Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Network denial of service in Windows SMB Server allows unauthenticated remote attackers to make the service allocate resources without throttling, exhausting memory or handles until SMB-dependent services and, potentially, the host become unresponsive. Tracked as CWE-770 and scored 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2) and Windows Server 2012 through Server 2025, with impact confined to availability - there is no disclosure or code-execution path. No public exploit has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (automatable: yes, technical impact: partial), and vendor-released patches are available through the Microsoft update guide referenced by the advisory.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Denial of service in Windows Failover Cluster allows an unauthenticated remote attacker with network reachability to the cluster service communication interface to trigger an integer underflow (CWE-191) and disrupt cluster availability. The issue affects Windows Server systems where the Failover Clustering role or feature is installed and active; standalone Windows servers are not impacted. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is availability-only, and no public exploit code or CISA KEV active exploitation is identified in the provided data.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Man-in-the-middle attackers who already control or intercept the network path to github.com can substitute a malicious gitstatusd archive during the gitstatus installer download bundled with Powerlevel10k (versions through 1.20.0), gaining code execution that persists under the victim's account on every prompt. Two weaknesses in the installer enable the substitution: it fetches the archive with curl -k, which disables TLS certificate validation, and it skips its SHA-256 integrity verification entirely when no hashing utility (sha256sum, shasum or openssl) is present on the host. Exploitation is conditional rather than opportunistic - it requires a privileged network position plus a user-initiated install or update event, and no public exploit code has been identified at time of analysis; no KEV listing or EPSS signal was provided with this record.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
An out-of-bounds read in Microsoft Outlook allows an unauthenticated, remote attacker to disclose information by getting crafted content parsed or rendered by the Outlook client, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) by the vendor with confidentiality-only impact. Our independent assessment keeps the network vector and high confidentiality impact but conservatively scores user interaction as required (UI:R), because the crafted message or attachment must actually reach a mailbox and be opened or previewed by Outlook - a delivery-and-render precondition, not a directly reachable network service. No public exploit code has been identified at time of analysis (CISA SSVC rates exploitation as 'none' and the issue is not in KEV), and a vendor patch is available, placing this in the important-but-not-emergency tier.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Unauthenticated remote attackers can disclose sensitive memory contents from Microsoft Azure Attestation and the Windows Server Device Health Attestation Service through an out-of-bounds read (CWE-125) triggered by a crafted request to an exposed attestation endpoint, rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The practical exposure is limited: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-reachable are at risk, specifically Windows Server 2019 before 10.0.17763.9376, Windows Server 2022 before 10.0.20348.5761, and Windows Server 2025 before 10.0.26100.33650. Impact is confined to information disclosure with high confidentiality loss and no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Unauthenticated remote resource exhaustion in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows an attacker to drive a reachable application server into an application-level denial-of-service by consuming system resources, with CVSS 3.1 scoring the issue 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) so the entire impact rests on availability. No special feature, protocol, or non-default configuration is required and no user interaction is involved; the practical limiting factor is network reachability, making internet-exposed instances the highest-risk population. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this should be treated as a patch-now availability risk rather than an actively exploited campaign; Adobe ships fixes in advisory APSB26-144.
An unauthenticated attacker with network reachability to the Windows Failover Clustering service can crash the cluster communication component by provoking an uncaught exception (CWE-248), resulting in a denial of service on the affected node. Windows Server 2019, Windows Server 2022, and Windows Server 2025 - including Server Core installations - are affected only when the Failover Clustering role/feature is configured; hosts without clustering enabled are not exposed. The CVSS 3.1 base score of 7.5 (HIGH) derives entirely from availability impact over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Authentication spoofing in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated, network-positioned attacker to bypass federated authentication and have forged identity assertions accepted by an affected deployment, yielding a CVSS 3.1 score of 7.5 driven entirely by high integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The weakness is an authentication bypass by spoofing (CWE-290) hitting the AD FS role on Windows Server 2012 R2, 2012 R2 Server Core, 2016, 2019, 2022, 2025, and the associated Windows 10 and Windows 11 client builds that Microsoft lists in the same update. No public exploit code exists and Microsoft's update is available, so this is a genuine patch-now exposure issue for organizations that actually run AD FS endpoints reachable by untrusted networks, not for hosts that have no AD FS role or are already at the fixed builds (for example Windows Server 2025 10.0.26100.33650, Server 2019 10.0.17763.9376, Server 2016 10.0.14393.9612, Server 2012 R2 6.3.9600.23470).
Siemens Industrial Edge App Publisher versions prior to V1.27.9 fail to validate the server certificate when establishing TLS connections, allowing an attacker who already occupies a privileged man-in-the-middle position on the network path to intercept, relay, and spoof trusted server communication. The flaw is unauthenticated from a credential standpoint (CVSS vector PR:N) but requires on-path access plus victim-initiated connection activity (AT:P, UI:P), so exploitation is constrained to environments where an adversary can insert themselves between the client and the intended server - a meaningful hurdle in segmented industrial networks where App Publisher normally operates. No public exploit code or in-the-wild activity has been identified at time of analysis, and the practical risk is medium-to-high rather than emergency priority: integrity and confidentiality of publisher-to-server traffic are fully exposed (C:H/I:H), while availability is unaffected (A:N).
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resource consumption when the library parses attacker-supplied assets or their embedded Content Credentials / C2PA manifest data. The vulnerable path is network-reachable with low attack complexity and, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no authentication and no user interaction, yielding a 7.5 base score with availability-only impact; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so practical risk is bounded by exposure: because this is an embedded SDK rather than a standalone service, only integrations that feed untrusted, externally sourced content into the parsing/verification path are realistically reachable, while deployments processing only trusted or internally generated assets are not.
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaust system resources and drive an application into denial-of-service by feeding it specially crafted Content Credentials/C2PA data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is network-reachable, low-complexity, requires no authentication and no user interaction, and affects availability only - there is no confidentiality or integrity impact, so no data compromise is expected. The practical precondition is that a deployed application actually accepts and processes attacker-supplied content through this SDK's parsing or verification path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the exact input structure that triggers exhaustion is not documented in the available data.
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security control and obtain unauthorized write access. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any deployment that exposes the vulnerable SDK input path to attacker-supplied content credentials data is reachable without credentials or user interaction, and the impact is integrity-only (C:N/I:H/A:N), meaning tampering with data rather than disclosure or denial of service. Rated CVSS 7.5 (High) and reported directly by Adobe PSIRT via advisory APSB26-163; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated remote attackers bypass the SDK's content-credential validation path and gain unauthorized write access, yielding an integrity-only impact (C:N/I:H/A:N, CVSS 7.5). Any deployment that ingests attacker-supplied or externally sourced credential data and runs the vulnerable SDK version through its parse/verify routine is exposed; no authentication (PR:N) and no user interaction (UI:N) are required per the assessed vector, so a default-configured verification service reachable from the network is sufficient. The practical limiting factor is deployment scope rather than a configuration toggle - the flaw only matters where untrusted content actually flows into the SDK - and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) at the time of writing, which keeps this an elevated but not top-tier priority.
Unauthenticated remote attackers can bypass a security feature in Adobe's CAI Content Credentials SDK and gain unauthorized write access, a 7.5-rated integrity flaw confirmed by Adobe PSIRT. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no credentials and no user interaction are required; the practical precondition is that an application embeds the SDK on a network-reachable code path that processes untrusted, externally supplied content. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the medium-to-high severity and the SDK's role in provenance validation make it a priority for integrations that ingest third-party content.
Improper input validation in the CAI Content Credentials SDK allows a remote, unauthenticated attacker to feed crafted input into the SDK's processing path and bypass its integrity and security checks, resulting in unauthorized write access to Content Credentials data. Adobe PSIRT rates the issue CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), meaning no privileges, no authentication, and no user interaction are required, and the impact is confined to integrity - forged or tampered provenance data - with no direct confidentiality or availability loss. Exposure is the limiting factor: since the SDK is a specialized provenance component, real risk depends on whether a downstream application actually accepts untrusted input through the vulnerable code path; there is no public exploit identified at time of analysis and no evidence of active exploitation.
Heap-based buffer overflow in OpenSSH for Windows - the optional OpenSSH client/server component shipped with Windows 10, Windows 11, and Windows Server 2019/2022/2025 - can allow code execution in the context of the vulnerable process, with the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (reported score 7.5) reflecting full confidentiality, integrity and availability impact. Exploitation is unauthenticated (PR:N) but is gated by two concrete limiters: User Interaction is Required (UI:R), implying a victim must actively initiate or accept the vulnerable SSH operation rather than being hit passively, and Attack Complexity is High (AC:H), meaning the attacker must satisfy a non-trivial precondition such as a specific heap or memory layout. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA SSVC Exploitation: none; KEV: no), and CISA's SSVC also rates the flaw as not automatable, although technical impact is assessed as total - on balance the signals point to a serious-but-not-emergency priority for hosts running the OpenSSH feature.
Heap-based buffer overflow in the Windows iSCSI Initiator component allows a remote unauthenticated attacker to execute arbitrary code on affected Windows 10, Windows 11, and Windows Server 2012 through 2025 systems, provided the target actually uses iSCSI and a user or administrator initiates or accepts a connection to an attacker-controlled iSCSI target (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5). The user-interaction requirement and High attack complexity - the attacker must also satisfy memory-layout or timing conditions to convert the overflow into reliable code execution - sharply limit the practical attack surface to environments that deploy iSCSI storage. Vendor-released patches are available from Microsoft, CISA's SSVC decision framework rates exploitation as none and automatable as no, and no public exploit identified at time of analysis.
Use-after-free in Microsoft's Remote Desktop Client (mstsc) allows an attacker who controls an RDP server to execute arbitrary code on the machine of any user who connects to it, with high confidentiality, integrity and availability impact (CVSS 7.5; AV:N/AC:H/PR:N/UI:R). Exploitation is not a passive drive-by: the victim must launch the client and initiate or accept the RDP connection to the attacker-controlled or compromised server, and the High attack complexity reflects the heap grooming or race conditions needed for reliable code execution. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records Exploitation=none and Automatable=no, so wormable or mass automation is not expected; the realistic risk is confined to environments whose users connect to untrusted or externally controlled RDP endpoints.
Heap-based buffer overflow in Windows Media can result in remote code execution when a victim opens, previews, or otherwise processes a maliciously crafted media file, letting an attacker corrupt heap memory and run code in the context of the media-handling process. The vulnerability carries a CVSS base score of 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H): attackers need no authentication, but successful exploitation depends on user interaction with a crafted file and on high attack complexity, meaning heap-state or race conditions must be satisfied and reliability is reduced. Affected systems include Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025; Microsoft has published vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in the Windows Remote Desktop Client lets an unauthenticated attacker execute arbitrary code on a connecting client by luring a user into initiating an RDP session to an attacker-controlled or compromised server. The vector is network-reachable with no privileges required (PR:N), but practical exploitation depends on the victim starting the outbound connection (UI:R) and on the attacker winning a specific memory-state or timing condition (AC:H), which is consistent with CISA's SSVC rating of non-automatable and no observed exploitation. No public exploit code has been identified at time of analysis and Microsoft has published fixed builds covering all affected Windows 10, Windows 11 and Windows Server platforms; because the trigger is client-initiated rather than a passive listening service, the realistic delivery paths are malicious .rdp files, crafted links, or a hijacked RDP endpoint.
A use-after-free (CWE-416) in the Microsoft Windows Remote Desktop Client allows an unauthenticated attacker to execute code on a victim's machine when that user initiates an outbound connection to an attacker-controlled RDP server. The flaw is client-side rather than a remotely reachable service bug: the attacker must control the server endpoint and also win a race condition inherent to the use-after-free (AC:H), while the victim must open a crafted .rdp file or otherwise accept the connection (UI:R), which is why the CVSS 3.1 base score sits at 7.5 even though a successful exploit yields full confidentiality, integrity and availability impact. Vendor-released patches are available, no public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so this is a moderate-priority issue rather than an urgent one.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to execute code on a Windows machine that connects to it, affecting builds across Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025. Exploitation is client-side: an attacker must induce a victim to open a crafted .rdp file or otherwise initiate an outbound RDP session, and with AC:H plus mandatory UI:R, reliable code execution depends on winning a heap race rather than a single deterministic response, so mass opportunistic exploitation is unlikely while targeted social-engineering delivery is plausible. No public exploit identified at time of analysis; CISA's SSVC rates exploitation as none and automation as not automatable, and the PR:N vector means the victim need not authenticate to the attacker.
A use-after-free (CWE-416) in the Windows Remote Desktop Client lets an attacker who controls or compromises an RDP server execute arbitrary code on the connecting client, as described in Microsoft's MSRC advisory for CVE-2026-69998. Exploitation is not passive: the victim must actively initiate an RDP session to the hostile endpoint (UI:R), and the unauthenticated attacker (PR:N) must still win a memory-management race or reliably groom the freed heap object to convert the corruption into code execution (AC:H), giving a CVSS 3.1 base score of 7.5. All supported Windows client and server builds below the patched build levels are affected; there is no public exploit identified at time of analysis, no confirmed active exploitation (CISA KEV), and CISA SSVC records exploitation as none and automatable as no, so the practical risk is driven by social engineering of an outbound RDP connection plus patch lag.
Use-after-free memory corruption in the Microsoft Windows Remote Desktop Client (mstsc.exe) can let an unauthenticated remote attacker execute arbitrary code on a vulnerable client, but only after the victim initiates an outbound RDP connection to an attacker-controlled, compromised, or spoofed RDP server. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.5) confirms the mandatory user interaction and high attack complexity, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'; no public exploit code has been identified at time of analysis. Microsoft has released fixes via the MSRC update guide, so the practical risk is moderate and concentrated on hosts that routinely open RDP sessions to untrusted or third-party endpoints.
Use-after-free in the Windows Remote Desktop Client allows a malicious or compromised RDP server to corrupt memory and execute code on the machine that connects to it (CVSS 7.5, C:H/I:H/A:H, SSVC Technical Impact 'total'). The attack is client-initiated and outbound - it requires the victim to establish an RDP session to the hostile endpoint (UI:R) and a favorable memory/race condition to be won (AC:H) - so it does not target a listening RDP service, and no privileges are required on the client (PR:N, unauthenticated). Current intelligence indicates no public exploit code and no confirmed active exploitation (CISA SSVC Exploitation: none; Automatable: no), while Microsoft has released a vendor patch, making this a high-impact-but-not-urgent issue at time of analysis.
Code execution in the Windows Remote Desktop Client (mstsc) is possible when a user initiates an outbound RDP session to a malicious or attacker-controlled server, triggering a use-after-free that can be leveraged for arbitrary code in the client's context. Affected are unpatched Windows client and server builds below their fixed versions - including Windows 10 1607 through 22H2, Windows 11 23H2/24H2/25H2/26H1/26H2, and Windows Server 2012/2012 R2/2016/2019/2022/2025 - while the attacker requires no credentials (PR:N) and the flaw cannot be triggered against a listening host without the victim's outbound connection (UI:R). Exploitation is rated high-complexity (AC:H) because the attacker must reliably win the heap/timing-dependent memory corruption condition; there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV), and Microsoft has released patched builds.
Use-after-free memory corruption in the Windows Remote Desktop Client allows an unauthenticated remote attacker to execute code in the context of the connecting user, but only after the victim initiates an outbound RDP session to an attacker-controlled or compromised server. Microsoft rates the issue 7.5 (High) under CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting a total loss of confidentiality, integrity, and availability that is tempered by high attack complexity and mandatory user interaction. CISA's SSVC assessment records exploitation as 'none' and no public exploit identified at time of analysis; Microsoft has released fixed builds through its update guide.