Privilege escalation in Windows Secure Kernel Mode enables a locally authenticated administrator to breach the virtualization-based security (VBS) trust boundary separating VTL0 (normal OS) from VTL1 (secure enclave). The root cause is CWE-190 integer overflow that leads to a buffer overflow condition within secure kernel processing, affecting Windows 10, Windows 11, and Windows Server across a broad range of release versions. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages.
Privilege escalation in Windows 11 Secure Kernel Mode (Virtualization-Based Security / VTL1) allows a locally authorized attacker with high privileges to cross the VBS isolation boundary and achieve full C:H/I:H/A:H impact on the Secure Kernel context. The root cause is CWE-822 (Untrusted Pointer Dereference): attacker-controlled pointer values are dereferenced without validation inside Secure Kernel Mode, enabling code execution at the VTL1 trust level. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available for Windows 11 26H1.
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. SSVC assessment indicates no current exploitation activity, but the technical impact is rated total due to full C/I/A compromise and a scope change beyond the vulnerable component.
Privilege escalation via heap-based buffer overflow (CWE-122) in Windows Hello affects Windows 10, Windows 11, and Windows Server 2019 across numerous build versions, allowing an authorized local attacker with high privileges to cross a security boundary and achieve full system compromise. The CVSS scope-change indicator (S:C) combined with C:H/I:H/A:H signals the overflow can propagate impact beyond the vulnerable Windows Hello component into other security principals - consistent with an admin-to-SYSTEM or authentication-subsystem boundary crossing. No public exploit or CISA KEV listing is present at time of analysis, but a vendor patch is available.
Remote code execution via use-after-free in the Windows DNS Server service allows an unauthenticated remote attacker to execute arbitrary code on affected Windows Server systems by sending crafted DNS queries that trigger a memory corruption condition. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H) reflects full-triad impact but high attack complexity, consistent with UAF exploitation requiring precise timing or race-condition manipulation. Reported by Microsoft's own security team (secure@microsoft.com) and patched via the MSRC update guide; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows DHCP Server service enables network-adjacent unauthenticated attackers to achieve remote code execution across a broad range of Windows Server versions, from Server 2012 through Server 2025. The flaw (CWE-121) resides in the DHCP server's packet-processing logic, where a malformed client request can overwrite the stack frame and redirect execution - effectively granting SYSTEM-level code execution on the host. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft via the MSRC is confirmed.
Remote code execution via use-after-free in Windows DNS Server affects Windows Server 2022 and 2025, allowing an unauthenticated network attacker to execute arbitrary code on the DNS service host. The vulnerability resides in the DNS service's heap memory management, where a freed object is subsequently dereferenced, enabling memory corruption with full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. Microsoft has released patches for all confirmed affected builds; no public exploit has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Heap-based buffer overflow (CWE-122) in the Windows Text Shaping subsystem allows remote unauthenticated attackers to achieve arbitrary code execution, with full confidentiality, integrity, and availability impact across an exceptionally broad range of Windows versions spanning Server 2012 through Windows 11 26H1. The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) signals network-reachable, authentication-free exploitation tempered by high attack complexity - indicating that triggering reliable code execution requires overcoming specific environmental conditions such as precise heap layout. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches for all affected versions.
Remote code execution in Windows DNS server components allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw. The vulnerability spans Windows Server 2012 through 2025, covering the core DNS infrastructure underpinning Active Directory environments globally. The CVSS vector (AC:H) indicates elevated exploitation complexity - consistent with use-after-free primitives that typically require timing or state manipulation - but successful exploitation yields full C:H/I:H/A:H impact. No public exploit or CISA KEV listing is noted at time of analysis.
Remote code execution in Windows DNS Server exposes unauthenticated network attackers to full system compromise via a use-after-free memory corruption flaw. The vulnerability spans an exceptionally wide range of Windows Server releases - from the end-of-life Server 2012 through the current Server 2025 - making it an unusually broad-surface patch event. With CVSS AC:H, exploitation is not trivial, but the complete C:H/I:H/A:H impact profile and zero-privilege requirement make patching urgent for any internet- or intranet-exposed DNS deployment. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
Remote code execution in the Windows DNS Server component allows unauthenticated network attackers to exploit a race condition in concurrent DNS request processing. The CWE-362 flaw affects every actively supported Windows Server release from Server 2012 through Server 2025, with full confidentiality, integrity, and availability impact if exploited. No active exploitation or public proof-of-concept has been identified, and the CVSS AC:H rating reflects that reliable exploitation requires precise race-condition timing against a production DNS service.
Remote code execution in Windows DNS Server affects multiple Windows Server versions through a race condition on a shared resource during concurrent request processing. An unauthenticated network attacker can exploit the timing window to corrupt state and execute arbitrary code on the DNS Server host. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the full CIA:H triad and network-accessible attack surface make this a credible high-priority patching target for any organization running Windows DNS Server.
Remote code execution in Microsoft Windows DNS Server allows unauthenticated network attackers to execute arbitrary code by exploiting a use-after-free memory corruption flaw in the DNS service. Affected systems span Windows Server 2012 through Server 2025 and two Windows 10 variants running the DNS Server role. CVSS 8.1 (AC:H) reflects the high-complexity exploitation requirement, but successful exploitation yields full C:H/I:H/A:H impact. No public exploit identified at time of analysis; vendor patch is available.
Use-after-free in the Windows Reliable Multicast Transport Driver (rmcast.sys) enables unauthenticated remote code execution across all supported Windows versions from Server 2012 to Server 2025 and Windows 10/11. An attacker sending crafted multicast packets over the network can trigger the CWE-416 condition in the kernel-mode driver, leading to corrupted memory that yields arbitrary code execution at kernel privilege. No public exploit or KEV listing has been identified at time of analysis, but the AC:H rating indicates a race condition must be won, slightly raising the bar for reliable weaponization.
Remote code execution in Windows Failover Cluster allows an unauthenticated network attacker to fully compromise affected Windows Server systems by triggering an untrusted pointer dereference (CWE-822) over the network. Affected deployments span Windows Server 2019, 2022, and 2025 (including Server Core variants) and Windows 10 Version 1809, with vendor-released patches available via Microsoft Security Response Center. No public exploit has been identified at time of analysis, but the full C:H/I:H/A:H impact delivered without authentication makes this a high-priority patching target for any organization running Windows Server clustering.
Remote code execution in Windows IP Helper (iphlpapi) affects every supported Windows client and server release from Windows Server 2012 through Windows 11 26H2. An unauthenticated network attacker who can trigger the use-after-free condition in the IP Helper service may gain full code execution on the target system - confidentiality, integrity, and availability all rated High. Patch Tuesday security updates remediate the flaw across all affected build lines; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Message Queuing (MSMQ) allows unauthenticated network attackers to execute arbitrary code via a use-after-free memory corruption condition. The vulnerability spans Windows 10, Windows 11, and Windows Server 2022/2025 across multiple feature-release versions. No public exploit code or active KEV-listed exploitation has been identified at time of analysis, but the full C:H/I:H/A:H CVSS impact and the network-accessible MSMQ attack surface make this a high priority for any enterprise with MSMQ enabled.
Heap-based buffer overflow in Windows Hyper-V allows a locally authenticated attacker with high privileges to escalate privileges and escape the guest VM boundary, achieving scope change to the underlying host. Affected across a broad range of Windows 10, 11, and Windows Server releases from 2016 through 2025. Vendor-released patches are available; no public exploit or CISA KEV listing identified at time of analysis.
Privilege escalation through a double-free memory corruption flaw in Windows Credential Guard affects Windows 11 (versions 24H2, 25H2, 26H1) and Windows Server 2025. An attacker who already holds elevated local privileges on a target system can exploit the CWE-415 defect to escape the Credential Guard security boundary, achieving scope change with high confidentiality, integrity, and availability impact on protected credential stores. No public exploit code and no CISA KEV listing are present at time of analysis; Microsoft has released patches as part of its update guidance.
Heap-based buffer overflow in Windows Hello allows an attacker who already holds elevated local access to escalate privileges beyond the Windows Hello security boundary, achieving high confidentiality, integrity, and availability impact across the broader Windows system. Affected builds span Windows 10 21H2/22H2 and Windows 11 23H2 through 26H1, representing virtually all currently supported Windows feature releases. No public exploit code or active exploitation has been identified at time of analysis; Microsoft has released patched builds via Patch Tuesday.
Overly permissive ClusterRole in hawtio-operator amplifies the blast radius of any operator-pod compromise to cluster-wide Secret exposure. The operator's ServiceAccount is granted secrets: [create, get, list, update, watch] across all Kubernetes namespaces with no scope restriction, meaning an attacker who gains code execution in the operator pod can immediately read every Secret in the cluster - bootstrap tokens, cloud provider credentials, and secrets belonging to other operators. No public exploit code has been identified at time of analysis, but the vulnerability is a structural privilege misconfiguration that persists for the lifetime of any deployment running the default ClusterRole.
Remote code execution in Apache Impala 2.7.0 through 4.5.1 allows an authorized user with table-creation and remote-storage upload privileges to load and execute arbitrary Java classes on Impala daemon nodes by exploiting insufficient authorization controls over External Data Source tables. The vulnerability abuses Impala's legitimate extensibility feature - Data Source tables - which permits custom Java class loading from remote storage; insufficient authorization checks mean any user holding those two combined privileges can weaponize the feature for server-side code execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; upgrade to 4.5.2 is the vendor-confirmed fix.
Heap-based buffer overflow in the Windows HTTP Print Provider component enables an authorized low-privilege network attacker to achieve remote code execution with full C/I/A impact on affected Windows systems. The vulnerability spans an exceptionally wide range of Microsoft operating systems from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the breadth of affected versions and high CVSS score of 8.0 make this a significant patching priority across enterprise Windows environments.
Stack-based buffer overflow in the Windows Device Association Service enables an authenticated, low-privileged network attacker to escalate privileges to full system compromise across Windows 10, Windows 11, and Windows Server 2012 through 2025. The vulnerability (CWE-121) requires user interaction to trigger but delivers complete confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has issued patches covering the full affected version range.
DNS response spoofing in Windows DNS Server allows unauthenticated network attackers to inject forged DNS responses by exploiting an origin validation error (CWE-346), poisoning the server's cache and redirecting downstream client resolution to attacker-controlled endpoints. All supported Windows Server releases from 2012 through 2025, plus Windows 10 versions 1607 and 1809, are confirmed affected across both full and Server Core installations. Successful cache poisoning yields full confidentiality, integrity, and availability impact - enabling credential interception, traffic redirection, and service disruption for any client relying on the compromised resolver. No public exploit identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog.
Heap-based buffer overflow in the Windows NTFS driver enables network-based privilege escalation across a broad range of Microsoft Windows desktop and server releases. An authenticated low-privileged attacker who can trigger user interaction can corrupt heap memory in the NTFS subsystem - most likely through a crafted network share or SMB-exposed filesystem operation - to achieve full SYSTEM-level control (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available.
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
Privilege escalation in the Windows exFAT File System driver (CWE-125, out-of-bounds read) allows an authenticated low-privilege attacker to gain elevated rights over a network connection. All major Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 are confirmed affected per EUVD version data. No public exploit or CISA KEV listing was identified at time of analysis, though the broad affected scope across the entire current Windows ecosystem and the high CVSS score of 8.0 make patching urgent.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Heap-based buffer overflow in the Windows Connected User Experiences and Telemetry service (DiagTrack) enables low-privileged authenticated attackers to escalate privileges to SYSTEM-level over the network. Affecting Windows 10 (1809 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2019 through 2025, the flaw carries a CVSS 8.0 rating with full CIA impact upon successful exploitation. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; Microsoft has released patches for all affected builds.
Authorization bypass in Okta Access Gateway (all versions before 2026.9.1) allows authenticated network users to circumvent Protected Rule access policies due to improper input sanitization and flawed regular expression evaluation in the authorization check component. When administrators have explicitly configured Protected Rule policies to restrict access to specific application resources, an attacker with low-privilege authentication can craft requests that defeat the policy evaluation, gaining unauthorized high-impact access to confidentiality and integrity of protected resources. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available.
Heap-based buffer overflow in the Windows Biometric Service (WBS) enables network-reachable privilege escalation to full system control on a broad range of Windows client and server releases. An authorized, low-privileged attacker who can induce user interaction can corrupt heap memory in the biometric service process and achieve arbitrary code execution at elevated privilege. Microsoft has released patches addressing all listed affected versions via the MSRC update guide.
Heap-based buffer overflow in the Windows Biometric Framework (WBF) service permits a low-privileged, network-adjacent authenticated attacker to escalate privileges to SYSTEM-level on affected Windows endpoints and servers. The vulnerability requires some user interaction to trigger (UI:R per CVSS), and successful exploitation yields full confidentiality, integrity, and availability impact on the target host. No active exploitation has been identified at time of analysis, and Microsoft has released patches across all supported Windows versions.
Heap-based buffer overflow in the Windows Biometric Service (WbioSrvc) enables a network-based privilege escalation by an authenticated low-privilege attacker who can trigger user interaction. The vulnerability (CWE-122) spans a broad swath of Microsoft's supported Windows ecosystem, from Windows 10 version 1607 through Windows 11 25H2 and Windows Server 2016 through 2025. Exploitation results in full compromise of confidentiality, integrity, and availability on the target system. No public exploit or CISA KEV listing is identified at time of analysis; Microsoft has released patches across all affected branches.
Heap-based buffer overflow in the Windows USB Video Driver enables a network-adjacent, low-privileged authenticated attacker to escalate privileges to SYSTEM-level on affected Windows hosts. The vulnerability spans a wide swath of the Windows ecosystem, from legacy Server 2012 through current Server 2025 and Windows 11 26H1, making it a broad enterprise patching obligation. Microsoft has released corrective build versions for each affected OS branch; no public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation via out-of-bounds read (CWE-125) in the Windows NTFS kernel driver affects virtually every current Windows release - from Windows 10 1607 and Server 2012 through Windows 11 26H2 and Server 2025 - allowing a low-privileged network attacker to achieve full CIA compromise of the target system. The vulnerability is reachable over the network (consistent with NTFS driver exposure via SMB), requires only low-level authentication and some user interaction, and can yield SYSTEM-level access. Microsoft has released patched builds for all affected versions; no active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Privilege escalation in the Microsoft Windows Search Component exposes Windows 11 and Windows Server 2022/2025 systems to full system compromise via a double-free memory corruption flaw. An authenticated, low-privileged attacker can trigger the vulnerability over the network with user interaction to gain SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, though a vendor patch is available.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Privilege escalation via out-of-bounds read in VOLSNAP.SYS, the Windows Volume Shadow Copy kernel-mode driver, allows a low-privileged network attacker to achieve SYSTEM-level code execution across virtually all Windows client and server versions from Server 2012 to Server 2025. The CVSS 8.0 vector (AV:N/AC:L/PR:L/UI:R) confirms the exploit is network-reachable with low access complexity and a low-privileged account, constrained only by a user interaction requirement. No public exploit code and no CISA KEV listing have been identified at time of analysis; Microsoft has released patches for all affected versions.
Heap-based buffer overflow in Windows' Volume Manager Driver enables a low-privileged authenticated attacker to escalate privileges to SYSTEM over a network, achieving full confidentiality, integrity, and availability compromise on the target host. The flaw spans an exceptionally wide range of Microsoft Windows versions, from Server 2012 through Windows 11 26H1 and Server 2025, making remediation breadth a significant operational challenge. No public exploit code or CISA KEV listing exists at time of analysis, but vendor-released patches are available and should be applied promptly given the C:H/I:H/A:H impact potential.
Privilege escalation via out-of-bounds read in the Windows Local Security Authority Server (lsasrv) allows a low-privileged authenticated attacker to elevate to higher system access over a network. Affected across a wide range of Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 builds, this vulnerability targets the core Windows authentication subsystem. Vendor patch is available; no public exploit or CISA KEV listing identified at time of analysis.
Apache Parquet Hadoop's envelope encryption subsystem (org.apache.parquet.crypto.keytools, versions 1.12-1.18.0) can leak KMS authentication tokens to an attacker-controlled endpoint when a crafted Parquet file embeds a malicious KMS URL and the reader application relies on file-controlled URL resolution. The pluggable KmsClient receives the file-embedded URL without host validation, allowing a file author to silently redirect KMS token requests to an arbitrary server. No public exploit has been identified at time of analysis; the fix ships in version 1.18.1, which disables file-controlled KMS URLs by default.
Improper certificate hostname validation (CWE-297) in Fortinet FortiOS and FortiProxy enables network-adjacent attackers to conduct man-in-the-middle attacks against outbound TLS connections made by affected devices. Fortinet FortiOS versions 7.6.1 through 7.6.6 and FortiProxy 7.6.2 through 7.6.6 fail to verify that a presented certificate matches the intended hostname, allowing a suitably positioned attacker to intercept and potentially tamper with encrypted traffic. Proof-of-concept code exists (E:P in temporal CVSS), and an official fix has been released per vendor advisory FG-IR-26-174.
Remote code execution via use-after-free (CWE-415) in the Windows DHCP Server service allows an authorized attacker on the same network segment to achieve full system compromise across a wide range of Windows Server editions from 2012 through 2025. The CVSS vector (AV:A/PR:L) confirms exploitation is constrained to adjacent-network attackers holding at least low-privilege access, yet the resulting C:H/I:H/A:H impact reflects complete server takeover if the flaw is triggered. No public exploit or CISA KEV listing has been identified at time of analysis; Microsoft has issued patches via its standard update channel.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables a low-privileged network-authenticated attacker to achieve full privilege escalation on affected Microsoft Windows systems, potentially reaching SYSTEM-level access. The vulnerability spans a very wide range of products from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, and Microsoft has confirmed the issue and released patched builds. No public exploit has been identified at time of analysis, and the vulnerability does not appear in CISA KEV.
Remote code execution via a use-after-free defect in the Windows Reliable Multicast Transport Driver (RMCAST) allows an unauthenticated network attacker to execute arbitrary code on affected Windows Server and Windows 10 systems. The vulnerability resides in a kernel-mode multicast transport driver, and successful exploitation achieves full confidentiality, integrity, and availability impact per CVSS C:H/I:H/A:H. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available from Microsoft.