September 2026
Microsoft shipped 2772 fixes in its September 2026 security updates. 135 are Critical severity, under active exploitation, or were publicly disclosed before a fix shipped — those are listed below. The rest: 1340 fixes to open-source packages bundled for Microsoft’s Azure Linux container distro, 435 Chromium fixes shipped through Microsoft Edge, and 862 lower-severity, non-exploited, non-publicly-disclosed fixes to Microsoft products — are counted here but not listed row by row.
Built by Daily CISO from Microsoft’s own update guide for this release (initial release September 8, 2026, last revised October 10, 2026); not an official Microsoft page. The full 2772-fix list, including every Azure Linux and Edge/Chromium entry, is on Microsoft’s own page, linked above.
CVE-2026-62874: Azure Billing Elevation of Privilege Vulnerability
Critical
Azure Billing
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69399: Azure Arc Elevation of Privilege Vulnerability
Critical
Azure ARC
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69843: Microsoft Fabric Elevation of Privilege Vulnerability
Critical
Microsoft Fabric
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-69865: Microsoft Container Registry Elevation of Privilege Vulnerability
Critical
Azure Container Registry
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-70200: Azure Logic Apps Elevation of Privilege Vulnerability
Critical
Azure Logic Apps
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-70352: Azure AI Language Elevation of Privilege Vulnerability
Critical
Azure AI Language Authoring
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-83711: Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Critical
Microsoft Azure Active Directory B2C
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-83944: Azure Logic Apps Elevation of Privilege Vulnerability
Critical
Azure Logic Apps
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-85889: Azure AI Foundry Elevation of Privilege Vulnerability
Critical
Azure AI Foundry
CVSS 10.0 · Microsoft says no customer action required
CVE-2026-83941: Entra ID Elevation of Privilege Vulnerability
Critical
Microsoft Entra ID
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-85878: Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Critical
Azure HorizonDB
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-85885: Microsoft 365 Copilot Elevation of Privilege Vulnerability
Critical
Microsoft 365 Copilot
CVSS 9.9 · Microsoft says no customer action required
CVE-2026-66302: Skype for Business Remote Code Execution Vulnerability
Critical
Skype for Business Server 2015 CU13, Skype for Business Server 2019 CU8, Skype for Business Server Subscription Edition CU1
CVSS 9.8
CVE-2026-67631: Microsoft SQL Server Remote Code Execution Vulnerability
Critical
Microsoft SQL Server 2017 for x64-based Systems (CU 31), Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR), +4 more
CVSS 9.8
CVE-2026-67643: Microsoft SQL Server Remote Code Execution Vulnerability
Critical
Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft SQL Server 2022 for x64-based Systems (GDR), Microsoft SQL Server 2025 for x64-based Systems (CU8), Microsoft SQL Server 2025 for x64-based Systems (GDR)
CVSS 9.8
CVE-2026-69579: Windows Message Queuing Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-69590: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-69595: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 9.8
CVE-2026-69730: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 9.8
CVE-2026-69769: Windows HTTP Print Provider Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-69829: Windows Shell Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-69845: Windows DHCP Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 9.8
CVE-2026-70296: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-72979: Windows DHCP Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 9.8
CVE-2026-72982: Windows Netlogon Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-72983: Internet Connection Sharing (ICS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-73009: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-73010: Microsoft Failover Cluster Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 9.8
CVE-2026-77493: Windows Graphics Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 9.8
CVE-2026-78445: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 9.8
CVE-2026-78509: Microsoft Office Outlook Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 9.8
CVE-2026-65669: Microsoft SQL Server Elevation of Privilege Vulnerability
Critical
SQL Server Management Studio 22
CVSS 9.6
CVE-2026-87701: Azure Cosmos DB Elevation of Privilege Vulnerability
Critical
Azure Cosmos DB
CVSS 9.6 · Microsoft says no customer action required
CVE-2026-70009: Azure Arc Elevation of Privilege Vulnerability
Critical
Azure ARC
CVSS 9.3 · Microsoft says no customer action required
CVE-2026-80098: Copilot Studio Elevation of Privilege Vulnerability
Critical
Microsoft Copilot Studio
CVSS 9.3 · Microsoft says no customer action required
CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages
Critical
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8), Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10), Microsoft Visual Studio 2022 version 17.14, Microsoft Visual Studio 2026 version 18.9, +2 more
CVSS 9.1
CVE-2026-62916: Microsoft Entra ID Elevation of Privilege Vulnerability
Critical
Microsoft Entra ID
CVSS 9.1 · Microsoft says no customer action required
CVE-2026-67378: Microsoft SQL Server Remote Code Execution Vulnerability
Critical
Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft SQL Server 2022 for x64-based Systems (GDR), +2 more
CVSS 9.0
CVE-2026-67636: Microsoft SQL Server Remote Code Execution Vulnerability
Critical
Microsoft SQL Server 2019 for x64-based Systems (CU 32), Microsoft SQL Server 2019 for x64-based Systems (GDR), Microsoft SQL Server 2022 for x64-based Systems (CU 26), Microsoft SQL Server 2022 for x64-based Systems (GDR), +2 more
CVSS 9.0
CVE-2026-69854: Spring Cloud Azure Elevation of Privilege Vulnerability
Critical
Spring Cloud Azure
CVSS 9.0
CVE-2026-77903: Microsoft Dataverse Elevation of Privilege Vulnerability
Critical
Microsoft Dataverse
CVSS 9.0 · Microsoft says no customer action required
CVE-2026-65772: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Critical
Microsoft Dynamics 365 (on-premises) version 9.1
CVSS 8.8
CVE-2026-69285: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +6 more
CVSS 8.8
CVE-2026-69499: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-69518: Windows Remote Desktop Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-69601: Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-69603: Windows Hyper-V Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +24 more
CVSS 8.8
CVE-2026-69632: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 8.8
CVE-2026-69649: Raw Image Extension Remote Code Execution Vulnerability
Critical
Raw Image Extension on Windows 10 Version 21H2 for 32-bit Systems, Raw Image Extension on Windows 10 Version 21H2 for ARM64-based Systems, Raw Image Extension on Windows 10 Version 21H2 for x64-based Systems, Raw Image Extension on Windows 10 Version 22H2 for 32-bit Systems, +8 more
CVSS 8.8
CVE-2026-69676: Windows Kerberos Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-69678: Microsoft Office PowerPoint Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 8.8
CVE-2026-69712: Windows Key Distribution Center Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 8.8
CVE-2026-69740: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +4 more
CVSS 8.8
CVE-2026-69767: Microsoft Office PowerPoint Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 8.8
CVE-2026-69784: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 8.8
CVE-2026-69797: Microsoft Office PowerPoint Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 8.8
CVE-2026-69860: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-70203: Windows Media Player Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-70351: Microsoft WebP Image Extension Remote Code Execution Vulnerability
Critical
WebP Image Extension
CVSS 8.8
CVE-2026-70586: Windows Paint Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-72950: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-72959: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-72960: Windows Media Player Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 8.8
CVE-2026-72986: Graphic Fonts Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-73006: DirectWrite Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 8.8
CVE-2026-73013: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-73018: Graphic Fonts Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-73023: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-77495: Windows Imaging Component Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-77504: Microsoft Office Word Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.8
CVE-2026-78439: Microsoft Office Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft Office 365 for Mac, Microsoft Office LTSC for Mac 2021, Microsoft Office LTSC for Mac 2024, Microsoft Office for Android
CVSS 8.8
CVE-2026-78505: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 8.8
CVE-2026-78519: Microsoft Office Outlook Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +6 more
CVSS 8.8
CVE-2026-78525: Microsoft Office Outlook Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 8.8
CVE-2026-80083: Windows Hyper-V Remote Code Execution Vulnerability
Critical
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +8 more
CVSS 8.8
CVE-2026-81352: Web Media Extensions Remote Code Execution Vulnerability
Critical
Web Media Extensions on Windows 10 Version 21H2 for 32-bit Systems, Web Media Extensions on Windows 10 Version 21H2 for ARM64-based Systems, Web Media Extensions on Windows 10 Version 21H2 for x64-based Systems, Web Media Extensions on Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 8.8
CVE-2026-81952: Microsoft Word Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 8.8
CVE-2026-81955: Windows Graphics Component Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +39 more
CVSS 8.8
CVE-2026-68791: Azure Machine Learning Information Disclosure Vulnerability
Critical
Azure Machine Learning
CVSS 8.6 · Microsoft says no customer action required
CVE-2026-65818: Power Automate Elevation of Privilege Vulnerability
Critical
Microsoft Power Platform
CVSS 8.5 · Microsoft says no customer action required
CVE-2026-69857: Azure Cosmos DB Spoofing Vulnerability
Critical
Azure Cosmos DB
CVSS 8.5 · Microsoft says no customer action required
CVE-2026-70178: Microsoft Fabric Elevation of Privilege Vulnerability
Critical
Microsoft Fabric
CVSS 8.5 · Microsoft says no customer action required
CVE-2026-78510: Microsoft Outlook and Word Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2016 (32-bit edition), Microsoft Office 2016 (64-bit edition), +9 more
CVSS 8.4
CVE-2026-69820: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 8.2
CVE-2026-69846: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 8.2
CVE-2026-69874: Windows ALPC Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, +18 more
CVSS 8.2
CVE-2026-69906: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 8.2
CVE-2026-72958: Windows Credential Guard Elevation of Privilege Vulnerability
Critical
Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, +4 more
CVSS 8.2
CVE-2026-72961: Windows Hyper-V Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 8.2
CVE-2026-72962: Windows USB Video Driver Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, +18 more
CVSS 8.2
CVE-2026-81354: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, +14 more
CVSS 8.2
CVE-2026-83939: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Critical
Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems
CVSS 8.2
CVE-2026-83946: Azure Portal Spoofing Vulnerability
Critical
Azure Portal
CVSS 8.2 · Microsoft says no customer action required
CVE-2026-85921: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Critical
Windows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems
CVSS 8.2
CVE-2026-69530: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-69813: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-69827: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-69858: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation)
CVSS 8.1
CVE-2026-72981: IP Helper Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.1
CVE-2026-72987: Windows DNS Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-77505: Windows DNS Server Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 8.1
CVE-2026-78444: Microsoft Failover Cluster Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-78449: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 8.1
CVE-2026-78450: Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation), +4 more
CVSS 8.1
CVE-2026-58599: HEVC Video Extensions Remote Code Execution Vulnerability
Critical
HEVC Video Extensions, HEVC Video Extensions for Licensed Applications, HEVC Video Extensions from Device Manufacturer on Windows 10 Version 1809 for 32-bit Systems, HEVC Video Extensions from Device Manufacturer on Windows 10 Version 1809 for x64-based Systems, +20 more
CVSS 7.8
CVE-2026-69725: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 7.8
CVE-2026-69799: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 7.8
CVE-2026-69864: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 7.8
CVE-2026-72957: Windows Deployment Services Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 7.8
CVE-2026-81948: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-81949: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-81950: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-81951: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-81953: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-81959: Microsoft Excel Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Excel 2016 (32-bit edition), Microsoft Excel 2016 (64-bit edition), +11 more
CVSS 7.8
CVE-2026-83498: Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
Critical
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +6 more
CVSS 7.8
CVE-2026-85887: M365 Copilot Information Disclosure Vulnerability
Critical
Microsoft 365 Copilot
CVSS 7.7 · Microsoft says no customer action required
CVE-2026-69710: Windows Hello Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +10 more
CVSS 7.5
CVE-2026-69852: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 7.5
CVE-2026-69890: Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, +18 more
CVSS 7.5
CVE-2026-72954: Windows Deployment Services Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +12 more
CVSS 7.5
CVE-2026-73017: Graphics Kernel Remote Code Execution Vulnerability
Critical
Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, +18 more
CVSS 7.5
CVE-2026-77898: Microsoft Office Remote Code Execution Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +7 more
CVSS 7.5
CVE-2026-81355: Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +26 more
CVSS 7.5
CVE-2026-85917: Azure AI Foundry Elevation of Privilege Vulnerability
Critical
Azure AI Foundry
CVSS 7.5 · Microsoft says no customer action required
CVE-2026-62906: Microsoft Discovery Studio Information Disclosure Vulnerability
Critical
Microsoft Discovery Studio
CVSS 7.4 · Microsoft says no customer action required
CVE-2026-78501: Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability
Critical
Microsoft 365 Copilot's Business Chat
CVSS 7.4 · Microsoft says no customer action required
CVE-2026-69501: Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Critical
Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems, +14 more
CVSS 7.0
CVE-2026-70585: Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Critical
Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), +8 more
CVSS 7.0
CVE-2026-78520: Microsoft Office Outlook Information Disclosure Vulnerability
Critical
Microsoft 365 Apps for Enterprise for 32-bit Systems, Microsoft 365 Apps for Enterprise for 64-bit Systems, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, +9 more
CVSS 6.5
CVE-2026-55946: Microsoft Copilot Information Disclosure Vulnerability
Critical
Microsoft Copilot
CVSS 6.1 · Microsoft says no customer action required
CVE-2026-83501: Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability
Critical
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +6 more
CVSS 5.5
CVE-2026-72980: Windows Hello Security Feature Bypass Vulnerability
Critical
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +22 more
CVSS 4.4
CVE-2026-81963: Windows Update Stack Elevation of Privilege Vulnerability
Important
Windows 11 Version 23H2 for ARM64-based Systems, Windows 11 Version 23H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems, +6 more
CVSS 7.8 · actively exploited
CVE-2026-85880: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Important
Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, +16 more
CVSS 7.8 · actively exploited