Local code execution in Microsoft Office Word (Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Word 2016, and the macOS builds) arises from a stack-based buffer overflow triggered when a victim opens a maliciously crafted document. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) shows an unauthenticated attacker needs no privileges but does require user interaction, and successful exploitation yields full confidentiality, integrity, and availability impact in the user's security context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has released a patch.
Local code execution in Microsoft Office Word (via a stack-based buffer overflow, CWE-121) lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. The flaw affects Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021/2024 (including Mac editions), and the Word component shared with SharePoint Server 2016/2019/Subscription Edition. No public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation requires the victim to open the attacker's file (UI:R).
Local code execution in Microsoft Office Word (across Microsoft 365 Apps, Office 2019/LTSC 2021/2024, Office for Mac, and Word 2016) allows an attacker to run arbitrary code by exploiting a use-after-free memory corruption flaw when a victim opens a maliciously crafted document. The CVSS 3.1 base score is 7.8 with a local attack vector requiring user interaction; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV. Microsoft, which reported the issue itself, has released a patch.
Denial of service in the Netty netty-codec-stomp module (versions 4.1.x up to 4.1.135.Final and 4.2.0.Alpha1 through 4.2.15.Final) allows a remote attacker to trigger an OutOfMemoryError and crash the JVM. The StompSubframeDecoder caps individual header line length via maxLineLength but never bounds the total header count or cumulative header size, so a single STOMP frame packed with thousands of short headers exhausts heap memory. Publicly available exploit code exists (a working client/server PoC is published in the GitHub Security Advisory), but there is no public evidence of active exploitation; EPSS/KEV signals are not present in the input.
Output spoofing via improper encoding in Microsoft .NET 8.0, 9.0, and 10.0 allows a low-privileged network attacker to manipulate encoded output, enabling content or identity spoofing with high integrity impact. Affected products span three active .NET generations plus Visual Studio 2022 (17.12, 17.14) and Visual Studio 2026 (18.7), creating a broad enterprise attack surface. A publicly available proof-of-concept exploit exists on GitHub; however, CISA SSVC reports exploitation status as none and EPSS sits at 0.41% (34th percentile), suggesting opportunistic rather than widespread active threat activity at time of analysis.
Uncontrolled memory consumption in Python Pillow (PIL) versions 5.1.0 through 12.2.x allows a remote attacker to cause denial of service by supplying a small crafted PDF whose FlateDecode stream declares a large Length; PdfParser.PdfStream.decode() passes this attacker-controlled Length straight to zlib.decompress() as the bufsize with no upper bound, so a tiny file inflates into gigabytes of decompressed data and exhausts host memory. Fixed in 12.3.0 by streaming decompression with a bounded max_length. No public exploit identified at time of analysis and this CVE is not in CISA KEV, but the trigger is trivial to construct.
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets an attacker corrupt the stack by supplying an oversized 'page' argument to the /goform/DhcpListClient web endpoint handled by the fromDhcpListClient function. The flaw is reachable over the network and publicly available exploit code exists (disclosed via VulDB), though it is not listed in CISA KEV and no EPSS score was provided. Per the supplied CVSS 4.0 vector (PR:L) the attack requires low-level authentication to the device, and successful exploitation can crash the router or potentially achieve arbitrary code execution.
Local File Read in Anyquery's Server Mode lets unauthenticated network attackers exfiltrate arbitrary files (e.g. /etc/passwd, ~/.ssh/id_rsa) readable by the server process. When `anyquery server` is running and reachable, any client speaking the MySQL wire protocol can issue native SQLite CREATE VIRTUAL TABLE statements against built-in reader modules such as csv_reader or log_reader to point at restricted paths, with no authentication or credentials required (CVSS 3.1 base 7.5, C:H/I:N/A:N). A working proof-of-concept is published in the GHSA advisory, so publicly available exploit code exists; there is no CISA KEV listing or EPSS score in the provided data.
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race condition (CWE-362) to gain SYSTEM-level rights across nearly all supported Windows client and server builds, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has shipped fixes and publicly available exploit code exists, though EPSS rates near-term mass exploitation modestly at 2.16% (80th percentile) and CISA's SSVC framework records no observed exploitation, indicating opportunistic rather than widespread abuse. The high AC:H reflects the timing-dependent nature of the flaw, which reduces reliability but does not eliminate risk on multi-user or shared hosts.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) allows remote attackers to corrupt memory via the fromVirtualSer handler for the /goform/VirtualSer endpoint by supplying an oversized 'page' argument. The flaw carries CVSS 4.0 7.4 and, per its vector, requires low-level privileges (PR:L); publicly available exploit code exists, though there is no public exploit identified as actively used in the wild (not in CISA KEV). Successful exploitation can crash the device or potentially lead to arbitrary code execution on the embedded MIPS/ARM firmware.
Stack-based buffer overflow in the Tenda BE12 Pro router (firmware 16.03.66.23) lets attackers corrupt memory by manipulating the 'page' argument passed to the fromSetIpBind function of the /goform/SetIpBind endpoint. The flaw is remotely reachable over the network and, per the CVSS 4.0 vector, requires low-level privileges (PR:L) while yielding high confidentiality, integrity, and availability impact - typically resulting in device crash or arbitrary code execution on the router. Publicly available exploit code exists (E:P), disclosed via VulDB, though it is not listed in CISA KEV.
Stack-based buffer overflow in the Tenda BE12 Pro Wi-Fi router (firmware 16.03.66.23) lets remote attackers corrupt memory by manipulating the 'page' argument of the fromSafeMacFilter handler at /goform/SafeMacFilter. Publicly available exploit code exists, though there is no public exploit identified as being used in active campaigns and it is not listed in CISA KEV. Successful exploitation can crash the device or potentially achieve code execution on the router's embedded OS. EPSS data was not provided.
Stack-based buffer overflow in the Tenda BE12 Pro router firmware 16.03.66.23 lets an authenticated remote attacker corrupt memory via the fromSafeUrlFilter handler at /goform/SafeUrlFilter by supplying an oversized 'page' parameter. Publicly available exploit code exists (published via VulDB), though the flaw is not listed in CISA KEV and no active exploitation has been confirmed. The CVSS 4.0 vector (7.4, PR:L) indicates network reachability with low-privilege authentication and high impact to confidentiality, integrity, and availability of the device.
Stack-based buffer overflow in the Tenda BE12 Pro (firmware 16.03.66.23) web management interface lets an attacker corrupt memory by supplying an oversized 'page' argument to the fromSafeClientFilter handler at /goform/SafeClientFilter, potentially crashing the device or executing arbitrary code with router privileges. Per the CVSS 4.0 vector the flaw is network-reachable but requires low-level privileges (PR:L). Publicly available exploit code exists (disclosed via VulDB), but there is no public exploit identified as being used in active attacks and it is not listed in CISA KEV.
Path traversal in Adobe ColdFusion allows an authenticated remote attacker (PR:L) to read arbitrary files outside the intended web/application scope by manipulating pathname input, per Adobe advisory APSB26-82. The flaw carries a critical 9.9 CVSS with a changed scope, meaning a successful read can reach files belonging to other security contexts on the host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS was not provided.
SQL injection in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged authenticated attacker to inject malicious SQL that can escalate to arbitrary code execution in the context of the current user, enabling account/session takeover. The flaw (CWE-89) is network-reachable and requires no user interaction, but demands existing high privileges per the CVSS PR:H metric. No public exploit is identified at time of analysis and it is not listed in CISA KEV; EPSS was not provided.
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) arises from unsafe deserialization of untrusted data (CWE-502), letting an attacker who can reach the database over the network run arbitrary code in the SQL Server process context. Microsoft rates it critical (CVSS 9.8) and has shipped fixes across all supported branches; there is no public exploit identified at time of analysis and CISA SSVC lists exploitation as none. EPSS is modest at 1.29% (67th percentile), consistent with a serious-but-not-yet-exploited server-side flaw.
Remote code execution in Microsoft SQL Server 2025 (GDR builds 17.0.1050.2 to 17.0.1125.2 and CU 6 line 17.0.4060.2) arises from unsafe deserialization of untrusted data (CWE-502), letting an authorized attacker run arbitrary code over the network with total impact to confidentiality, integrity, and availability. Microsoft, the reporting party, rates it CVSS 9.8, though the description's 'authorized attacker' wording conflicts with the vector's PR:N and should be verified. There is no public exploit identified at time of analysis, EPSS is a moderate 1.29% (67th percentile), and CISA SSVC records exploitation status as none.
Cross-site request forgery in the Sustainable Irrigation Platform (SIP) through 5.2.16 lets remote attackers execute state-changing administrative actions when a logged-in administrator is lured to a malicious page, because administrative endpoints accept HTTP GET requests with no CSRF token or origin validation. An attacker can disable the passphrase, reboot the irrigation controller, delete watering programs, or install plugins; in the default configuration these endpoints are exposed to unauthenticated users because no passphrase is required and the default credential is 'opendoor'. Publicly available exploit code exists (ZeroScience ZSL-2026-5995), though there is no public exploit identified as being used in active campaigns.
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary code by triggering the use of an uninitialized resource (CWE-908). All currently supported Windows client and server releases are affected, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The CVSS 3.1 base score is 9.8 with a network, no-privileges, no-interaction vector; there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary code over the network by corrupting heap memory. The flaw (CWE-122) carries a CVSS 9.8 and affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Server 2025. No public exploit is identified at time of analysis, but the network-reachable, no-interaction, no-privilege profile of prior MSMQ bugs (e.g. the 'QueueJumper' class) makes this a top-priority patch. Microsoft has released a fix.
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122) in the service's packet handling. The flaw carries a CVSS 9.8 with a fully remote, no-interaction, no-privilege vector and affects Windows Server 2012 through 2025 (plus the Windows 10 1607/1809 code base). At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV, but the unauthenticated network-facing nature of the DHCP service makes it a high-priority patch.
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122). The flaw affects the FTP service across a broad range of Windows 10, Windows 11, and Windows Server (2019/2022/2025) builds and carries a critical CVSS 9.8 rating with no authentication or user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, network-reachable nature of the bug makes it a high-priority patch target.
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets a remote, unauthenticated attacker defeat a cryptographic-signature check over the network — most likely a JWT/token signature verification flaw per the vendor 'Jwt Attack' and 'Authentication Bypass' tags. By forging or tampering with signed data the runtime fails to validate correctly, an attacker can impersonate trusted principals and undermine an authentication or integrity control. Microsoft has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored/reflected cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a network-based, unauthenticated attacker inject malicious script that executes in a victim's browser session, enabling spoofing and - per the scope-changed CVSS 9.6 vector - high impact to confidentiality, integrity, and availability of resources beyond the vulnerable component. Exploitation requires the target to view attacker-controlled content (UI:R). Microsoft has released a patch; no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution in Microsoft Windows GDI+ (gdiplus) lets an unauthenticated network attacker run arbitrary code when a victim opens or renders a specially crafted image, via a heap-based buffer overflow (CWE-122). The flaw affects a broad range of supported Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). It carries a critical CVSS 9.6 with a scope-changed impact, but requires user interaction and currently has no public exploit identified at time of analysis.
External file path control in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition allows authenticated low-privileged network attackers to perform spoofing, resulting in high confidentiality impact (C:H per CVSS). Exploitation requires no special configuration or user interaction, only a valid SharePoint account. No active exploitation is confirmed - SSVC rates exploitation as none, EPSS sits at 0.71% (49th percentile), and this CVE does not appear in CISA KEV - placing this as a medium-priority patching item despite its network-reachable, low-complexity attack profile.
Server-side request forgery in Microsoft SharePoint Server enables authenticated, low-privileged users to force the server to issue outbound network requests, exposing internal resources and sensitive data not directly accessible to the attacker. All three actively supported SharePoint server editions are affected: Enterprise Server 2016, Server 2019, and Subscription Edition. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.59% (44th percentile) and SSVC rates exploitation as none, indicating limited real-world exploitation activity despite the medium-high CVSS score.
jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact.
Security feature bypass in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks plugin allows a high-privileged, authenticated attacker to defeat an authorization check (CWE-863) and gain unauthorized read access to data that should be restricted. The flaw is network-reachable with low complexity, requires no user interaction, and changes scope, so the exposure can reach beyond the initially vulnerable component. There is no public exploit identified at time of analysis and no CISA KEV listing, making exploitation currently theoretical rather than observed.
Account takeover in the WP 2FA WordPress plugin (all versions before 3.1.1.2) is achievable by any attacker who has obtained a valid user's credentials. The plugin fails to verify that the email address submitted during two-factor authentication enrollment belongs to the authenticated account (CWE-862: Missing Authorization), allowing the attacker to redirect the setup verification code to an attacker-controlled inbox and complete 2FA enrollment on behalf of the victim. A publicly available proof-of-concept exists per WPScan; this vulnerability is not currently listed in the CISA KEV catalog, but the combination of a PoC, medium-prevalence deployment, and account-takeover impact warrants prompt patching.
Server-side request forgery in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows unauthenticated network attackers to weaponize the device as an HTTP proxy against internal or external hosts. Exploitation requires the optional Node-RED plugin to be installed and leverages the known default passphrase 'opendoor' to bypass authentication to the plugin interface - dramatically lowering the practical barrier for blind SSRF. A publicly available proof-of-concept exploit exists per ZeroScience advisory ZSL-2026-5998; no CISA KEV listing at time of analysis.
Server-side request forgery in Adobe ColdFusion lets a low-privileged, authenticated attacker coerce the server into issuing crafted outbound requests, bypassing a security control and gaining unauthorized read access to resources the attacker should not reach. The CVSS 3.1 scope-changed vector (S:C, C:H) indicates the impact extends beyond ColdFusion itself to backend or internal systems it can reach. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; remediation is available via Adobe security bulletin APSB26-82.
Authentication bypass in Siemens Opcenter X (all versions before V2604) lets an unauthenticated remote attacker forge JSON Web Tokens by exploiting improper validation of the algorithm field in the JWT header. Because the application trusts the attacker-controlled 'alg' value, an attacker can craft tokens that impersonate any user - including administrators - yielding full unauthorized access to the manufacturing operations platform. Rated CVSS 10.0 with a scope-changing critical impact; no public exploit identified at time of analysis and it is not currently in CISA KEV.
Remote code execution in Microsoft Dynamics NAV 2018 allows an unauthorized, network-based attacker to run arbitrary code by submitting maliciously crafted serialized data that the application deserializes without validation (CWE-502). With a CVSS 9.8 vector requiring no authentication and no user interaction, successful exploitation grants full compromise of the ERP host. Microsoft has released a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Server-Side Request Forgery and information disclosure in Roundcube Webmail (1.6.x before 1.6.17 and 1.7.x before 1.7.2) arises from insufficient CSS sanitization in HTML email messages, allowing an attacker who sends a crafted message to make the mail server fetch attacker-chosen URLs - including internal/local network hosts - via stylesheet links. This is a re-fix of CVE-2026-35540 and CVE-2026-48843, whose prior patches were incomplete, and the 1.7.2 notes explicitly cite 'SSRF bypass via specific local address URLs - two new cases.' No public exploit is identified at time of analysis and the vulnerability is not on CISA KEV; EPSS is low (0.22%, 13th percentile) despite the source-assigned CVSS of 10.0.
Arbitrary code execution in Adobe ColdFusion 2023 (through Update 21) and ColdFusion 2025 (through Update 10) allows an unauthenticated attacker on an adjacent network to run code in the context of the current user via improper input validation, with no user interaction required and a scope change extending impact beyond the vulnerable component. Adobe (APSB26-82) rates it CVSS 9.6; there is no public exploit identified at time of analysis and CISA's SSVC framework reports exploitation status 'none'. EPSS estimates a 2.17% 30-day exploitation probability (80th percentile), notable but not extreme for a critical-rated ColdFusion RCE.
Privilege escalation via a heap-based buffer overflow (CWE-122) in the Windows Remote Desktop Client lets an unauthorized network attacker corrupt heap memory and gain total control of the target host. The flaw affects the built-in RDP client across the entire supported Windows line, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has shipped patches; there is no public exploit identified at time of analysis and it is not in CISA KEV, though CISA's SSVC assessment rates the flaw automatable with total technical impact.
Unauthenticated remote command execution on Rockwell Automation's 1715-AENTR EtherNet/IP Adapter arises from a network-accessible debug port that enforces no privilege controls, exposing intrusive CLI commands to any attacker who can reach the device. An unauthenticated remote actor can read and delete files, halt tasks, modify memory, and manipulate physical I/O states, giving full control over device confidentiality, integrity, and availability. Rated CVSS 4.0 10.0 (Critical) with subsequent-system impact; no public exploit has been identified at time of analysis.
Remote code execution in Microsoft Windows Admin Center allows an authenticated attacker to run arbitrary code over the network by exploiting a relative path traversal (CWE-23) flaw. Any user holding valid low-privilege credentials to the WAC gateway can leverage the traversal to break out of the intended file path and achieve full compromise (confidentiality, integrity, and availability impact all High). Microsoft has published a patch via MSRC; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.
Code injection (CWE-94) in Adobe ColdFusion 2023 (Update 21 and earlier) and ColdFusion 2025 (Update 10 and earlier) allows a low-privileged, network-adjacent attacker to execute arbitrary code in the context of the current user without any user interaction. Because the CVSS scope is changed, successful exploitation can extend impact beyond the vulnerable component to the underlying host. There is no public exploit identified at time of analysis and the EPSS probability is low (0.43%, 35th percentile), but the near-maximum CVSS of 9.9 and Adobe's own PSIRT reporting make this a high-priority patch.
Authenticated remote code execution in Microsoft Windows Admin Center (CWE-77) lets an attacker with low-privilege access inject and run arbitrary commands over the network, yielding full confidentiality, integrity, and availability compromise (CVSS 8.8). Microsoft has released a patch; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Cross-tenant data exposure in n8n-mcp (npm package, <= 2.56.0) lets an authenticated tenant on a shared multi-tenant HTTP instance read, delete, and destroy the automatic workflow version backups belonging to other tenants. Because each snapshot embeds full node definitions, the leaked data can include credential references and authorization headers, making this both a confidentiality and an integrity/availability failure. Rated CVSS 9.9 due to the scope change across tenant trust boundaries; no public exploit is identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Microsoft Fabric Data Warehouse allows an authenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). The flaw carries a CVSS 8.8 rating with high impact to confidentiality, integrity, and availability, and requires only low-privilege access with no user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available via MSRC.
Remote code execution in Microsoft Windows Media Foundation allows an unauthenticated network attacker to run arbitrary code by triggering a heap-based buffer overflow (CWE-122) in the media-processing pipeline, per the CVSS:3.1 vector (AV:N/PR:N/UI:N). The flaw affects a broad range of client and server SKUs from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with EPSS estimating a modest 0.83% 30-day exploitation probability.
Remote code execution in Microsoft Windows Remote Desktop Protocol allows an unauthorized, unauthenticated network attacker to run arbitrary code by triggering an integer overflow (CWE-190) in RDP processing. The flaw carries a CVSS 9.8 and affects a broad range of Windows client and server builds from Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is a modest 0.78% (52nd percentile), so risk is currently theoretical but severe if weaponized.
Security-feature bypass in Microsoft Visual Studio Code lets a remote attacker deliver functionality from an untrusted control sphere (CWE-829) that circumvents a built-in protection, yielding high confidentiality, integrity, and availability impact once a victim opens or interacts with attacker-supplied content. Rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R), it requires user interaction but no authentication, and Microsoft has released a fix via MSRC. There is no public exploit identified at time of analysis and it is not on the CISA KEV list.
Privilege escalation in the Microsoft Windows DHCP Client service, driven by an integer underflow (CWE-191) triggered when processing DHCP traffic, lets an unauthorized network attacker gain elevated privileges with full confidentiality, integrity, and availability impact. It affects a broad Windows fleet spanning Windows 10 (1607/1809) and Windows Server 2012 through 2025, including Server Core installations. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is modest at 0.76% (51st percentile), but the vendor rates it critical (CVSS 9.8) and CISA SSVC flags it as Automatable.