Windows Raw Image Extension Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft Edge (Chromium-based), Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems (+23 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Raw Image Extension, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Text Shaping Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126835, KB5126836, KB5126868 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Text Shaping, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Windows Media Foundation Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126657, KB5126655 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+22 more)Fix KB5126651, KB5126657, KB5126655 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126657, KB5126655 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft Windows Media Foundation, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Shell Security Feature Bypass Vulnerability. Microsoft rates it Important; it is reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Detected. Microsoft publishes a customer-installable fix (KB5126836, KB5126868, KB5126651 and others listed in the advisory).
Severity ImportantExploited YesDisclosed NoAffects Microsoft Edge (Chromium-based), Outlook.com (+30 more)Fix KB5126836, KB5126868, KB5126651 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126836, KB5126868, KB5126651 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports this vulnerability as exploited, so it matters if you run the affected products.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Severity
Important · CVSS 8.8
Type
Security updates
Tags
Windows Shell, Security Feature Bypass, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: Yes · Publicly disclosed: No · Exploitation Detected · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Windows Raw Image Extension Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Raw Image Extension on Windows 10 Version 1607 for 32-bit Systems, Raw Image Extension on Windows 10 Version 1607 for x64-based Systems (+22 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Raw Image Extension, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126836, KB5126868, KB5126651 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5126836, KB5126868, KB5126651 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126836, KB5126868, KB5126651 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126653, KB5127648, KB5126646 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+26 more)Fix KB5126653, KB5127648, KB5126646 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5126653, KB5127648, KB5126646 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Virtualization-Based Security (VBS) Enclave, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Kernel Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5127648, KB5126646, KB5126651 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+22 more)Fix KB5127648, KB5126646, KB5126651 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5127648, KB5126646, KB5126651 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Kernel, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Active Directory Federation Services (AD FS) Spoofing Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126646 and others listed in the advisory and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 version 1607, Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (+44 more)Fix KB5126651, KB5126655, KB5126646 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126646 and others listed in the advisory and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Severity
Critical · CVSS 7.4
Type
Security updates
Tags
Active Directory Federation Services (AD FS), Spoofing, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Deployment Services Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126646 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5126651, KB5126655, KB5126646 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126646 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows Deployment Services, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126646 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5126651, KB5126655, KB5126646 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126646 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Double free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126835, KB5126836, KB5126868 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126835, KB5126836, KB5126868 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126835, KB5126836, KB5126868 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DHCP Server, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126653, KB5127648, KB5127646).
Severity CriticalExploited NoDisclosed NoAffects Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems (+8 more)Fix KB5126653, KB5127648, KB5127646
What you should do
If you run the affected products, install Microsoft's update (KB5126653, KB5127648, KB5127646); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Virtualization-Based Security (VBS) Enclave, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Graphics Kernel Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126657, KB5126653, KB5127648 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems (+16 more)Fix KB5126657, KB5126653, KB5127648 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5126657, KB5126653, KB5127648 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows Graphics Kernel, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows GDI+ Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126657 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126651, KB5126655, KB5126657 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126657 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows GDI+, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows ALPC Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5127648, KB5126646, KB5127646 and 4 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+22 more)Fix KB5127648, KB5126646, KB5127646 and 4 more
What you should do
If you run the affected products, install Microsoft's update (KB5127648, KB5126646, KB5127646 and 4 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows ALPC allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.0
Type
Security updates
Tags
Windows ALPC, Elevation of Privilege, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DHCP Client Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126835, KB5126836, KB5126868 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DHCP Client allows an unauthorized attacker to execute code over an adjacent network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Windows DHCP Client, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Active Directory Domain Services Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5127648, KB5126835, KB5126836 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5127648, KB5126835, KB5126836 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5127648, KB5126835, KB5126836 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Active Directory Domain Services, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Remote Desktop Services Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126651, KB5126655, KB5126646 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126651, KB5126655, KB5126646 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126651, KB5126655, KB5126646 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5126835, KB5126836, KB5126868 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Microsoft PostScript Printer Driver, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft PostScript Printer Driver Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5127648, KB5126646, KB5126835 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+30 more)Fix KB5127648, KB5126646, KB5126835 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5127648, KB5126646, KB5126835 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Microsoft PostScript Printer Driver, Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5126835, KB5126836, KB5126868 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5126835, KB5126836, KB5126868 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5126835, KB5126836, KB5126868 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Network Device Enrollment Service (NDES), Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122876, KB5122882, KB5122878 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5122876, KB5122882, KB5122878 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5122876, KB5122882, KB5122878 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent network.
Severity
Critical · CVSS 7.5
Type
Security updates
Tags
Reliable Multicast Transport Driver (RMCAST), Remote Code Execution, 2026-Oct
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.