Windows NTFS Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally.
Type
Security updates
Tags
Windows NTFS, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows NTFS Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code with a physical attack.
Type
Security updates
Tags
Windows NTFS, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122771, KB5122770, KB5122768 and 1 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft SQL Server 2022 for x64-based Systems (GDR) (+2 more)Fix KB5122771, KB5122770, KB5122768 and 1 more
What you should do
If you run the affected products, install Microsoft's update (KB5122771, KB5122770, KB5122768 and 1 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5122773, KB5122771, KB5122770 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR) (+4 more)Fix KB5122773, KB5122771, KB5122770 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122773, KB5122771, KB5122770 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Out-of-bounds read in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.0
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122769, KB5122768, KB5122775 and 5 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2017 for x64-based Systems (CU 31), Microsoft SQL Server 2017 for x64-based Systems (GDR) (+6 more)Fix KB5122769, KB5122768, KB5122775 and 5 more
What you should do
If you run the affected products, install Microsoft's update (KB5122769, KB5122768, KB5122775 and 5 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.8
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5122773, KB5122771, KB5122770 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR) (+4 more)Fix KB5122773, KB5122771, KB5122770 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5122773, KB5122771, KB5122770 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Untrusted pointer dereference in SQL Server allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 9.0
Type
Security updates
Tags
SQL Server, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Skype for Business Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
Type
Security updates
Tags
Skype for Business, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft Dynamics 365 (on-premises) version 9.1Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft Dynamics 365, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft SQL Server Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects SQL Server Management Studio 22Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network.
Severity
Critical · CVSS 9.6
Type
Security updates
Tags
SQL Server, Elevation of Privilege, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Spoofing Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity not ratedExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit SystemsFix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
Severity
· CVSS 6.5
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
HEVC Video Extensions Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects HEVC Video Extensions, HEVC Video Extensions for Licensed Applications (+22 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Windows Codecs Library, Remote Code Execution, 2026-Sep
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Defender Elevation of Privilege Vulnerability. Microsoft rates it Important; not reported as exploited; publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity ImportantExploited NoDisclosed YesAffects Microsoft Malware Protection EngineFix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports it as publicly disclosed, so it matters if you run the affected products.
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
Severity
Important · CVSS 7.8
Type
Security updates
Services
Defender
Tags
Microsoft Defender, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: Yes · Exploitation More Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability. Microsoft rates it Important; not reported as exploited; publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft publishes a customer-installable fix (KB5121000).
Severity ImportantExploited NoDisclosed YesAffects Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based SystemsFix KB5121000
What you should do
If you run the affected products, install Microsoft's update (KB5121000); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports it as publicly disclosed, so it matters if you run the affected products.
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Severity
Important · CVSS 5.5
Type
Security updates
Tags
Windows Container Isolation FS Filter Driver (unionfs.sys), Tampering, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: Yes · Exploitation Unlikely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 2 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+6 more)Fix KB5120238, KB5120242, KB5120229 and 2 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 2 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Integer overflow or wraparound in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows Device Health Attestation (DHA), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Installer Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Unlikely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Installer, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Unlikely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft PowerShell Remote Code Execution Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
Type
Security updates
Tags
Microsoft PowerShell Core, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+6 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 8.4
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability. Microsoft rates it Important; it is reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Detected. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity ImportantExploited YesDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix and reports this vulnerability as exploited, so it matters if you run the affected products.
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Severity
Important · CVSS 7.0
Type
Security updates
Tags
Windows Ancillary Function Driver for WinSock, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: Yes · Publicly disclosed: No · Exploitation Detected · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Important) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002884, KB5002903 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+12 more)Fix KB5002884, KB5002903
What you should do
If you run the affected products, install Microsoft's update (KB5002884, KB5002903 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002884, KB5002903 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+12 more)Fix KB5002884, KB5002903
What you should do
If you run the affected products, install Microsoft's update (KB5002884, KB5002903 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Numeric truncation error in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Excel Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5002884, KB5002903 and release notes).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+12 more)Fix KB5002884, KB5002903
What you should do
If you run the affected products, install Microsoft's update (KB5002884, KB5002903 and release notes); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Services
Microsoft 365 Apps
Tags
Microsoft Office Excel, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Office Graphics Component Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (see the release notes linked in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems (+9 more)Fix see release notes
What you should do
If you run the affected products, install Microsoft's update (see the release notes linked in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Microsoft Office, Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability. Microsoft gives no severity rating; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation More Likely. Microsoft marks customer action as required but lists no specific update or mitigation in the advisory data.
Severity not ratedExploited NoDisclosed NoAffects not listedFix none listed
What you should do
Open the advisory to see which of your products are affected; Microsoft lists no specific update here. from Microsoft's advisory data
Why: Microsoft marks customer action as required but lists no specific update, so check whether your products are affected.
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
Type
Security updates
Tags
Windows Cross Device Service, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation More Likely · Remediation: none listed
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (n/a) is Microsoft's rating and is not treated as proof that action is needed.
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and 3 more).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems (+8 more)Fix KB5120238, KB5120242, KB5120229 and 3 more
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and 3 more); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Health Attestation (DHA) allows an unauthorized attacker to execute code over a network.
Severity
Critical · CVSS 8.1
Type
Security updates
Tags
Windows Device Health Attestation (DHA), Remote Code Execution, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.
Windows Key Guard Elevation of Privilege Vulnerability. Microsoft rates it Critical; not reported as exploited; not publicly disclosed; exploitability assessment: Exploitation Less Likely. Microsoft publishes a customer-installable fix (KB5120238, KB5120242, KB5120229 and others listed in the advisory).
Severity CriticalExploited NoDisclosed NoAffects Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems (+28 more)Fix KB5120238, KB5120242, KB5120229 and others listed in the advisory
What you should do
If you run the affected products, install Microsoft's update (KB5120238, KB5120242, KB5120229 and others listed in the advisory); the advisory lists the exact build per product. from Microsoft's advisory data
Why: Microsoft lists a customer-installable fix, so it matters if you run the affected products.
Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.
Severity
Critical · CVSS 7.8
Type
Security updates
Tags
Windows Key Guard, Elevation of Privilege, 2026-Aug
Microsoft advisory data
Customer action required: Yes · Exploited: No · Publicly disclosed: No · Exploitation Less Likely · Remediation: update published
Classification
Derived from Microsoft's structured advisory fields, not by AI. Severity (Critical) is Microsoft's rating and is not treated as proof that action is needed.