An out-of-bounds read in the Network Device Enrollment Service (NDES) role of Active Directory Certificate Services allows an unauthenticated remote attacker to crash the SCEP enrollment endpoint on affected Windows servers, producing a denial of service (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only hosts where the optional NDES role is installed and reachable over the network are exposed, spanning Windows Server 2012 through Windows Server 2025 plus Windows 10 versions 1607 and 1809, and Microsoft has published vendor fixes for these builds. No public exploit code and no confirmed active exploitation were identified at the time of analysis, and real-world exposure is bounded because NDES is a deliberately deployed, non-default role rather than a component present on every Windows server.
Out-of-bounds memory reads in Microsoft's Network Device Enrollment Service (NDES) allow a remote, unauthenticated attacker to disrupt certificate-enrollment service by sending crafted requests to a reachable SCEP endpoint, yielding a denial-of-service condition rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Exposure is narrow in practice: NDES is an optional Active Directory Certificate Services role that is not present in a default Windows Server installation, so only hosts where the role has been deployed and its HTTP/HTTPS SCEP interface is network-reachable are at risk, and the vector requires no authentication, privileges, or user interaction. Impact is confined to availability - the assessed vector shows no confidentiality or integrity loss - and no public exploit identified at time of analysis, though vendor patches are available for all affected builds.
Denial of service in Windows Host Guardian Service (HGS) affects servers where the optional HGS role is installed and its network endpoint is reachable. An unauthenticated, remote attacker can trigger a stack-based buffer overflow (CWE-121) to crash or disrupt HGS, impacting attestation and key-protection services for guarded hosts; the CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5). CISA SSVC records exploitation as none and no public exploit code has been identified at time of analysis, and the narrow HGS deployment footprint makes this a bounded, medium-priority patch rather than an emergency.
Denial of service in the Windows Storage Spaces Controller allows remote attackers to crash affected Windows hosts by sending crafted input over the network that triggers a heap-based buffer overflow, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Exploitation is limited to availability impact (C:N/I:N/A:H, CVSS 7.5): the flaw cannot be leveraged for data theft or code execution based on available data. No public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV does not list this CVE); CISA SSVC rates exploitation as "none" while noting the attack is automatable, and a vendor patch is available.
Unauthenticated, network-reachable attackers can deny service on Windows hosts that run the Routing and Remote Access Service (RRAS) by triggering an out-of-bounds read (CWE-125) that crashes or destabilizes the service. Rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the impact is availability-only with no confidentiality or integrity effect, and exposure is restricted to systems where the non-default RRAS role is installed and its listener is reachable over the network, requiring no credentials and no user interaction. No public exploit code identified at time of analysis and the issue is not listed in CISA KEV; vendor patches are available.
Denial of service in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to crash the service by sending crafted network traffic that triggers a null pointer dereference, taking down routing, VPN, NAT, and dial-up functions on the host. Per the provided vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), exploitation requires no credentials and no user interaction, and the impact is confined to availability with no confidentiality or integrity effect. The practical limitation is deployment: RRAS is not enabled by default, so only servers configured as VPN gateways, routers, or NAT/dial-up endpoints with a reachable listener are exposed; CISA's SSVC assessment rates exploitation as 'none' and no public exploit has been identified at time of analysis, though the attack is automatable and a vendor patch is available.
Denial of service in the Windows Graphics Device Interface (GDI) subsystem allows unauthenticated, remote attackers to trigger a stack-based buffer overflow (CWE-121) and crash affected components, requiring no user interaction. The flaw (CVSS:3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) affects all supported Windows client and server editions, including Server Core installations, but impact is confined to availability - there is no confidentiality or integrity loss, code execution, or privilege escalation described. CISA's SSVC assessment records exploitation as "none" and notes the flaw is automatable; no public exploit code was identified at time of analysis, and a vendor patch is available per the Microsoft advisory.
An out-of-bounds read in the Windows Internet Key Exchange (IKE) protocol implementation allows an unauthenticated remote attacker to cause a denial of service on affected hosts, with a CVSS base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflecting availability-only impact. Windows 10, Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025 are affected, but exploitation is only reachable on hosts that actually expose an IKE/IPsec listener on UDP 500/4500 to the attacker's network - typically VPN gateways, IKEv2 remote-access servers, or hosts under domain IPsec policy. No public exploit identified at time of analysis, CISA SSVC records exploitation as 'none', and Microsoft has released vendor patches listed in the MSRC update guide.
Denial of service in Microsoft Windows' IKE Extension (IKEEXT), where a heap-based buffer overflow (CWE-122) can be triggered by a remote, unauthenticated attacker sending crafted IKE/ISAKMP negotiation traffic to hosts that expose the IPsec keying service on UDP 500 and 4500. Successful exploitation degrades availability only - CVSS 3.1 base score 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - with no confidentiality or integrity impact and no demonstrated code execution. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as "none," though the issue is rated automatable; a vendor patch is available per Microsoft's advisory.
Network denial of service in Windows SMB Server allows unauthenticated remote attackers to make the service allocate resources without throttling, exhausting memory or handles until SMB-dependent services and, potentially, the host become unresponsive. Tracked as CWE-770 and scored 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it affects Windows 10 (1607 through 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1/26H2) and Windows Server 2012 through Server 2025, with impact confined to availability - there is no disclosure or code-execution path. No public exploit has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' (automatable: yes, technical impact: partial), and vendor-released patches are available through the Microsoft update guide referenced by the advisory.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Unauthenticated network traffic against the Remote Desktop Gateway (RD Gateway) role service on unpatched Windows Server builds causes a memory leak that is never released, progressively exhausting server memory until the gateway can no longer broker remote desktop sessions (CWE-401, CVSS 7.5, availability-only). Only hosts where the RD Gateway role service is installed, running, and reachable over the network are affected - typically internet-facing servers listening on TCP 443 - while servers without that role are not in scope. CISA's SSVC assessment records Exploitation: none and Technical Impact: partial, with Automatable: yes, and no public exploit has been identified at time of analysis; a vendor patch is available, so exposure is bounded to the enumerated pre-patch build ranges.
Heap corruption in the Microsoft Windows iSCSI service lets an unauthenticated remote attacker crash or destabilize the service, yielding a denial-of-service condition on any host that has the iSCSI listener enabled and network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms network reachability with no credentials, no user interaction, and no non-default configuration beyond the service being turned on, and the impact is confined to availability with no data disclosure or modification. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS or CISA KEV signal was supplied; exposure is therefore driven primarily by deployment, since hosts that do not run the iSCSI service or that firewall its port are not reachable.
Denial of service in Windows Failover Cluster allows an unauthenticated remote attacker with network reachability to the cluster service communication interface to trigger an integer underflow (CWE-191) and disrupt cluster availability. The issue affects Windows Server systems where the Failover Clustering role or feature is installed and active; standalone Windows servers are not impacted. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is availability-only, and no public exploit code or CISA KEV active exploitation is identified in the provided data.
Denial of service in Microsoft Active Directory Domain Services (AD DS) allows an unauthenticated remote attacker with a network path to a domain controller to crash the AD DS service by triggering an out-of-bounds read (CWE-125). Exploitation requires the AD DS role to be present, meaning only hosts promoted to domain controllers are realistically at risk; general Windows endpoints are not, even though matching client builds also appear in the vendor's affected-build list. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) confirms the impact is confined to availability with no confidentiality or integrity loss, CISA SSVC records Exploitation as "none," and no public exploit has been identified at time of analysis; the flaw is rated Automatable: yes, so a reliable trigger could be scripted once reverse-engineered. Vendor patches are available (see advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83647).
Man-in-the-middle attackers who already control or intercept the network path to github.com can substitute a malicious gitstatusd archive during the gitstatus installer download bundled with Powerlevel10k (versions through 1.20.0), gaining code execution that persists under the victim's account on every prompt. Two weaknesses in the installer enable the substitution: it fetches the archive with curl -k, which disables TLS certificate validation, and it skips its SHA-256 integrity verification entirely when no hashing utility (sha256sum, shasum or openssl) is present on the host. Exploitation is conditional rather than opportunistic - it requires a privileged network position plus a user-initiated install or update event, and no public exploit code has been identified at time of analysis; no KEV listing or EPSS signal was provided with this record.
Denial of service in the OpenSSH server component (sshd) shipped as an optional feature of Windows allows an unauthenticated, remote attacker who can reach the SSH port to consume host resources without throttling, degrading or exhausting the service so legitimate SSH sessions can no longer be established. Only Windows builds that actually have the OpenSSH Server capability installed, enabled and network-reachable are at risk - the feature is not on by default for most client installs, which materially narrows the attack surface, and the impact is availability-only (C:N/I:N/A:H). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CISA's SSVC assessment records exploitation as none, automatable as yes and technical impact as partial, and there is no public exploit identified at time of analysis; a vendor fix is available.
Path traversal (CWE-22) in Microsoft SharePoint Server Subscription Edition lets an authenticated attacker read files outside an intended restricted directory over the network. Exploitation requires a valid low-privileged session (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it is not an anonymous, internet-wide attack - the credential requirement is the primary limiting factor, and CISA's SSVC assessment rates it Exploitation: none, Automatable: no, Technical Impact: partial. Impact is confidentiality-only (no integrity or availability effect), and no public exploit code has been identified at time of analysis; Microsoft has released a vendor patch.
Server-side request forgery in Adobe ColdFusion 2023 (up to and including 2023.0.25) and ColdFusion 2025 (up to and including 2025.0.13) lets an attacker who already holds a high-privileged ColdFusion account force the server to issue requests to internal or otherwise restricted resources, resulting in privilege escalation and unauthorized access to internal services. The vulnerability is network-reachable (AV:N), needs no user interaction (UI:N), but is gated by the high-privilege precondition (PR:H), so it is not exploitable against default unauthenticated configurations - the practical risk is concentrated on internet-exposed ColdFusion administrative interfaces and insider or post-compromise scenarios. The CVSS vector changes scope (S:C), meaning the attacker can leverage the vulnerable ColdFusion component to affect resources outside its own security authority, and no public exploit code has been identified at time of analysis. This is a solid-priority-but-not-emergency issue rather than an emergency, driven mainly by the privileged access required to trigger it.
Unauthenticated remote attackers can read uninitialized-memory contents from network-reachable Windows hosts that run the Routing and Remote Access Service (RRAS), resulting in disclosure of potentially sensitive process data (CVSS 7.5; vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Exposure is strongly limited by deployment posture: RRAS is not installed, enabled, or running by default on either Windows client or Windows Server, so realistic risk concentrates on internet-facing or broadly reachable remote-access/VPN gateways and on custom routing roles. CISA's SSVC decision framework rates exploitation as "none" with partial technical impact, and no public exploit code or confirmed active exploitation has been identified at time of analysis, although the issue is rated automatable; Microsoft has published fixes through its Security Update Guide.
Path traversal in Microsoft SharePoint Server Subscription Edition allows an authenticated attacker to read files outside the intended content directory, resulting in disclosure of confidential information over the network. The flaw affects SharePoint Server Subscription Edition builds prior to 16.0.20326.20190 and carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N), meaning exploitation requires valid low-privilege credentials, needs no user interaction, and cannot modify data or cause denial of service. CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', and no public exploit code has been identified at time of analysis - the practical risk is concentrated on insiders or attackers holding stolen or low-privilege accounts rather than anonymous internet adversaries.
An out-of-bounds read in Microsoft Outlook allows an unauthenticated, remote attacker to disclose information by getting crafted content parsed or rendered by the Outlook client, rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) by the vendor with confidentiality-only impact. Our independent assessment keeps the network vector and high confidentiality impact but conservatively scores user interaction as required (UI:R), because the crafted message or attachment must actually reach a mailbox and be opened or previewed by Outlook - a delivery-and-render precondition, not a directly reachable network service. No public exploit code has been identified at time of analysis (CISA SSVC rates exploitation as 'none' and the issue is not in KEV), and a vendor patch is available, placing this in the important-but-not-emergency tier.
An unauthenticated, remote out-of-bounds read in Microsoft Windows Network Policy Server (NPS) can leak the contents of process memory to any attacker able to reach the NPS network listener, with a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflecting high confidentiality impact and no integrity or availability effect. Affected systems are Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025 installations that have the NPS role deployed and running as a RADIUS/NAC server; NPS is not enabled by default, so the realistic attack surface is limited to hosts whose RADIUS endpoints are reachable across network segments. CISA's SSVC assessment rates the issue as automatable with partial technical impact and no observed exploitation, and no public exploit code has been identified at time of analysis, making this a moderate-but-real priority rather than an emergency rather than a confirmed active threat.
An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows a remote, unauthenticated attacker to read past the bounds of an allocated buffer and disclose information over the network, rated CVSS 7.5 with confidentiality impact rated High and no integrity or availability effect. Only hosts that have the RRAS role installed and running - typically VPN, dial-up or NAT/router servers - are exposed, since RRAS is not enabled by default on Windows Server or client SKUs, and exploitation requires the service to be network-reachable. Exploitation is rated 'none' by CISA SSVC and no public exploit code or CISA KEV listing was identified at time of analysis, though the flaw is considered automatable, and a vendor patch is available.
An out-of-bounds read (CWE-125) in the Windows Print Spooler lets an unauthenticated, remote attacker who can reach the spooler service over the network read memory contents from the affected host, yielding a confidentiality-only impact (C:H/I:N/A:N) at CVSS 7.5. The flaw affects a broad swath of Windows builds - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012/2012 R2/2016/2019/2022/2025, including Server Core installations - but only those not yet updated to the fixed builds published by Microsoft. A vendor patch is available and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), though the issue is rated automatable; the practical blast radius is bounded by network reachability to the spooler's RPC/print endpoints and by the fact that this is information disclosure rather than remote code execution.
Information disclosure in the Windows Message Queuing (MSMQ) Queue Manager lets unauthenticated remote attackers read past the end of a buffer and leak memory contents over the network. Exposure is limited to Windows 10, Windows 11, and Windows Server hosts on which the optional Message Queuing feature is actually installed and reachable - MSMQ is not part of a default Windows installation, so most hosts are unaffected regardless of patch level. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' while flagging the flaw as automatable, and the confidentiality-only impact makes this a genuine patch-priority issue rather than an emergency.
Information disclosure in Microsoft Windows IKE Extension (IKEEXT) allows a remote, unauthenticated attacker to send crafted IKE/IPsec traffic to UDP ports 500 or 4500 and trigger an out-of-bounds read that may disclose memory contents. The flaw is rated CVSS 7.5 HIGH with high confidentiality impact and no integrity or availability impact; the principal exposure requirement is that the target Windows host processes inbound IKE/IPsec traffic. No public exploit code or confirmed active exploitation is identified in the provided data, so no public exploit identified at time of analysis.
Unauthenticated remote attackers can disclose sensitive memory contents from Microsoft Azure Attestation and the Windows Server Device Health Attestation Service through an out-of-bounds read (CWE-125) triggered by a crafted request to an exposed attestation endpoint, rated CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The practical exposure is limited: on-premises Device Health Attestation is an optional Windows Server role, so only hosts where it is enabled and network-reachable are at risk, specifically Windows Server 2019 before 10.0.17763.9376, Windows Server 2022 before 10.0.20348.5761, and Windows Server 2025 before 10.0.26100.33650. Impact is confined to information disclosure with high confidentiality loss and no integrity or availability effect, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Information disclosure in the Windows Function Discovery Service (implemented in fdwsd.dll) allows an unauthenticated remote attacker to read beyond the bounds of a network-supplied buffer, exposing memory contents to the sender. Affected are a broad set of Windows client and server builds (Windows 10 1607 through 22H2, Windows 11 23H2 through 26H1/26H2, and Windows Server 2012 through 2025, including Server Core installations); per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N the attack is network-reachable, low complexity, requires no authentication or user interaction, and yields a pure confidentiality impact with no integrity or availability effect, which is why the 7.5 base score rests entirely on the C:H rating. Exploitation is not currently observed - CISA's SSVC rates exploitation as 'none', so no public exploit is identified at time of analysis, though the flaw is rated automatable, and vendor patches (cumulative updates raising affected builds to their fixed revisions) are available from Microsoft. Real-world exposure depends on whether the Function Discovery / Web Services on Devices discovery surface is reachable from the attacker's network segment, since hardened environments normally confine it to local or trusted networks rather than the internet.
Improper input validation in Microsoft SharePoint Server Subscription Edition (versions 16.0.0 prior to 16.0.20326.20190) allows an attacker holding a valid low-privilege authenticated session to disclose confidential information over the network, with a CVSS 3.1 base score of 6.5. Because the vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the weakness is remotely reachable and trivially triggered once a session exists, but it cannot be exploited by a fully unauthenticated attacker and produces no integrity or availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a moderate-priority patch-and-monitor item rather than an emergency, though the high confidentiality rating means successful abuse could expose content the attacker is not entitled to read, and the affected server must be network-accessible to the attacker for exploitation.
An out-of-bounds read in Microsoft Windows GDI allows an unauthenticated, network-reachable attacker to disclose process memory, yielding a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) with confidentiality impact only and no integrity or availability loss. Affected platforms span Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1, 26H2) and Windows Server 2012 through 2025 (including Server Core), all of which have vendor patches available. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, EPSS is low at 0.93% (60th percentile), and CISA's SSVC framework rates exploitation as "none" with automatable "no" and technical impact "partial" - signals that are consistently moderate and point away from this being a top-priority emergency despite the High CVSS rating, with the leaked memory being most valuable as an ASLR-bypass or reconnaissance primitive feeding a chained exploit rather than as a standalone compromise.
A double-free flaw in Microsoft IIS enables unauthenticated remote attackers to crash the web server, resulting in a denial of service; availability is the only impacted security property. This is a genuine but bounded availability risk-the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms remote exploitation without credentials or interaction, but no code execution, data disclosure, or integrity loss is assessed. The available intelligence does not indicate active exploitation (no CISA KEV listing) or public exploit code, and the sole reference is Microsoft's MSRC advisory; affected IIS/Windows Server versions must be confirmed there.
Unauthenticated remote attackers can force a deadlock in the Windows Routing and Remote Access Service (RRAS), causing a denial of service against the service itself (CVSS 3.1 base 7.5 HIGH; AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack is remote, low-complexity, requires no credentials and no user interaction, but the practical blast radius is bounded by the deployment prerequisite: the RRAS role must be installed, enabled, and network-reachable, and RRAS is not enabled by default on standard Windows installations. Impact is limited to availability - there is no confidentiality or integrity effect, so the host is not compromised beyond the loss of routing/VPN/remote-access functionality. No public exploit code has been identified at time of analysis and the issue is not reported as confirmed actively exploited (CISA KEV).
Unauthenticated remote resource exhaustion in Adobe ColdFusion 2025 (up to and including 2025.0.13) and ColdFusion 2023 (up to and including 2023.0.25) allows an attacker to drive a reachable application server into an application-level denial-of-service by consuming system resources, with CVSS 3.1 scoring the issue 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) so the entire impact rests on availability. No special feature, protocol, or non-default configuration is required and no user interaction is involved; the practical limiting factor is network reachability, making internet-exposed instances the highest-risk population. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this should be treated as a patch-now availability risk rather than an actively exploited campaign; Adobe ships fixes in advisory APSB26-144.
An unauthenticated attacker with network reachability to the Windows Failover Clustering service can crash the cluster communication component by provoking an uncaught exception (CWE-248), resulting in a denial of service on the affected node. Windows Server 2019, Windows Server 2022, and Windows Server 2025 - including Server Core installations - are affected only when the Failover Clustering role/feature is configured; hosts without clustering enabled are not exposed. The CVSS 3.1 base score of 7.5 (HIGH) derives entirely from availability impact over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.
Denial of service in Windows SMB Server lets unauthenticated remote attackers exhaust or lose track of an allocated server-side resource, causing the SMB service and dependent file-sharing functionality to crash or become unresponsive on affected Windows builds. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H confirms network reachability with no privileges and no user interaction, but impact is confined to availability with no confidentiality or integrity effects. Affected systems span Windows 10, Windows 11 and Windows Server 2012 through 2025 as enumerated in EUVD-2026-100228; no public exploit identified at time of analysis and vendor patches are available, so practical risk is driven mainly by whether TCP/445 is reachable from untrusted networks.
Server-side request forgery in Microsoft SharePoint Server Subscription Edition lets an authenticated remote attacker with low privileges coerce the SharePoint server into making requests to destinations of the attacker's choosing, exposing information held on network-accessible resources that the server can reach (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Because the vector specifies PR:L, a valid low-privileged session on the affected build (16.0.0 before 16.0.20326.20190) is required and unauthenticated exploitation is not indicated; no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a medium-priority, confidentiality-only issue whose urgency is driven by how widely low-privileged accounts are granted and whether the farm is internet-exposed.
Information disclosure in the Windows Presentation Foundation (WPF) component of .NET can be triggered when a Windows desktop application built on an affected Microsoft.WindowsDesktop.App.Runtime version renders attacker-supplied XAML or XPS markup, allowing an unauthenticated remote attacker to leak data (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). The attack is unauthenticated but requires user interaction - the victim's application must load or navigate untrusted markup - and impact is limited to confidentiality, with no integrity or availability loss. No public exploit code was identified at time of analysis, CISA SSVC records exploitation as none and the issue as not automatable; vendor-released patches are available for .NET 8.0, 9.0, 10.0, 11.0 and the affected Visual Studio channels.
Incorrect authorization in Microsoft SharePoint Server Subscription Edition (versions below 16.0.20326.20190) allows an authenticated attacker with low privileges to disclose information over the network, with no user interaction required. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to properly validate whether a user is entitled to access certain data. No public exploit code or confirmed active exploitation is identified at time of analysis for CVE-2026-102865; the limiting factor is that the attacker must already hold valid low-privilege access, so realistic risk is highest in environments with many authenticated users or multi-tenant/shared SharePoint sites where cross-account disclosure matters.
Unauthenticated network requests to a reachable Active Directory Federation Services (AD FS) endpoint on unpatched Windows Server builds can drive excessive memory allocation and exhaust the service's resources, denying service to legitimate users. The vulnerability carries a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no credentials, privileges, or user interaction are required, but the impact is confined to availability - no confidentiality or integrity loss and no code execution. CISA's SSVC assessment records exploitation as 'none' and no public exploit code has been identified at time of analysis, so this is a genuine but moderate-priority availability risk for organizations that actually run the AD FS role; Microsoft has published fixed builds for the affected Windows Server 2012 through 2025 and Server Core platforms.
Authentication spoofing in Microsoft Active Directory Federation Services (AD FS) allows an unauthenticated, network-positioned attacker to bypass federated authentication and have forged identity assertions accepted by an affected deployment, yielding a CVSS 3.1 score of 7.5 driven entirely by high integrity impact (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). The weakness is an authentication bypass by spoofing (CWE-290) hitting the AD FS role on Windows Server 2012 R2, 2012 R2 Server Core, 2016, 2019, 2022, 2025, and the associated Windows 10 and Windows 11 client builds that Microsoft lists in the same update. No public exploit code exists and Microsoft's update is available, so this is a genuine patch-now exposure issue for organizations that actually run AD FS endpoints reachable by untrusted networks, not for hosts that have no AD FS role or are already at the fixed builds (for example Windows Server 2025 10.0.26100.33650, Server 2019 10.0.17763.9376, Server 2016 10.0.14393.9612, Server 2012 R2 6.3.9600.23470).
Siemens Industrial Edge App Publisher versions prior to V1.27.9 fail to validate the server certificate when establishing TLS connections, allowing an attacker who already occupies a privileged man-in-the-middle position on the network path to intercept, relay, and spoof trusted server communication. The flaw is unauthenticated from a credential standpoint (CVSS vector PR:N) but requires on-path access plus victim-initiated connection activity (AT:P, UI:P), so exploitation is constrained to environments where an adversary can insert themselves between the client and the intended server - a meaningful hurdle in segmented industrial networks where App Publisher normally operates. No public exploit code or in-the-wild activity has been identified at time of analysis, and the practical risk is medium-to-high rather than emergency priority: integrity and confidentiality of publisher-to-server traffic are fully exposed (C:H/I:H), while availability is unaffected (A:N).
Information disclosure in Microsoft Active Directory Federation Services (AD FS) allows remote unauthenticated attackers to potentially obtain sensitive data by exploiting observable discrepancies in service responses. Affected systems include Windows Server and Windows client versions where the optional AD FS role is deployed, with internet-facing federation proxies at highest risk. No public exploit code or confirmed active exploitation has been identified, and the assessed vector (AC:H) indicates practical exploitation may require repeated requests and measurable response differences, making this a moderate-priority information-disclosure issue rather than a critical emergency.
Missing authentication for a critical function in Ivanti Xtraction before version 2026.4 allows remote unauthenticated attackers to create or modify trusted site configurations. This vulnerability, tracked as CVE-2026-106043 with a CVSS score of 7.5, has a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N) per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. No public exploit identified at time of analysis; however, successful exploitation requires network reachability to the Xtraction web interface, and instances restricted to internal networks face reduced risk.
Remote code execution is possible on Windows hosts that have the Network Policy Server (NPS) role deployed, where an authenticated attacker with network reach to the service can trigger a heap-based buffer overflow (CWE-122) and potentially take over the NPS process (CVSS 7.5; CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Because NPS is the Windows RADIUS/802.1X authentication service and is not installed by default, exposure is effectively limited to servers functioning as RADIUS or NAP infrastructure, and the high attack complexity (AC:H) reflects the heap grooming typically required for reliable exploitation rather than an easily automated attack. There is no public exploit identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' with automatable 'no', and a vendor patch is available, so this is a genuine but not top-tier priority that should be handled in normal patch cadence.
Code execution in Windows Cryptographic Services is possible when an authenticated attacker with valid low-privilege credentials and network reachability to the affected host wins a memory-lifecycle race in a freed object (use-after-free). Successful exploitation yields high confidentiality and integrity impact, but the high attack complexity (AC:H) means it depends on non-deterministic heap timing rather than a deterministic trigger, and the CVSS vector requires PR:L, so unauthenticated remote exploitation is not described. No public exploit has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and vendor patches are already available for every listed Windows client and server build.
Denial of service in Adobe's CAI (Content Authenticity Initiative) Content Credentials SDK stems from uncontrolled resource consumption when the library parses attacker-supplied assets or their embedded Content Credentials / C2PA manifest data. The vulnerable path is network-reachable with low attack complexity and, per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), requires no authentication and no user interaction, yielding a 7.5 base score with availability-only impact; confidentiality and integrity are unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied, so practical risk is bounded by exposure: because this is an embedded SDK rather than a standalone service, only integrations that feed untrusted, externally sourced content into the parsing/verification path are realistically reachable, while deployments processing only trusted or internally generated assets are not.
Uncontrolled resource consumption in the Adobe CAI Content Credentials SDK lets unauthenticated, remote attackers exhaust system resources and drive an application into denial-of-service by feeding it specially crafted Content Credentials/C2PA data. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is network-reachable, low-complexity, requires no authentication and no user interaction, and affects availability only - there is no confidentiality or integrity impact, so no data compromise is expected. The practical precondition is that a deployed application actually accepts and processes attacker-supplied content through this SDK's parsing or verification path; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the exact input structure that triggers exhaustion is not documented in the available data.
Improper input validation in the Adobe CAI Content Credentials SDK allows remote, unauthenticated attackers to bypass a security control and obtain unauthorized write access. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, any deployment that exposes the vulnerable SDK input path to attacker-supplied content credentials data is reachable without credentials or user interaction, and the impact is integrity-only (C:N/I:H/A:N), meaning tampering with data rather than disclosure or denial of service. Rated CVSS 7.5 (High) and reported directly by Adobe PSIRT via advisory APSB26-163; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Improper input validation in the CAI Content Credentials SDK (Adobe security bulletin APSB26-163) lets unauthenticated remote attackers bypass the SDK's content-credential validation path and gain unauthorized write access, yielding an integrity-only impact (C:N/I:H/A:N, CVSS 7.5). Any deployment that ingests attacker-supplied or externally sourced credential data and runs the vulnerable SDK version through its parse/verify routine is exposed; no authentication (PR:N) and no user interaction (UI:N) are required per the assessed vector, so a default-configured verification service reachable from the network is sufficient. The practical limiting factor is deployment scope rather than a configuration toggle - the flaw only matters where untrusted content actually flows into the SDK - and there is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV) at the time of writing, which keeps this an elevated but not top-tier priority.