current EPSS exploit probability.
| Rank | CVE | EPSS | Vulnerability |
|---|---|---|---|
| 1 | CVE-2021-34473 | 100.0% | Microsoft Exchange Server Remote Code Execution Vulnerability |
| 2 | CVE-2019-0708 | 100.0% | "BlueKeep" Microsoft Windows Remote Desktop Remote Code Execution Vulnerability |
| 3 | CVE-2015-1635 | 100.0% | Microsoft HTTP.sys Remote Code Execution Vulnerability |
| 4 | CVE-2021-26855 | 100.0% | Microsoft OWA Exchange Control Panel (ECP) Exploit Chain |
| 5 | CVE-2021-34523 | 100.0% | Microsoft Exchange Server Privilege Escalation Vulnerability |
| 6 | CVE-2025-53770 | 100.0% | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 7 | CVE-2012-0158 | 100.0% | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability |
| 8 | CVE-2022-41082 | 100.0% | Microsoft Exchange Server Remote Code Execution Vulnerability |
| 9 | CVE-2020-0688 | 100.0% | Microsoft Exchange Server Key Validation Vulnerability |
| 10 | CVE-2022-41040 | 100.0% | Microsoft Exchange Server Server-Side Request Forgery Vulnerability |
By the Year
In 2026 there have been 6840 vulnerabilities in Microsoft with an average score of 7.3 out of ten. Last year, in 2025 Microsoft had 2759 security vulnerabilities published. That is, 4081 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.05.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 6840 | 7.28 |
| 2025 | 2759 | 7.23 |
| 2024 | 2182 | 7.39 |
| 2023 | 1695 | 7.21 |
| 2022 | 1389 | 7.43 |
| 2021 | 1153 | 7.44 |
| 2020 | 1253 | 7.19 |
| 2019 | 831 | 7.08 |
| 2018 | 661 | 7.03 |
It may take a day or so for new Microsoft vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Microsoft Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-77490 | Sep 11, 2026 |
Sep 2026: Microsoft Edge (Chromium-based) Spoofing VulnerabilityImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
Edge Chromium
|
| CVE-2026-70341 | Sep 11, 2026 |
Sep 2026: Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityUse after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. |
Edge Browser
Edge Chromium
|
| CVE-2026-87491 | Sep 09, 2026 |
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
|
| CVE-2026-66307 | Sep 08, 2026 |
Sep 2026: Skype for Business and Lync Denial of Service VulnerabilityInteger underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network. |
Skype For Business Server 2015
Skype Business Server Subscription Edition
Skype For Business Server 2019
And others... |
| CVE-2026-66303 | Sep 08, 2026 |
Sep 2026: Skype for Business and Lync Denial of Service VulnerabilityNull pointer dereference in Skype for Business allows an authorized attacker to deny service over a network. |
Skype For Business Server 2015
Skype For Business Server 2019
Skype Business Server Subscription Edition
And others... |
| CVE-2026-69646 | Sep 08, 2026 |
Sep 2026: Skype for Business Spoofing VulnerabilityImproper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network. |
Skype For Business Server 2019
Skype Business Server Subscription Edition
Skype For Business Server 2015
And others... |
| CVE-2026-69642 | Sep 08, 2026 |
Sep 2026: Skype for Business Spoofing VulnerabilityImproper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. |
Skype For Business Server 2015
Skype For Business Server 2019
Skype Business Server Subscription Edition
And others... |
| CVE-2026-66305 | Sep 08, 2026 |
Sep 2026: Skype for Business Spoofing VulnerabilityUse of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network. |
Skype For Business Server 2015
Skype For Business Server 2019
Skype Business Server Subscription Edition
And others... |
| CVE-2026-63523 | Sep 08, 2026 |
Sep 2026: Skype for Business Spoofing VulnerabilityImproper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. |
Skype For Business Server 2015
Skype Business Server Subscription Edition
Skype For Business Server 2019
And others... |
| CVE-2026-66308 | Sep 08, 2026 |
Sep 2026: Skype for Business and Lync Denial of Service VulnerabilityOut-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. |
Skype For Business Server 2015
Skype Business Server Subscription Edition
Skype For Business Server 2019
And others... |
| CVE-2026-66306 | Sep 08, 2026 |
Sep 2026: Skype for Business Information Disclosure VulnerabilityGeneration of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network. |
Skype For Business Server 2019
Skype Business Server Subscription Edition
Skype For Business Server 2015
And others... |
| CVE-2026-66302 | Sep 08, 2026 |
Sep 2026: Skype for Business Remote Code Execution VulnerabilityExternal control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. |
Skype For Business Server 2019
Skype Business Server Subscription Edition
Skype For Business Server 2015
And others... |
| CVE-2026-66304 | Sep 08, 2026 |
Sep 2026: Skype for Business Information Disclosure VulnerabilityServer-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network. |
Skype For Business Server 2019
Skype Business Server Subscription Edition
Skype For Business Server 2015
And others... |
| CVE-2026-62804 | Sep 08, 2026 |
Sep 2026: Microsoft Word Remote Code Execution VulnerabilityExternal control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
Office 2019
365 Apps
Office Macos 2021
And others... |
| CVE-2026-84003 | Sep 08, 2026 |
Sep 2026: Microsoft Authentication Library (MSAL) for Node.js Spoofing VulnerabilityAuthentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network. |
Microsoft Authentication Library Node Js
|
| CVE-2026-83498 | Sep 08, 2026 |
Sep 2026: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege VulnerabilityUntrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
Windows Server 2025
Windows 11 25h2
Windows 11 23h2
And others... |
| CVE-2026-83501 | Sep 08, 2026 |
Sep 2026: Windows Virtualization-Based Security (VBS) Information Disclosure VulnerabilityOut-of-bounds read in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally. |
Windows Server 2025
Windows 11 25h2
Windows 11 23h2
And others... |
| CVE-2026-69806 | Sep 08, 2026 |
Sep 2026: .NET Elevation of Privilege VulnerabilityExposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally. |
Visual Studio 2026
Visual Studio 2022
Net
And others... |
| CVE-2026-85875 | Sep 08, 2026 |
Sep 2026: Microsoft Office Excel Information Disclosure VulnerabilityOut-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
Office 2016
365 Apps
Office 2024
And others... |
| CVE-2026-84000 | Sep 08, 2026 |
Sep 2026: Microsoft Graphics Component Remote Code Execution VulnerabilityHeap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83997 | Sep 08, 2026 |
Sep 2026: Windows Message Queuing Remote Code Execution VulnerabilityUse after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
Windows Server 2022
Windows 10
Windows Server 2025
And others... |
| CVE-2026-83995 | Sep 08, 2026 |
Sep 2026: Windows NTFS Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83992 | Sep 08, 2026 |
Sep 2026: Windows Imaging Component Remote Code Execution VulnerabilityHeap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83990 | Sep 08, 2026 |
Sep 2026: Microsoft Graphics Component Elevation of Privilege VulnerabilityStack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. |
Windows Server 2022
Windows Server 2025
Windows 11 25h2
And others... |
| CVE-2026-83989 | Sep 08, 2026 |
Sep 2026: Windows Services for NFS ONCRPC XDR Driver Denial of Service VulnerabilityOut-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83985 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83987 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83983 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83982 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83980 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83978 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83981 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83977 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-70145 | Sep 08, 2026 |
Sep 2026: Microsoft Windows Search Component Information Disclosure VulnerabilityOut-of-bounds read in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83973 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83972 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83968 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityUse after free in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83970 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83967 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83954 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-69598 | Sep 08, 2026 |
Sep 2026: Windows iSCSI Remote Code Execution VulnerabilityIncorrect calculation of buffer size in Windows iSCSI allows an unauthorized attacker to execute code over a network. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83971 | Sep 08, 2026 |
Sep 2026: Windows Biometric Service Elevation of Privilege VulnerabilityHeap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-72965 | Sep 08, 2026 |
Sep 2026: Windows WebClient Service Elevation of Privilege VulnerabilityUse after free in Windows WebClient Service allows an authorized attacker to elevate privileges locally. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-69530 | Sep 08, 2026 |
Sep 2026: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution VulnerabilityUse after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-69381 | Sep 08, 2026 |
Sep 2026: Windows Storage Port Driver Information Disclosure VulnerabilityOut-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. |
Windows 10
Windows Server 2019
Windows Server 2022
And others... |
| CVE-2026-83949 | Sep 08, 2026 |
Sep 2026: Microsoft Office Word Information Disclosure VulnerabilityBuffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
Word 2016
Office 2019
Office 2021
And others... |
| CVE-2026-83951 | Sep 08, 2026 |
Sep 2026: Microsoft Office Word Information Disclosure VulnerabilityBuffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
Word 2016
Office 2019
Office 2021
And others... |
| CVE-2026-83948 | Sep 08, 2026 |
Sep 2026: Microsoft Azure CLI Remote Code Execution VulnerabilityImproper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network. |
Azure Cli
|
| CVE-2026-81963 | Sep 08, 2026 |
Sep 2026: Windows Update Stack Elevation of Privilege VulnerabilityImproper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
Windows Server 2025
Windows 11 25h2
Windows 11 23h2
And others... |
| CVE-2026-77897 | Sep 08, 2026 |
Sep 2026: Microsoft Power Automate Desktop Elevation of Privilege VulnerabilityRelative path traversal in Power Automate allows an authorized attacker to elevate privileges locally. |
Power Automate For Desktop
Power Automate Agent Virtual Desktops
|