Windows Media Player Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Media Player, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Secure Kernel Mode Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Secure Kernel Mode, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+20 more)Fix KB5122876, KB5122882, KB5122878 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Virtual Trusted Platform Module allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.5
Type
Security updates
Tags
Windows Virtual Trusted Platform Module, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows ALPC Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+20 more)Fix KB5122876, KB5122882, KB5122878 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows ALPC, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122878, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+12 more)Fix KB5122878, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122878, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Imaging Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Imaging Component, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122882, KB5122871).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2022, Windows Server 2022 (Server Core installation) (+2 more)Fix KB5122882, KB5122871
What you should do
If you run the affected products, install Microsoft's update (KB5122882, KB5122871); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Spring Cloud Azure Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Spring Cloud AzureFix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 9.0
Type
Security updates
Tags
Spring Cloud Azure, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine
Severity
Critical · CVSS 7.5
Type
Security updates
Tags
Windows Routing and Remote Access Service (RRAS), Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Secure Kernel Mode Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+24 more)Fix KB5122876, KB5122882, KB5122878 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Secure Kernel Mode, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Shell Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Shell allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Shell, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Role: DNS Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122878, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+12 more)Fix KB5122878, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122878, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.2
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122878, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+12 more)Fix KB5122878, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122878, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office PowerPoint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002920 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002920
What you should do
If you run the affected products, install Microsoft's update (KB5002920 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office PowerPoint, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122878, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+12 more)Fix KB5122878, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122878, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Client Denial of Service Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Missing release of memory after effective lifetime in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.
Type
Security updates
Tags
Windows DHCP Client, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows HTTP Print Provider Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows HTTP Print Provider, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office PowerPoint Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002920 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002920
What you should do
If you run the affected products, install Microsoft's update (KB5002920 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office PowerPoint, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5124008, KB5122880, KB5124012).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+6 more)Fix KB5124008, KB5122880, KB5124012
What you should do
If you run the affected products, install Microsoft's update (KB5124008, KB5122880, KB5124012); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network.
Type
Security updates
Tags
Windows Link Layer Topology Discovery Protocol, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122871 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5122876, KB5122882, KB5122871 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122871 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Hello Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122878, KB5124008, KB5122880 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+12 more)Fix KB5122878, KB5124008, KB5122880 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122878, KB5124008, KB5122880 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Windows Hello allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Hello, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.