Windows iSCSI Target Service Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows iSCSI Target Service, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows iSCSI Target Service Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows iSCSI Target Service, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows DNS Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2016, Windows Server 2016 (Server Core installation) (+6 more)Fix KB5120238, KB5120242, KB5120229 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows DNS, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Win32k Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Win32K, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows iSCSI Target Service Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+14 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows iSCSI Target Service, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SharePoint Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5002894, KB5002896, KB5002893).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SharePoint Server 2019, Microsoft SharePoint Server Subscription EditionFix KB5002894, KB5002896, KB5002893
What you should do
If you run the affected products, install Microsoft's update (KB5002894, KB5002896, KB5002893); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
SharePoint
Tags
Microsoft Office SharePoint, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SharePoint Server Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002905, KB5002906, KB5002894 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SharePoint Enterprise Server 2016, Microsoft SharePoint Server 2019 (+1 more)Fix KB5002905, KB5002906, KB5002894 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5002905, KB5002906, KB5002894 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Services
SharePoint
Tags
Microsoft Office SharePoint, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002897 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002897
What you should do
If you run the affected products, install Microsoft's update (KB5002897 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002901 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002901
What you should do
If you run the affected products, install Microsoft's update (KB5002901 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002897 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002897
What you should do
If you run the affected products, install Microsoft's update (KB5002897 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002897 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002897
What you should do
If you run the affected products, install Microsoft's update (KB5002897 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002897 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002897
What you should do
If you run the affected products, install Microsoft's update (KB5002897 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002901 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+8 more)Fix KB5002901
What you should do
If you run the affected products, install Microsoft's update (KB5002901 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Word Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002755 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002755
What you should do
If you run the affected products, install Microsoft's update (KB5002755 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Word, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002902 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002902
What you should do
If you run the affected products, install Microsoft's update (KB5002902 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002897 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+11 more)Fix KB5002897
What you should do
If you run the affected products, install Microsoft's update (KB5002897 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Exchange Server Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5121576, KB5121573, KB5121574 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14 (+2 more)Fix KB5121576, KB5121573, KB5121574 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5121576, KB5121573, KB5121574 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 8.0
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Windows Server 2012, Windows Server 2012 (Server Core installation) (+10 more)Fix KB5120238, KB5120242, KB5120229 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Windows Deployment Services, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows GDI+ Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows GDI+ allows an authorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows GDI+, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.