Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.
Memory exhaustion in the Windows DHCP Server role across Windows Server 2012 through 2025 allows a low-privileged network-authenticated attacker to crash or render the DHCP service unresponsive, denying IP address assignment to all network clients. The root cause (CWE-401) is a failure to release allocated memory after its effective lifetime during DHCP request processing, enabling gradual heap exhaustion. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing exists at time of analysis.
Auth0 AD/LDAP Connector versions 6.5.0 and earlier expose an administrative management panel on the local loopback interface with no authentication requirement, allowing any low-privileged local user or co-resident process to read plaintext Active Directory service account credentials and modify connector configuration without presenting credentials. The impact extends beyond the connector itself: exposed AD service account passwords enable lateral movement and privilege escalation within the broader Active Directory environment. No public exploit code or CISA KEV listing is recorded at time of analysis, but the attack requires only a basic HTTP client and local system access.
Unthrottled resource allocation in the Windows SMB Server component (CWE-770) allows a low-privilege authenticated attacker to exhaust server resources over a network connection, causing a denial of service. Affected platforms span Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across both standard and Server Core installations. Microsoft has released patches for all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Windows Compressed Folder's built-in ZIP handler on Windows 11 and Windows Server 2025 allows a network-adjacent attacker to craft a malicious archive exploiting NTFS hard link abuse (CWE-65) to read sensitive files outside the intended extraction path, resulting in high-confidentiality information disclosure. Exploitation requires victim interaction - the user must open or expand the crafted compressed archive in Windows Explorer - but no attacker authentication or special privileges are needed. No CISA KEV listing or public exploit code has been identified at time of analysis, and a vendor-released patch is available via MSRC.
Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.
Heap-based buffer overflow in the Windows Winsock networking subsystem enables local privilege escalation to SYSTEM-level on a broad range of Windows client and server releases. An attacker who already holds a high-privileged (but non-SYSTEM) local account can trigger CWE-122 heap corruption through Winsock to achieve full C:H/I:H/A:H impact. No public exploit code has been identified at time of analysis, and Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in Windows BitLocker enables an authorized local attacker with high privileges to achieve arbitrary code execution on the vulnerable system. The vulnerability affects an exceptionally broad range of Windows releases, from Windows Server 2012 through Windows 11 25H2 and 26H1, with vendor-confirmed patches available. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H requirement substantially limits the attacker pool to users already possessing administrator-level access.
Windows Overlay Filter (WOF), the kernel-mode filesystem filter driver present across virtually all supported Windows desktop and server releases, contains an integer overflow or wraparound that enables an already-privileged local attacker to further escalate privileges. The flaw spans Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 R2 through 2025, placing the vulnerable component in an exceptionally wide installed base. Microsoft has released patched builds; no public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Overlay Filter (WOF) kernel driver allows a locally authenticated attacker with pre-existing high-privilege access to escalate to full system control. The vulnerability affects virtually all supported Windows desktop and server releases, from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2012 R2 through Server 2025. Microsoft has released patches addressing this issue; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Microsoft Office PowerPoint exposes memory contents to remote attackers when a victim opens a specially crafted PowerPoint file. Affected products span PowerPoint 2016 through Microsoft 365 Apps for Enterprise across Windows and Mac. No public exploit code has been identified and SSVC classifies exploitation as none and not automatable, consistent with the user-interaction requirement that prevents mass exploitation.
SQL injection in Microsoft SharePoint Server Subscription Edition allows any network-authenticated low-privilege user to exfiltrate sensitive database contents without additional interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms that a standard SharePoint account is the only prerequisite, placing sensitive intranet data - documents, user records, site configuration - at risk. Microsoft has released a remediation build (16.0.20326.20082); no public exploits or CISA KEV listing have been identified at time of analysis.
Information disclosure in Microsoft SharePoint Server Subscription Edition allows a low-privileged authenticated attacker to read sensitive data over the network by leveraging a SharePoint component that executes with unnecessary elevated privileges (CWE-250). The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) reflects a straightforward network-accessible exploit requiring only basic user credentials, with no user interaction and high confidentiality impact. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Privilege escalation to SYSTEM in the Windows USB Audio Class driver (usbaudio.sys) is achievable by an attacker with physical device access who connects a specially crafted USB audio device. The integer overflow in the driver's input-handling logic produces an undersized heap allocation, enabling a subsequent heap-based buffer overflow (CWE-122) that corrupts kernel memory and permits arbitrary code execution at elevated privilege. The vulnerability spans a wide swath of supported Windows releases - from Windows 10 1809 through Windows 11 25H2 and Windows Server 2019/2022/2025 - making the patch surface broad. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV.
Out-of-bounds read in Microsoft Office (CWE-125) allows a remote unauthenticated attacker to disclose sensitive memory contents when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, Office 2016/2019, and their Mac counterparts - covering virtually the entire active Office install base. No public exploit code or active exploitation has been identified; SSVC rates the exploitation likelihood as none and technical impact as partial, consistent with the 6.5 CVSS base score.
Out-of-bounds read in Microsoft Office Outlook allows a remote, unauthenticated attacker to disclose sensitive information from process memory by inducing a user to open or interact with a maliciously crafted email or document. Affected products span Outlook 2016 through Microsoft 365 Apps for Enterprise, covering a large portion of the enterprise desktop install base. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches across all affected product lines via MSRC.
Out-of-bounds read in Microsoft Excel enables an unauthenticated remote attacker to disclose sensitive memory contents when a victim opens a crafted Excel file. The vulnerability spans a broad range of Office product lines - including Office 2016, 2019, 2021 LTSC, 2024 LTSC, Microsoft 365 Apps for Enterprise, and Mac variants - making the exposure surface wide. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via Microsoft's update guide.
Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.
Buffer over-read (CWE-126) in Microsoft Office Excel's file parsing engine allows remote information disclosure when a user opens a crafted spreadsheet file. Affected versions span Office 2016 through Office 2024 LTSC and Microsoft 365 Apps for Enterprise across Windows and Mac platforms, with fixed builds confirmed for Windows variants per EUVD-2026-73733. No public exploit code has been identified at time of analysis, and SSVC rates current exploitation as none with partial technical impact, consistent with the absence of a CISA KEV listing.
Untrusted pointer dereference in Microsoft Office PowerPoint exposes high-confidentiality memory contents to a remote, unauthenticated attacker who can convince a user to open a specially crafted presentation file. The flaw (CWE-822) allows the application to dereference a pointer sourced from untrusted file data without validation, enabling out-of-bounds or arbitrary memory reads that leak sensitive process memory over a network context. No public exploit code or CISA KEV listing is present at time of analysis, but the high-confidentiality CVSS rating and broad install base across all current Office versions make patch deployment a priority.
Type confusion (CWE-822) in Microsoft Office PowerPoint allows a remote unauthenticated attacker to disclose sensitive information from a victim's system by inducing them to open a specially crafted presentation file. The vulnerability spans Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024, Office 2019, and Mac variants of Office across multiple release channels. Vendor-released patches are available for Windows editions with specific fixed build numbers; no public exploit has been identified at time of analysis.
Out-of-bounds read in Microsoft Word across Office 2016 through Microsoft 365 Apps enables an unauthenticated remote attacker to disclose sensitive memory contents when a user opens a crafted document. The vulnerability (CWE-125) affects both Windows (x86/x64) and macOS deployments of the Office suite across multiple release tracks - retail, LTSC, and subscription. No public exploit or active exploitation has been identified at time of analysis, though the broad install base and socially-engineered document delivery make this a realistic phishing vector.
Out-of-bounds read in Microsoft Office Word enables remote attackers to disclose high-value in-process memory contents by convincing a user to open a specially crafted document. Affecting Microsoft 365 Apps for Enterprise, Word 2016, Office 2019/2021/2024 LTSC on Windows (x86/x64) and Office for Mac editions, this CWE-125 flaw requires no attacker authentication but does require victim interaction. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation as none with non-automatable delivery, consistent with the phishing/social-engineering delivery model implied by the UI:R CVSS metric.
Buffer over-read (CWE-126) in Microsoft Office exposes process memory contents to remote unauthenticated attackers when a victim opens a maliciously crafted Office document. The vulnerability spans a wide range of Office product lines across both Windows and macOS - including Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and the macOS Office 365/LTSC equivalents. No public exploit code has been identified and the CVE does not appear in the CISA KEV catalog at time of analysis; a vendor patch has been released across all affected product lines.
Integer overflow in Microsoft Office Word's document parsing engine triggers an out-of-bounds read (CWE-125), enabling a remote unauthenticated attacker to disclose potentially sensitive memory contents by inducing a victim to open a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS. Microsoft has released patches across all affected versions; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Buffer over-read (CWE-126) in Microsoft Office Word exposes sensitive process memory to a remote unauthenticated attacker who can deliver a maliciously crafted Word document and trick a user into opening it. The flaw affects a broad range of Microsoft Office products - Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC, and Word 2016 - across both Windows (x86/x64) and macOS platforms. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-supplied patches have been released addressing specific build versions across all affected product lines.
Eval injection in the Okta Access Gateway management console allows an authenticated administrator, connected via SSH, to execute arbitrary code with the privileges of the management console process. The root cause (CWE-95) is unsanitized user input passed directly to eval() in an exception handler context, meaning any administrative SSH session can be leveraged for full code execution. All versions prior to 2026.9.1 are affected; a vendor patch is available and no public exploit or active exploitation has been identified at time of analysis.
Configuration injection in Okta Access Gateway (all versions before 2026.9.1) allows a high-privileged authenticated attacker to embed arbitrary nginx directives into the gateway's auto-generated nginx server block configuration by placing unsanitized payload in the application label field. Once the configuration is regenerated and nginx reloads, the injected directives execute within the nginx context, enabling full server compromise including code execution, credential interception, and proxy manipulation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the high impact triad and the identity-gateway nature of the product make this a meaningful risk for affected Okta deployments.
Null pointer dereference in Microsoft Skype for Business Server allows any authenticated low-privilege user to crash the server over the network, causing a complete denial of communications service. Three on-premises product lines are affected: Server 2015 CU13, Server 2019 CU8, and Subscription Edition CU1. No active exploitation is confirmed - SSVC rates exploitation as none and the attack is not automatable - but the low authentication bar (any valid SfB user account) makes this a credible insider threat or compromised-credential scenario.
Out-of-bounds read in Microsoft Office Outlook and closely related Office suite components exposes sensitive in-memory data to network-based attackers who can deliver a crafted document to a user. The CVSS vector (C:H/I:N/A:N) and CWE-125 (Out-of-bounds Read) align on an information-disclosure primary impact, while Microsoft's description references code execution - a material discrepancy that warrants verification against the full MSRC advisory. Patches are available from Microsoft across all affected product lines including Office 2016 through 2024 LTSC and Microsoft 365 Apps on both Windows and macOS; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. The CVSS vector confirms high integrity impact with no confidentiality or availability effect, consistent with the described tampering primitive. No public exploit has been identified at time of analysis, and a vendor-released patch is available.
Uninitialized resource use (CWE-908) in Microsoft Office exposes high-confidentiality data to remote unauthenticated attackers when a victim opens a specially crafted Office document. The vulnerability spans the full Microsoft Office ecosystem - Office 2016, 2019, LTSC 2021/2024, Microsoft 365 Apps for Enterprise, and Mac variants - making the affected surface extremely broad. No public exploit code and no active exploitation have been identified at time of analysis; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in Microsoft Office leaks sensitive memory contents to unauthenticated network attackers when a victim opens a specially crafted document. Affected products span Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise on both Windows and macOS, making the exposure surface extremely broad. Vendor-released patches are available; no public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity, no-privilege vector warrants prompt patching across enterprise fleets.
Out-of-bounds memory read in Microsoft PowerPoint's file-parsing logic exposes sensitive process memory when a victim opens a specially crafted presentation file, allowing a remote unauthenticated attacker to disclose heap or stack contents. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019, Office LTSC 2021, and Office LTSC 2024 on both Windows and macOS platforms. Microsoft has released patched builds via the MSRC advisory; no public exploit identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Office Outlook allows a remote unauthenticated attacker to leak process memory contents when a victim opens or previews a crafted email message or attachment. All major Office branches are affected - Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise - spanning hundreds of millions of endpoints globally. Microsoft has released patches across all affected branches; no public exploit code exists and CISA SSVC rates exploitation as 'none' at the time of analysis.
Out-of-bounds read in Microsoft Office exposes sensitive memory contents to a remote, unauthenticated attacker who can convince a user to open a crafted document. The flaw (CWE-125) affects the full current Office portfolio - Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS counterparts - with high confidentiality impact and no integrity or availability consequence. No public exploit identified at time of analysis; vendor-released patches are available for all Windows versions with specific build thresholds.
Out-of-bounds read in multiple Microsoft Office SKUs allows a remote unauthenticated attacker to disclose in-process memory contents by inducing a user to open a specially crafted document. Affected builds span Microsoft 365 Apps for Enterprise, Office 2019/2021/2024 LTSC on Windows, and multiple Mac variants. Exploitation yields high confidentiality impact with no integrity or availability consequence; no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in Microsoft Office exposes arbitrary memory contents to a remote unauthenticated attacker who can convince a user to open a malicious file, resulting in high-confidence information disclosure. Affected versions span Microsoft Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and their macOS equivalents. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, though the phishing-file delivery model is a well-established Office exploitation pattern.
Out-of-bounds read (CWE-125) in Microsoft PowerPoint exposes memory contents to remote unauthenticated attackers who can convince a user to open a specially crafted presentation file. All major Office release channels are affected, including Microsoft 365 Apps for Enterprise, Office 2019, PowerPoint 2016, Office LTSC 2021, and Office LTSC 2024, on both Windows and Mac platforms. No public exploit or active exploitation has been confirmed; SSVC assessment rates exploitation as none and technical impact as partial, consistent with a CVSS 6.5 medium-severity information disclosure finding.
Out-of-bounds memory read in Microsoft Office Word discloses potentially sensitive process memory contents when a victim opens a specially crafted document, affecting Microsoft 365 Apps for Enterprise, Office 2019, Office 2021 LTSC, Office 2024 LTSC, Word 2016, and macOS editions across both Windows and macOS platforms. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms this is a network-delivered, low-complexity information-disclosure flaw requiring user interaction but no attacker-side privileges. Vendor patch is confirmed available via Microsoft MSRC; no active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis.
Out-of-bounds read (CWE-125) in Microsoft Word's document-parsing engine enables remote information disclosure across Microsoft 365 Apps, Office 2019, 2021, and 2024 LTSC on both Windows and macOS. An unauthenticated remote attacker (per CVSS PR:N) can cause Word to read beyond an allocated buffer when a victim opens a crafted document, potentially leaking sensitive memory contents to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates the attack as non-automatable with partial technical impact, placing this squarely in routine patch-cycle response rather than emergency remediation.
Improper cryptographic signature verification in OpenDDS 3.33.x's SignedDocument module allows a local, low-privileged attacker to crash the DDS participant process via a crafted signed document, causing a denial of service. The flaw (CWE-347) resides in the verify() function within the SSL/SignedDocument.cpp component of the DDS Security implementation. A proof-of-concept exists per SSVC data, though EPSS is very low at 0.15% and active exploitation has not been confirmed by CISA KEV.
Denial-of-service in Windows iSCSI via an out-of-bounds read (CWE-125) allows an unauthenticated network attacker to crash the affected service, rendering iSCSI storage targets or initiators unavailable. The vulnerability affects an exceptionally broad swath of Microsoft Windows - from Windows Server 2012 through Server 2025 and Windows 10/11 across all major release channels. User interaction is required per the CVSS vector (UI:R), meaning exploitation likely requires a user to initiate or process a malformed iSCSI exchange. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available.
Windows DHCP Server on multiple Windows Server versions stores passwords in a recoverable format (CWE-257), enabling an authenticated low-privileged network attacker to extract those credentials over the network. The impact is a pure confidentiality breach - passwords held by the DHCP Server service can be recovered without cracking, potentially enabling lateral movement or privilege escalation through credential reuse. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing the flaw across the full affected version matrix.
Out-of-bounds read in Skype for Business Server enables authenticated network attackers to crash the service, causing a denial of service. Affected are on-premises deployments of Skype for Business Server 2015, 2019, and the Subscription Edition - all unpatched below the versions specified in Microsoft's July 2026 advisory. No public exploit code has been identified and CISA has not placed this in the KEV catalog, placing it in the lower-priority tier despite the network-accessible attack vector.
Path traversal in Windows PowerShell (CWE-22) enables network-based security feature bypass across virtually all supported Windows releases, from Server 2012 through Windows Server 2025 and Windows 11 26H2. The flaw allows an unauthenticated remote attacker - contingent on user interaction - to write files outside a restricted directory, circumventing a Windows security boundary with high integrity impact and no direct confidentiality or availability consequence. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, though the broad affected surface across all major Windows versions warrants prompt patching.
Memory exhaustion via crafted DHCP packets in Windows 11 and Windows Server 2025 allows an unauthenticated adjacent-network attacker to crash or degrade the DHCP client service. The root cause is CWE-401 (missing memory release after effective lifetime), meaning the DHCP client allocates memory when processing incoming DHCP messages but fails to free it, making the system vulnerable to progressive memory exhaustion. Impact is availability-only; no confidentiality or integrity breach is claimed. No public exploit or KEV listing has been identified at time of analysis.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Insufficiently protected credential transmission in Microsoft Office exposes NTLM or equivalent credential material to a network-adjacent attacker via a crafted document or resource link. Affected versions span the entire active Office portfolio - Office 2016 through LTSC 2024 and Microsoft 365 Apps for Enterprise - making the exposure broadly relevant. An unauthenticated remote attacker who can induce a user to open a specially crafted Office file or embedded resource can capture credential hashes suitable for relay or offline cracking, constituting a practical spoofing primitive. No public exploit code or CISA KEV listing has been identified at the time of analysis, though Microsoft has released patches.
Uncontrolled resource consumption in Adobe ColdFusion 2025 (≤Update 12) and ColdFusion 2023 (≤Update 23) allows an unauthenticated adjacent-network attacker to exhaust system resources, resulting in a full application denial-of-service condition. The vulnerability requires no user interaction and no privileges, making it straightforward to trigger from within the same network segment. This issue is patched under Adobe advisory APSB26-119, which also addresses a higher-severity authenticated SQLi/RCE flaw (CVE-2026-75746) in the same product.