Microsoft Failover Cluster Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+6 more)Fix KB5122876, KB5122882, KB5122871
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Failover Cluster, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Secure Socket Tunneling Protocol (SSTP), Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
DirectWrite Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft Graphics Component, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Graphic Fonts Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Graphic Fonts, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Internet Connection Sharing (ICS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Internet Connection Sharing (ICS), Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Netlogon Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Netlogon, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
IP Helper Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in IP Helper allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
IP Helper, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Security Feature Bypass Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
Severity
Critical · CVSS 4.4
Type
Security updates
Tags
Windows Hello, Security Feature Bypass, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows USB Video Driver Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+20 more)Fix KB5122876, KB5122882, KB5122878 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows USB Video Driver, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hyper-V Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Hyper-V, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Media Player Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Media Player, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Routing and Remote Access Service (RRAS), Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Credential Guard Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122871, KB5124008, KB5124012).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems (+6 more)Fix KB5122871, KB5124008, KB5124012
What you should do
If you run the affected products, install Microsoft's update (KB5122871, KB5124008, KB5124012); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Credential Guard, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Deployment Services Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Deployment Services allows an authorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Deployment Services, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Deployment Services Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Deployment Services allows an authorized attacker to execute code over a network.
Severity
Critical · CVSS 7.5
Type
Security updates
Tags
Windows Deployment Services, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Routing and Remote Access Service (RRAS), Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows DNS, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Installer Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Installer, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Paint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Paint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Paint, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to execute code locally.
Severity
Critical · CVSS 7.0
Type
Security updates
Tags
Windows Services for NFS ONCRPC XDR Driver, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Core Messaging Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Core Messaging, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft WebP Image Extension Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects WebP Image ExtensionFix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft WebP Image Extension, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Imaging Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds write in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Imaging Component, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.