Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows Secure Socket Tunneling Protocol (SSTP), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows User Profile Service Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed YesAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows User Profile Service, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: Yes · Exploitation More Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SharePoint Server Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002905, KB5002906, KB5002894 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 (+1 more)Fix KB5002905, KB5002906, KB5002894 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5002905, KB5002906, KB5002894 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
SharePoint
Tags
Microsoft Office SharePoint, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Remote Desktop Client Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120418, KB5120386, KB5120385).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+6 more)Fix KB5120418, KB5120386, KB5120385
What you should do
If you run the affected products, install Microsoft's update (KB5120418, KB5120386, KB5120385); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over an adjacent network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows GDI+ Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows GDI+, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2016, Windows Server 2016 (Server Core installation) (+6 more)Fix KB5120238, KB5120242, KB5120229 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows Routing and Remote Access Service (RRAS), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Active Directory Certificate Services (AD CS) allows an authorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Active Directory Certificate Services (AD CS), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2019, Windows Server 2019 (Server Core installation) (+4 more)Fix KB5120238, KB5120242, KB5120229 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds write in Windows DNS allows an unauthorized attacker to execute code over an adjacent network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Reliable Multicast Transport Driver (RMCAST), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft QUIC Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed. Microsoft publishes a customer-installable fix (KB5120242, KB5120229, KB5120233 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+10 more)Fix KB5120242, KB5120229, KB5120233 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120242, KB5120229, KB5120233 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Microsoft QUIC, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows SMBv3 Server Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network.
Type
Security updates
Tags
Windows SMB Server, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows DHCP Server, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Kerberos Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Kerberos, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows MIDI Service Module Elevation of Privileges Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows MIDI Service Module, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Storage Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Storage, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Graphics Kernel Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Graphics Kernel, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Installer Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Integer overflow or wraparound in Windows Installer allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Installer, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.