Microsoft
Monthly
Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.
Privilege escalation in Windows Installer (msiexec) on Windows 11 and Windows Server 2025 allows a locally authenticated low-privileged user to gain SYSTEM-level privileges by exploiting a use-after-free memory corruption condition. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core deployments. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Kernel (CWE-122) affects a broad span of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authenticated local attacker exploiting this flaw can gain SYSTEM-level privileges, achieving full control over confidentiality, integrity, and availability of the target system. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch is available.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.
Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) affects virtually the entire modern Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - via an incorrect authorization flaw (CWE-863). An attacker with low-privilege authenticated local access can exploit the broken authorization check within the Installer service to elevate to SYSTEM-level privileges, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis, though Microsoft has released patches across the full affected version matrix per MSRC advisory.
Out-of-bounds read in the Windows Remote Desktop Client component (CWE-125) exposes high-sensitivity memory contents to remote network attackers, enabling information disclosure across all supported Windows 10, Windows 11, and Windows Server 2012 through 2025 releases. The vulnerability carries a CVSS 7.5 base score with a network attack vector and no privilege requirement per the official vector, though SSVC classifies exploitation as not automatable and technical impact as partial, suggesting real-world exploitation is constrained by the need for a user to initiate an RDP connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, EPSS places active exploitation probability at 0.85% (55th percentile), and a vendor-released patch is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.
Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.
Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Local code execution in the Windows DHCP Client exposes Windows 11 and Windows Server 2025 systems to privilege escalation by authorized local users via a use-after-free memory corruption condition. The flaw (CWE-416) requires high attack complexity - consistent with race-condition-dependent UAF exploitation - and an existing local foothold (PR:L, AV:L), limiting its practical reach compared to its full C:H/I:H/A:H impact triad. No public exploit has been identified at time of analysis, and Microsoft has released a vendor-confirmed patch.
Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.
Local privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) affects a broad range of Windows 10, Windows 11, and Windows Server releases through a symlink-following flaw (CWE-59). An authenticated local attacker can manipulate file system links to redirect ATBroker.exe file access operations, enabling elevation from a standard user account to SYSTEM-level privileges across default Windows installations. No public exploit has been identified at time of analysis; however, Microsoft has released a patch and the breadth of affected builds makes timely remediation critical.
Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.
Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to elevate to SYSTEM-level access by exploiting a use-after-free memory corruption condition in the kernel-mode driver. The flaw spans a wide swath of Microsoft's supported and legacy Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, making the patching surface unusually broad. No public exploit code or active exploitation has been confirmed at time of analysis; however, the combination of kernel-level impact, full C/I/A compromise upon success, and low privilege prerequisite makes this a meaningful post-compromise escalation risk.
Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Null pointer dereference in the Windows TCP/IP kernel driver exposes virtually every supported Windows Server and desktop release to remote denial-of-service attacks without any authentication or user interaction. The flaw, rooted in CWE-476, causes a kernel panic (Blue Screen of Death) when a specially crafted network packet triggers a NULL pointer dereference in tcpip.sys, crashing the affected host. Nineteen distinct product/version combinations from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2 are confirmed affected; no public exploit has been identified at time of analysis, and Microsoft has released corrective patches.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.
Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.
Remote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run arbitrary code by submitting maliciously crafted serialized data that the product deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 and requires no authentication or user interaction per the vector. A vendor patch is available; no public exploit has been identified at time of analysis.
Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check (CWE-862) on a network-accessible code path, allowing an unauthenticated network attacker to execute arbitrary code on a victim's machine with high impact across confidentiality, integrity, and availability. Exploitation requires user interaction (CVSS UI:R), meaning the victim must engage with attacker-controlled content. A vendor-released patch is available in version 1.132.1; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.
Security feature bypass in Visual Studio Code (versions 1.0.0 through 1.132.1) exploits CWE-639, where authorization decisions rely on attacker-controllable keys, allowing a local attacker to circumvent an intended access control with high impact across confidentiality, integrity, and availability. The attack requires no elevated attacker privileges but does require a legitimate VS Code user to interact with the manipulated environment, pointing to shared-workstation or social-engineering delivery paths. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis; a vendor-released patch is available at version 1.132.1.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).
Spoofing via origin validation failure in Windows Network Address Translation (NAT) exposes Windows Server 2025 and Windows 11 (versions 24H2 through 26H1) to network-layer address spoofing by unauthenticated attackers on an adjacent network. The flaw, rooted in CWE-346, allows crafted packets to bypass NAT's origin-trust enforcement, potentially enabling man-in-the-middle interception or manipulation of traffic transiting the NAT boundary. The CVSS scope change (S:C) reflects that the impact extends beyond the host running NAT to other systems whose traffic passes through it. No public exploit code or active exploitation has been confirmed at time of analysis.
Privilege escalation via untrusted search path (CWE-426) in Windows Narrator Braille affects multiple Windows 10, Windows 11, and Windows Server builds, allowing a locally authenticated attacker to elevate from standard user to higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity once local access is established, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor-released patch is available and should be applied promptly.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Security feature bypass in the Python extension for Visual Studio Code (versions prior to 1.132.1) allows a local attacker to load functionality from an untrusted control sphere, achieving full compromise of confidentiality, integrity, and availability. The attack requires user interaction - specifically opening a malicious workspace or project directory - making it highly relevant in developer supply-chain and social engineering scenarios such as cloning a weaponized repository. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the full CIA impact and low attack complexity elevate real-world concern for development environments.
Unauthenticated network-based denial of service in the Windows Kernel results from unconstrained resource allocation (CWE-770), where the kernel fails to impose limits or throttling on network-triggered resource consumption. Affecting Windows 10, Windows 11, and Windows Server editions spanning 2012 through 2025, a remote attacker with no credentials or user interaction can exhaust system resources and render the host unavailable. No public exploit code or active exploitation has been identified at the time of analysis, though the low-complexity, unauthenticated attack surface warrants prompt patching across all affected enterprise environments.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.
Command injection in Windows Active Directory enables network-based remote code execution against a broad range of Windows client and server versions, from legacy Server 2012 through Windows 11 26H1 and Server 2025. With a CVSS 8.8 and a vector of AV:N/AC:L/PR:N/UI:R, an unauthenticated remote attacker can execute arbitrary commands on affected systems when a local user performs a triggering action - such as processing a crafted request or interacting with attacker-controlled content that reaches the vulnerable AD component. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation over a network by an authorized attacker with high-privilege access. The CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitation yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is confirmed available from Microsoft MSRC.
Local privilege escalation in the Windows RPC API exploits a missing authentication gate on a critical function (CWE-306), enabling any low-privileged authenticated local user to attain SYSTEM-level control across a sweeping range of Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard user account with no user interaction. No public exploit code is identified at time of analysis, and CISA SSVC rates current exploitation status as none, though technical impact is rated total.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Path traversal in Tabby terminal emulator (prior to 1.0.235) on Windows allows a malicious SFTP server to write or overwrite arbitrary files outside the user-selected download or temporary edit directory. When a Windows user downloads a folder or opens a remote file for editing, server-supplied filenames containing backslash sequences bypass POSIX path handling in the SSH layer and are later resolved by Windows-native path.join(), enabling directory traversal. No public exploit code has been identified at time of analysis, but the attack requires only a user connecting to an attacker-controlled SFTP server and initiating a download or file-edit operation.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows enables a local low-privileged attacker to execute arbitrary code at the privilege level of the SDK process by planting a malicious DLL in a user-controlled directory present in the PATH environment variable. The SDK's dependency resolution fallback traverses PATH when a required DLL is not found locally, making the attack reliable and requiring no special tooling. No public exploit has been identified at time of analysis, but the technique is well-documented and the CVSS scope change (S:C) signals that impact can extend beyond the attacker's own privilege tier if the SDK runs under a higher-privileged account.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
Server-side request forgery in Microsoft Office SharePoint lets a remote, unauthenticated attacker coerce the server into issuing attacker-controlled requests, enabling spoofing across a network per Microsoft's classification. The CVSS 3.1 base score is 9.6 (critical) with a changed scope, and exploitation requires a victim to interact with attacker-supplied content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network due to a missing authorization check (CWE-862). The maximum 10.0 CVSS rating stems from a changed scope with high confidentiality and integrity impact, meaning the flaw reaches resources beyond the initially vulnerable component. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect-score, no-precondition profile makes it a top-tier patch priority.
Privilege elevation in Microsoft Planetary Computer Pro allows a remote, unauthenticated attacker to gain elevated privileges over the network by invoking a critical function that lacks an authentication check (CWE-306). Scored CVSS 10.0 with a scope change, the flaw exposes confidential data and permits unauthorized modification against the affected Azure geospatial platform. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the maximal score reflects trivial exploitability against exposed instances.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication controls and gain higher privileges across a network boundary. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H) shows the flaw is remotely reachable, requires only low existing privileges, needs no user interaction, and crosses a security scope to compromise confidentiality and integrity of resources beyond the initially authorized context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.6 base score reflects the low barrier to abuse once an attacker holds any authenticated Teams foothold.
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Privilege elevation in Microsoft Azure SQL Managed Instance lets an unauthenticated network attacker cross the intended communication-channel boundary and gain elevated privileges, carrying a scope-changed CVSS of 10.0 that reflects likely cross-tenant or cross-service impact in this multi-tenant PaaS offering. Microsoft tags it as an authentication bypass exposing high-value confidentiality and integrity, with no availability loss. There is no public exploit identified at time of analysis and EPSS probability is low (0.36%, 29th percentile), consistent with a vendor-discovered, service-side issue rather than mass exploitation.
Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.
Privilege elevation in Microsoft Power Apps allows an unauthorized, network-based attacker to gain elevated permissions by abusing improper authorization checks, with a scope change (S:C) indicating the impact crosses a security boundary beyond the initially compromised component. Exploitation requires some user interaction (UI:R) but no prior authentication (PR:N), and results in high confidentiality and integrity impact. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (Critical).
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.
Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue.
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Path traversal in Microsoft Application Insights Profiler allows an authenticated low-privilege network attacker to escalate privileges, with high confidentiality, integrity, and availability impact. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation requires no special conditions beyond a valid low-privilege account and network reachability, making the barrier to exploitation low. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and high impact profile warrant prompt remediation.
Use-after-free in Windows Winlogon enables a locally authenticated attacker to escalate privileges to SYSTEM level across a broad range of Windows desktop and server editions spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through 2025. The CVSS 7.0 score (AV:L/AC:H/PR:L) reflects that exploitation requires an existing low-privileged foothold and high attack complexity, placing this squarely in the post-compromise privilege escalation category rather than an initial access vector. No public exploit identified at time of analysis; Microsoft has released patches covering all affected build branches.
Privilege escalation in Windows Installer (msiexec) on Windows 11 and Windows Server 2025 allows a locally authenticated low-privileged user to gain SYSTEM-level privileges by exploiting a use-after-free memory corruption condition. Affected builds span Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core deployments. No public exploit code or active exploitation has been identified at time of analysis; a vendor-released patch is available from Microsoft.
Local privilege escalation in Windows HTTP.sys enables authenticated local attackers to gain SYSTEM-level access across a sweeping range of Windows client and server releases, from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. An integer overflow in the kernel-mode HTTP driver triggers a heap-based buffer overflow (consistent with both the CWE-122 classification and the vendor-applied 'Heap Overflow' tag), allowing an attacker with an existing low-privilege local foothold to corrupt kernel heap structures and achieve full code execution as SYSTEM. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, though the extremely broad affected surface and low attack complexity make timely patching a high priority for enterprise environments.
Privilege escalation via use-after-free in the Windows Bind Filter Driver affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, allowing a locally authenticated attacker to gain SYSTEM-level privileges. The memory corruption flaw (CWE-416) is triggered through the kernel-mode filter driver component, yielding full confidentiality, integrity, and availability impact per CVSS. SSVC signals no confirmed exploitation and non-automatable attack path; a vendor patch is available and should be prioritized given the total technical impact rating.
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library enables any standard authenticated local user to gain full SYSTEM-level control across a wide range of Windows 10, Windows 11, and Windows Server deployments. The vulnerability arises from a type confusion condition in the DWM Core Library - though the CWE-122 classification and vendor tags ('Heap Overflow', 'Buffer Overflow') indicate the confusion likely manifests through or triggers a heap-based memory corruption primitive. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Kernel (CWE-122) affects a broad span of Windows 10, Windows 11, and Windows Server releases from 2016 through 2025. An authenticated local attacker exploiting this flaw can gain SYSTEM-level privileges, achieving full control over confidentiality, integrity, and availability of the target system. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; a vendor patch is available.
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated low-privilege attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025. The vulnerability carries a CVSS 7.0 score with high attack complexity (AC:H), indicating exploitation likely requires precise timing or heap-grooming to succeed. No public exploit identified at time of analysis, and Microsoft has released patches addressing all affected build versions.
Privilege escalation in the Windows Bind Filter Driver (bindflt.sys) permits a low-privileged local attacker to gain SYSTEM-level access on Windows 11 and Windows Server 2025 by exploiting a race condition that triggers a use-after-free in kernel memory. Affected builds span Windows 11 24H2, 25H2, and 26H1, as well as Windows Server 2025 including Server Core installations; Microsoft has released patched builds via the MSRC update guide. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows USB Driver (CWE-122) affects a broad range of Microsoft Windows client and server platforms, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authenticated local attacker with low privileges can exploit this kernel-mode heap corruption to achieve full system compromise - gaining complete confidentiality, integrity, and availability over the affected host. Microsoft has released patches across all affected versions via the MSRC advisory; no public exploit has been identified at time of analysis.
Local privilege escalation in Windows Installer (msiexec) affects virtually the entire modern Windows ecosystem - from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025 - via an incorrect authorization flaw (CWE-863). An attacker with low-privilege authenticated local access can exploit the broken authorization check within the Installer service to elevate to SYSTEM-level privileges, achieving full confidentiality, integrity, and availability impact on the host. No public exploit code has been identified at time of analysis, though Microsoft has released patches across the full affected version matrix per MSRC advisory.
Out-of-bounds read in the Windows Remote Desktop Client component (CWE-125) exposes high-sensitivity memory contents to remote network attackers, enabling information disclosure across all supported Windows 10, Windows 11, and Windows Server 2012 through 2025 releases. The vulnerability carries a CVSS 7.5 base score with a network attack vector and no privilege requirement per the official vector, though SSVC classifies exploitation as not automatable and technical impact as partial, suggesting real-world exploitation is constrained by the need for a user to initiate an RDP connection to an attacker-controlled server. No public exploit code has been identified at time of analysis, EPSS places active exploitation probability at 0.85% (55th percentile), and a vendor-released patch is available via Microsoft MSRC.
Privilege escalation via heap-based buffer overflow in Windows Display Enhancement Service allows a local low-privileged attacker to gain SYSTEM-level control across a broad swath of Windows desktop and server releases. The vulnerability carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact upon successful exploitation. No public exploit code has been identified and it is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected versions - spanning Windows 10 through Windows 11 26H1 and Windows Server 2019 through 2025 - makes patching a meaningful operational priority.
Remote code memory disclosure in the Windows Remote Desktop Client (CWE-125) exposes sensitive process memory to an attacker operating a malicious or compromised RDP server. All major Windows desktop and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through Windows Server 2025 are affected, representing essentially the entire active Windows install base running an RDP client. Microsoft has released patches via the MSRC advisory; no public exploit code or CISA KEV listing exists at time of analysis, and SSVC rates exploitation status as none.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows Server and client platforms, allowing a locally authenticated low-privilege user to elevate to SYSTEM-level access by invoking a critical RDS function that lacks proper authentication enforcement (CWE-306). The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects low attack complexity and full confidentiality, integrity, and availability impact once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available for all affected versions.
Privilege escalation via double-free memory corruption in the Windows Network Connection Broker (NCBroker) service affects a broad swath of Microsoft Windows desktop and server releases spanning Windows 10 through Windows 11 26H1 and Windows Server 2012 through Server 2025. An authenticated local attacker with low-privilege access can exploit heap corruption induced by the double-free condition (CWE-415) to elevate privileges to SYSTEM level. No public exploit code or CISA KEV listing has been identified at time of analysis, but the exceptionally wide scope of affected Windows versions substantially broadens the attack surface for organizations with unpatched endpoints.
Privilege escalation in Windows Remote Desktop Services (RDS) via a missing authentication check (CWE-306) allows a locally authenticated, low-privileged user to gain SYSTEM or administrator-level access on the target machine. The vulnerability affects an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates - multiplying the organizational exposure. No active exploitation is confirmed by CISA KEV and no public exploit code is identified at time of analysis, though the low attack complexity (AC:L) and absence of required user interaction make the technique straightforward once a local foothold is achieved.
Privilege escalation in Windows Remote Desktop Services affects a broad range of Windows 10, Windows 11, and Windows Server versions from 2012 through 2025, allowing a locally authenticated low-privilege attacker to elevate to full SYSTEM-level control. The root cause is CWE-306 - a critical RDS function entirely lacking an authentication gate - meaning any low-privilege account holder can invoke it without proper authorization. Microsoft has released patches across all affected product lines, though no public exploit code or CISA KEV listing was present in the available intelligence.
Remote code execution in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on a connecting client system by exploiting a heap-based buffer overflow triggered when the client processes a maliciously crafted RDP server response. All major Windows 10, Windows 11, and Windows Server editions from 2012 through 2025 are affected across x86, x64, and ARM64 architectures. No public exploit has been identified at time of analysis and CISA SSVC confirms no current exploitation; a vendor patch is available through the Microsoft Security Response Center.
Local code execution in the Windows DHCP Client exposes Windows 11 and Windows Server 2025 systems to privilege escalation by authorized local users via a use-after-free memory corruption condition. The flaw (CWE-416) requires high attack complexity - consistent with race-condition-dependent UAF exploitation - and an existing local foothold (PR:L, AV:L), limiting its practical reach compared to its full C:H/I:H/A:H impact triad. No public exploit has been identified at time of analysis, and Microsoft has released a vendor-confirmed patch.
Privilege escalation via heap-based buffer overflow in the Windows Storage subsystem affects a wide range of Windows 11 and Windows Server 2022/2025 builds. An attacker already holding a standard (low-privileged) local user account can exploit the memory corruption flaw to gain full SYSTEM-level control - no user interaction or elevated starting privileges required beyond basic logon. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity (AC:L) makes this a credible post-access escalation primitive.
Local privilege escalation in Windows Accessibility Infrastructure (ATBroker.exe) affects a broad range of Windows 10, Windows 11, and Windows Server releases through a symlink-following flaw (CWE-59). An authenticated local attacker can manipulate file system links to redirect ATBroker.exe file access operations, enabling elevation from a standard user account to SYSTEM-level privileges across default Windows installations. No public exploit has been identified at time of analysis; however, Microsoft has released a patch and the breadth of affected builds makes timely remediation critical.
Local privilege escalation in Windows Application Information Services (appinfo) allows an authenticated local user to gain SYSTEM-level privileges through a use-after-free memory corruption flaw (CWE-416). Affected systems span Windows 11 versions 24H2, 25H2, and 26H1, plus Windows Server 2025 and its Server Core variant - all current, widely-deployed Microsoft platforms. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and full CIA impact (C:H/I:H/A:H) make this a high-priority patch for any environment where untrusted or low-privileged users have local access.
Privilege escalation in Windows Remote Desktop Services (RDS) exploits a missing authentication check for a critical internal function, allowing a locally authenticated attacker to gain SYSTEM-level or equivalent elevated privileges. Affected platforms span Windows 10, Windows 11, and Windows Server 2019 through 2025, covering a broad swath of modern Microsoft deployments. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vendor-confirmed patch availability and low attack complexity make rapid patching urgent.
Heap-based buffer overflow in the Windows Sensor Data Service enables a locally authenticated, low-privileged attacker to fully compromise a target Windows system by escalating to SYSTEM-level privileges. Affecting Windows 10 (21H2, 22H2), Windows 11 (23H2 through 26H1), Windows Server 2022, and Windows Server 2025 across dozens of specific build ranges, exploitation requires no user interaction and low complexity once local access is established. No public exploit code or CISA KEV listing has been identified at time of analysis, but SSVC classifies technical impact as total; Microsoft has released patches across all affected product lines.
Heap-based buffer overflow in the Windows Telephony Service (TAPISRV) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases spanning Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. The vulnerability carries a CVSS 7.8 score with low attack complexity, meaning exploitation is straightforward once local access is established, making it an effective second-stage tool in a broader attack chain. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all affected build lines.
Remote code execution via race condition in the Windows Remote Desktop Client enables unauthenticated network attackers to execute arbitrary code on affected systems across a broad sweep of Windows versions - from the aging Windows Server 2012 through the current Windows 11 26H1 and Windows Server 2025. The flaw (CWE-362) arises from improper synchronization of shared resources during concurrent execution within the RDP client stack, allowing an adversary who can win a precise timing window to achieve full code execution. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none, though the CVSS base score of 8.1 and total technical impact classification make this a meaningful patching priority.
Privilege escalation in the Windows Work Folder Service allows an authenticated local attacker to gain SYSTEM-level privileges via a use-after-free memory corruption flaw rooted in a race condition (CWE-362). The vulnerability affects a wide range of Windows client and server releases from Windows Server 2012 R2 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, and SSVC assessment confirms no observed exploitation; however, technical impact is rated 'total,' indicating full system compromise is achievable if exploited.
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an authenticated local attacker with low privileges to elevate to SYSTEM-level access by exploiting a use-after-free memory corruption condition in the kernel-mode driver. The flaw spans a wide swath of Microsoft's supported and legacy Windows ecosystem, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025, making the patching surface unusually broad. No public exploit code or active exploitation has been confirmed at time of analysis; however, the combination of kernel-level impact, full C/I/A compromise upon success, and low privilege prerequisite makes this a meaningful post-compromise escalation risk.
Local privilege escalation in the Windows Graphics Kernel exposes a broad range of Windows 10, Windows 11, and Windows Server editions to a use-after-free memory corruption flaw (CWE-416). An attacker holding a low-privileged local account who can satisfy a race condition in the kernel graphics subsystem can gain SYSTEM-level control of the affected host. Microsoft has released patches across all identified product lines; no public exploit has been identified at time of analysis.
Remote code execution in the Windows Remote Desktop Client exposes client machines across Windows 10, 11, and multiple Windows Server generations when connecting to an attacker-controlled RDP server. The heap-based buffer overflow (CVSS 8.1, AV:N/AC:H/PR:N/UI:N) allows a remote unauthenticated attacker to gain full control over a vulnerable client machine, though the AC:H rating reflects non-trivial exploitation preconditions. Microsoft has released patches across all affected product lines; no active exploitation is confirmed per SSVC and the absence of a CISA KEV listing, with EPSS at 0.64% (47th percentile) indicating low near-term exploitation probability.
Privilege escalation in Microsoft High Performance Computing (HPC) Pack allows a network-authenticated attacker with low-privilege access to elevate privileges to a higher level, potentially achieving full system compromise. The flaw stems from CWE-250 (Execution with Unnecessary Privileges), meaning a component within HPC Pack runs with more rights than its function requires, providing a lever for a legitimately authenticated user to abuse. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the CVSS 8.8 score and full C/I/A impact triad indicate a serious risk in any environment where untrusted low-privilege users have network access to HPC Pack services.
Null pointer dereference in the Windows TCP/IP kernel driver exposes virtually every supported Windows Server and desktop release to remote denial-of-service attacks without any authentication or user interaction. The flaw, rooted in CWE-476, causes a kernel panic (Blue Screen of Death) when a specially crafted network packet triggers a NULL pointer dereference in tcpip.sys, crashing the affected host. Nineteen distinct product/version combinations from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2 are confirmed affected; no public exploit has been identified at time of analysis, and Microsoft has released corrective patches.
Privilege escalation in Windows Installer exposes virtually every supported Windows release to local elevation-of-privilege via an integer overflow (CWE-190) in the msiexec/installer subsystem. Any low-privileged local user can trigger the flaw to gain SYSTEM-level control, with full confidentiality, integrity, and availability impact confirmed by the CVSS:3.1 AV:L/PR:L/C:H/I:H/A:H vector. Microsoft has released patches across all affected product lines; no public exploit code or CISA KEV listing has been identified at the time of this analysis.
Privilege escalation in the Windows Event Logging Service affects Windows 10, Windows 11, and Windows Server 2022/2025 across a wide range of builds via an improperly synchronized race condition on a shared resource. An authorized local attacker with low-level credentials can win a concurrent execution timing window to gain full SYSTEM-level privileges, achieving complete confidentiality, integrity, and availability compromise on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions across both client and server editions makes patching a high-priority operational item.
Privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver affects Windows 10, 11, and Server 2016 through 2025, enabling a low-privileged local attacker to achieve full kernel-level control via a use-after-free memory corruption in a kernel-mode driver. The CVSS AC:H rating indicates the exploit path likely requires precise timing - consistent with a race condition in driver memory management - which reduces but does not eliminate real-world risk. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch from Microsoft is available.
Remote code execution in Microsoft High Performance Computing (HPC) Pack allows an unauthorized network attacker to run arbitrary code by submitting maliciously crafted serialized data that the product deserializes without validation (CWE-502). The flaw carries a CVSS 9.8 and requires no authentication or user interaction per the vector. A vendor patch is available; no public exploit has been identified at time of analysis.
Privilege escalation in Windows Telephony Service via an improper synchronization race condition (CWE-362) allows a locally authenticated, low-privilege attacker to gain full control over an affected system, achieving high confidentiality, integrity, and availability impact. The flaw spans an exceptionally broad range of Windows releases - from Windows Server 2012 through Windows 11 25H2 and Windows Server 2025 - and Microsoft has issued patched builds through the MSRC update guide. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Remote code execution in Visual Studio Code (versions 1.0.0 through 1.132.0) is enabled by a missing authorization check (CWE-862) on a network-accessible code path, allowing an unauthenticated network attacker to execute arbitrary code on a victim's machine with high impact across confidentiality, integrity, and availability. Exploitation requires user interaction (CVSS UI:R), meaning the victim must engage with attacker-controlled content. A vendor-released patch is available in version 1.132.1; no public exploit code or CISA KEV listing is confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Word enables local code execution with full user-level impact when a victim opens a specially crafted document. Affected products span Microsoft 365 Apps for Enterprise, Office LTSC 2021 and 2024 (both Windows and Mac), and Office 365 for Mac. No public exploit identified at time of analysis, and no CISA KEV listing; however, the CVSS 7.8 score and complete C/I/A impact triad reflect the severity of arbitrary code execution achievable through a standard phishing or malicious file delivery scenario.
Security feature bypass in Visual Studio Code (versions 1.0.0 through 1.132.1) exploits CWE-639, where authorization decisions rely on attacker-controllable keys, allowing a local attacker to circumvent an intended access control with high impact across confidentiality, integrity, and availability. The attack requires no elevated attacker privileges but does require a legitimate VS Code user to interact with the manipulated environment, pointing to shared-workstation or social-engineering delivery paths. No public exploit code has been identified and this CVE is absent from the CISA KEV catalog at time of analysis; a vendor-released patch is available at version 1.132.1.
Local privilege escalation in Microsoft .NET runtimes (versions 8.0, 9.0, and 10.0) enables a local attacker to gain elevated system privileges by triggering an integer overflow condition, requiring only user interaction and no prior authentication. The flaw carries a CVSS 7.8 score with high impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing has been identified at time of analysis, but the broad deployment of .NET across enterprise Windows and Linux environments makes this a meaningful patching priority.
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).
Spoofing via origin validation failure in Windows Network Address Translation (NAT) exposes Windows Server 2025 and Windows 11 (versions 24H2 through 26H1) to network-layer address spoofing by unauthenticated attackers on an adjacent network. The flaw, rooted in CWE-346, allows crafted packets to bypass NAT's origin-trust enforcement, potentially enabling man-in-the-middle interception or manipulation of traffic transiting the NAT boundary. The CVSS scope change (S:C) reflects that the impact extends beyond the host running NAT to other systems whose traffic passes through it. No public exploit code or active exploitation has been confirmed at time of analysis.
Privilege escalation via untrusted search path (CWE-426) in Windows Narrator Braille affects multiple Windows 10, Windows 11, and Windows Server builds, allowing a locally authenticated attacker to elevate from standard user to higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity once local access is established, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but a vendor-released patch is available and should be applied promptly.
Heap-based buffer overflow in Windows Imaging Component (WIC), Microsoft's built-in image processing framework, enables local code execution across virtually every supported Windows client and server release from Windows 10 1607 through Windows 11 25H2 and Windows Server 2012 through 2025. The flaw is triggered when a user opens or previews a specially crafted image file, requiring no prior authentication or elevated privileges, and yields full confidentiality, integrity, and availability impact on the compromised system. Vendor-released patches are available via Microsoft's July 2026 update cycle; no public exploit code or active exploitation has been identified at time of analysis.
Security feature bypass in the Python extension for Visual Studio Code (versions prior to 1.132.1) allows a local attacker to load functionality from an untrusted control sphere, achieving full compromise of confidentiality, integrity, and availability. The attack requires user interaction - specifically opening a malicious workspace or project directory - making it highly relevant in developer supply-chain and social engineering scenarios such as cloning a weaponized repository. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the full CIA impact and low attack complexity elevate real-world concern for development environments.
Unauthenticated network-based denial of service in the Windows Kernel results from unconstrained resource allocation (CWE-770), where the kernel fails to impose limits or throttling on network-triggered resource consumption. Affecting Windows 10, Windows 11, and Windows Server editions spanning 2012 through 2025, a remote attacker with no credentials or user interaction can exhaust system resources and render the host unavailable. No public exploit code or active exploitation has been identified at the time of analysis, though the low-complexity, unauthenticated attack surface warrants prompt patching across all affected enterprise environments.
Privilege elevation in Microsoft Azure Kubernetes Service (AKS) lets a network-based, unauthenticated attacker gain elevated privileges by reaching a critical function that lacks an authentication check (CWE-306). Microsoft rates it 9.4 (Critical) with an AV:N/AC:L/PR:N/UI:N vector, indicating trivial remote reachability and no user interaction, though scope is unchanged. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the missing-auth root cause and high confidentiality/integrity impact make it a high-priority cloud-platform issue.
Heap-based buffer overflow in the Windows LUAFV (Layered User Access Filter Volume) kernel driver enables a locally authenticated, low-privileged user to escalate to full SYSTEM-level privileges across a wide range of Windows desktop and server releases. Microsoft has released patches covering Windows 10 through Windows 11 and Windows Server 2012 through Server 2025, with exact fix builds published via MSRC and ENISA EUVD-2026-56287. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the AC:H constraint limits opportunistic exploitation rather than eliminating risk from determined actors who already hold a foothold.
Command injection in Windows Active Directory enables network-based remote code execution against a broad range of Windows client and server versions, from legacy Server 2012 through Windows 11 26H1 and Server 2025. With a CVSS 8.8 and a vector of AV:N/AC:L/PR:N/UI:R, an unauthenticated remote attacker can execute arbitrary commands on affected systems when a local user performs a triggering action - such as processing a crafted request or interacting with attacker-controlled content that reaches the vulnerable AD component. No public exploit or CISA KEV listing has been identified at time of analysis, but Microsoft has released patches across all affected branches.
Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation over a network by an authorized attacker with high-privilege access. The CVSS:3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms network-based exploitation yielding full confidentiality, integrity, and availability impact on the affected host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is confirmed available from Microsoft MSRC.
Local privilege escalation in the Windows RPC API exploits a missing authentication gate on a critical function (CWE-306), enabling any low-privileged authenticated local user to attain SYSTEM-level control across a sweeping range of Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms low-complexity exploitation requiring only a standard user account with no user interaction. No public exploit code is identified at time of analysis, and CISA SSVC rates current exploitation status as none, though technical impact is rated total.
Kernel-mode stack overflow in Intel PROSet/Wireless WiFi Software for Windows allows adjacent unauthenticated attackers to crash affected systems, resulting in a full system denial of service. The flaw resides in Ring 0 (kernel privilege level) WiFi driver code, meaning a successful exploit triggers a kernel panic or Blue Screen of Death rather than a user-space crash. No public exploit or CISA KEV listing has been identified at time of analysis, and no exact patched version is confirmed in the available reference data - the Intel advisory INTEL-SA-01468 should be consulted directly.
Kernel-mode denial of service in Intel PROSet/Wireless WiFi Software for Windows allows an adjacent unauthenticated attacker to crash the target system by triggering an improper buffer restriction in the Ring 0 (kernel-level) WiFi driver component. The vulnerability carries a CVSS 4.0 score of 8.3, requires no authentication or user interaction, and is confined to adjacent-network attackers. Intel has acknowledged the issue via security advisory INTEL-SA-01468; no public exploit code exists and no CISA KEV listing has been identified at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows allows local unprivileged code operating within the Ring 2 privileged process boundary to elevate access rights due to improper privilege management (CWE-269), yielding high availability impact and limited confidentiality and integrity exposure on both the vulnerable and subsequent systems. The attack is constrained to local access and requires high complexity, but no prior authentication or user interaction is needed from the attacker. Intel has published advisory INTEL-SA-01468 to address this flaw; no public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from a null pointer dereference (CWE-476) in the Ring 2 device driver layer, allowing an adjacent unauthenticated attacker to crash the affected system with no user interaction required. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VA:H) confirms low-complexity exploitation from the same network segment, resulting in high availability impact to the vulnerable system and residual low availability impact to subsequent systems. No public exploit code or CISA KEV entry has been identified at time of analysis, though the absence of authentication and interaction requirements makes this trivially triggerable by any adjacent network adversary.
Denial of service in Intel PROSet/Wireless WiFi Software for Windows stems from improper buffer restrictions (CWE-119) in the Ring 2 device driver layer, exploitable by an adjacent network attacker without authentication or user interaction. An attacker within Wi-Fi range or on the same network segment can trigger a driver-level crash by sending crafted wireless input, resulting in high availability impact on the target system and low availability impact on subsequent systems, with no confidentiality or integrity consequences. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Privilege escalation in Intel PROSet/Wireless WiFi Software for Windows exposes local systems to code execution by unprivileged attackers via a Ring 2 (device driver layer) improper access control flaw. Any local process with no privileges required and no user interaction can leverage the driver's failure to enforce access boundaries to achieve local code execution, with follow-on high confidentiality impact on the broader system - consistent with a kernel-level scope change. No public exploit identified at time of analysis, and no CISA KEV listing; however, the low complexity and zero-privilege requirement make this a credible post-compromise escalation vector for threat actors with any form of local code execution already established.
Null pointer dereference in Intel PROSet/Wireless WiFi Software for Windows at the Ring 2 device driver layer enables denial of service by an unauthenticated adjacent-network attacker. Disclosed by Intel in advisory INTEL-SA-01422, the flaw affects all currently indexed versions of the software and can be triggered at low complexity with no user interaction or special attack prerequisites. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the kernel-mode (Ring 0) component of Intel PROSet/Wireless WiFi Software for Windows enables a denial-of-service condition against affected Windows hosts. An unauthenticated attacker with adjacent network access and the ability to satisfy specific attack requirements can trigger a kernel-level crash, resulting in high availability impact to both the vulnerable system and any subsequent system processes. No public exploit code has been identified at time of analysis, and this CVE has not been listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds write in Intel PROSet/Wireless WiFi Software for Windows device drivers (Ring 2) allows adjacent network attackers to trigger a denial of service condition without authentication or user interaction. Unauthenticated attackers on the same network segment can exploit this CWE-787 buffer overflow flaw with low complexity, causing high availability impact to the affected Windows system and low residual availability impact on subsequent systems. No public exploit code and no CISA KEV listing exist at time of analysis.
Denial-of-service in Intel PROSet/Wireless WiFi Software for Windows (Ring 2 device driver layer) allows an unauthenticated adjacent-network attacker to crash or disable the wireless driver with no user interaction. The flaw stems from an improper conditions check (CWE-754) in the driver, yielding complete loss of wireless availability on the affected system and minor downstream availability impact on subsequently connected systems. No public exploit or CISA KEV listing exists at time of analysis, and Intel has published an advisory at INTEL-SA-01422.
Intel PROSet/Wireless WiFi Software for Windows contains a null pointer dereference in Ring 0 (kernel space) that an adjacent, unauthenticated attacker can exploit to crash the target system, resulting in a denial of service. The flaw resides in the WiFi kernel driver, meaning a successful trigger causes a kernel panic (BSOD on Windows) with high availability impact on both the vulnerable component and the broader system. No public exploit code has been identified at time of analysis, and no KEV listing exists, but the adjacent-network attack vector and zero-privilege requirement make this relevant for any environment where untrusted parties share a wireless segment with Intel WiFi-equipped Windows endpoints.
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. No public exploit has been identified at time of analysis; however, the vulnerability is exploitable in straightforward steps once both deployment preconditions are satisfied.
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Path traversal in Tabby terminal emulator (prior to 1.0.235) on Windows allows a malicious SFTP server to write or overwrite arbitrary files outside the user-selected download or temporary edit directory. When a Windows user downloads a folder or opens a remote file for editing, server-supplied filenames containing backslash sequences bypass POSIX path handling in the SSH layer and are later resolved by Windows-native path.join(), enabling directory traversal. No public exploit code has been identified at time of analysis, but the attack requires only a user connecting to an attacker-controlled SFTP server and initiating a download or file-edit operation.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
SQL injection in Plesk Obsidian up to version 18.0.80 on Linux and Windows allows any authenticated panel user to read arbitrary data from the underlying control panel database. The CVSS scope change (S:C) reflects that the injected queries cross the application boundary into the database tier, and the high confidentiality impact (C:H) is consistent with a hosting control panel whose database contains cross-tenant customer records, credentials, and configuration data. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Path traversal in Tobit Laboratories AG TeamDavid's Webbox archive creation functionality allows authenticated low-privilege remote attackers to create directories in arbitrary filesystem locations, including sensitive Windows system paths such as C:\Windows and other users' directories. All TeamDavid releases through Rollout 524 are affected, as confirmed by NCSC.ch and detailed in InfoGuard's research disclosing 22 CVEs across the David platform. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.5 reflects significant potential impact on both the vulnerable host and downstream systems.
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows enables a local low-privileged attacker to execute arbitrary code at the privilege level of the SDK process by planting a malicious DLL in a user-controlled directory present in the PATH environment variable. The SDK's dependency resolution fallback traverses PATH when a required DLL is not found locally, making the attack reliable and requiring no special tooling. No public exploit has been identified at time of analysis, but the technique is well-documented and the CVSS scope change (S:C) signals that impact can extend beyond the attacker's own privilege tier if the SDK runs under a higher-privileged account.
Local privilege escalation in PowerISO 9.3.0.0 on Windows exposes low-privileged local users to full system compromise via the scdemu.sys kernel driver's improper privilege management (CWE-269). The exploit - publicly detailed as arbitrary registry write or deletion through the driver's IOCTL interface - allows elevation to SYSTEM-level control with high confidentiality, integrity, and availability impact on the vulnerable host. No vendor patch exists; the vendor did not respond to responsible disclosure, and a public proof-of-concept has been released, lowering the skill threshold for exploitation.
Server-side request forgery in Microsoft Office SharePoint lets a remote, unauthenticated attacker coerce the server into issuing attacker-controlled requests, enabling spoofing across a network per Microsoft's classification. The CVSS 3.1 base score is 9.6 (critical) with a changed scope, and exploitation requires a victim to interact with attacker-supplied content (UI:R). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Privilege escalation in Microsoft Purview eDiscovery enables an authenticated low-privileged attacker to gain elevated access over the network, with full confidentiality, integrity, and availability impact once exploited. The vulnerability stems from improper access control (CWE-284), meaning the service fails to enforce authorization boundaries between privilege levels for eDiscovery operations such as case management, legal holds, and content searches. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis, though the low attack complexity and network accessibility make this a credible threat in Microsoft 365 enterprise environments.
Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network due to a missing authorization check (CWE-862). The maximum 10.0 CVSS rating stems from a changed scope with high confidentiality and integrity impact, meaning the flaw reaches resources beyond the initially vulnerable component. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect-score, no-precondition profile makes it a top-tier patch priority.
Privilege elevation in Microsoft Planetary Computer Pro allows a remote, unauthenticated attacker to gain elevated privileges over the network by invoking a critical function that lacks an authentication check (CWE-306). Scored CVSS 10.0 with a scope change, the flaw exposes confidential data and permits unauthorized modification against the affected Azure geospatial platform. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the maximal score reflects trivial exploitability against exposed instances.
Cryptographic signature spoofing in Microsoft Teams exposes enterprise collaboration environments to unauthenticated identity impersonation over the network. The flaw, tagged as a JWT attack enabling authentication bypass, allows a remote attacker with no prior credentials to forge or tamper with token-based identity claims that Teams fails to properly verify. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a low-barrier, remotely exploitable path with high integrity impact.
Privilege elevation in Microsoft Teams allows an authenticated attacker with low-level access to bypass authentication controls and gain higher privileges across a network boundary. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H) shows the flaw is remotely reachable, requires only low existing privileges, needs no user interaction, and crosses a security scope to compromise confidentiality and integrity of resources beyond the initially authorized context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the 9.6 base score reflects the low barrier to abuse once an attacker holds any authenticated Teams foothold.
Privilege elevation in Microsoft 365 Admin Center allows a remote, unauthenticated attacker to gain elevated permissions by exploiting improper verification of a cryptographic signature (CWE-347), consistent with the vendor-supplied 'Authentication Bypass' and 'JWT Attack' tags. The maximal 9.8 CVSS with a fully network-reachable, no-privilege, no-interaction vector makes this a critical bypass of the admin portal's trust boundary. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.
Privilege elevation in Microsoft Azure SQL Managed Instance lets an unauthenticated network attacker cross the intended communication-channel boundary and gain elevated privileges, carrying a scope-changed CVSS of 10.0 that reflects likely cross-tenant or cross-service impact in this multi-tenant PaaS offering. Microsoft tags it as an authentication bypass exposing high-value confidentiality and integrity, with no availability loss. There is no public exploit identified at time of analysis and EPSS probability is low (0.36%, 29th percentile), consistent with a vendor-discovered, service-side issue rather than mass exploitation.
Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.
Privilege elevation in Microsoft Power Apps allows an unauthorized, network-based attacker to gain elevated permissions by abusing improper authorization checks, with a scope change (S:C) indicating the impact crosses a security boundary beyond the initially compromised component. Exploitation requires some user interaction (UI:R) but no prior authentication (PR:N), and results in high confidentiality and integrity impact. At time of analysis there is no public exploit identified and the issue is not listed in CISA KEV; the CVSS base score is 9.3 (Critical).
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.
Elevation of privilege in Microsoft Azure SQL Database lets an unauthorized network attacker bypass authentication and gain higher privileges, with a maximum CVSS 10.0 and a scope change indicating the flaw extends impact beyond the initially vulnerable component. The CVSS vector (PR:N/UI:N) means no credentials or user interaction are required, making this a critical priority despite no public exploit being identified. As a managed cloud service, remediation is handled server-side by Microsoft rather than by customer patching.
Information disclosure in Microsoft Azure Logic Apps allows an authenticated, low-privileged attacker to read data they should not have access to across a network, with a scope-changed CVSS 3.1 score of 9.6 reflecting potential cross-boundary (multi-tenant) impact. The flaw stems from improper access control (CWE-284) in the cloud workflow-automation service; Microsoft is the reporter and remediation is delivered service-side. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, though the high score and scope change warrant prompt attention.
Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue.
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Path traversal in Microsoft Application Insights Profiler allows an authenticated low-privilege network attacker to escalate privileges, with high confidentiality, integrity, and availability impact. The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) indicates exploitation requires no special conditions beyond a valid low-privilege account and network reachability, making the barrier to exploitation low. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and high impact profile warrant prompt remediation.