Windows Server 2012

CVE-2026-97820 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorization on the network read memory beyond intended buffer boundaries and disclose that information over the network. Only hosts running the DNS Server role are affected, spanning Windows Server 2012 through 2025 (including Server Core installations) plus Windows 10 and Windows 11 clients that host the role; exploitation requires an authenticated/authorized position (CVSS PR:L) with network reachability to the DNS service, so it is not an unauthenticated remote flaw. Impact is limited to confidentiality (C:H) with no integrity or availability effect, and no public exploit code has been identified at time of analysis - the practical risk concentrates in environments where low-privilege accounts or internal footholds can reach a DNS server.

CVE-2026-97819 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read (CWE-125) in the Microsoft Windows DNS Server role allows an attacker holding low-privilege authenticated access to disclose information over the network. Only hosts actually running the DNS Server role are exposed; the flaw is rated CVSS 6.5 with high confidentiality impact but no integrity or availability impact, and exploitation requires authorized (PR:L) rather than unauthenticated network access. Patched builds are available from the vendor per the MSRC update guide, and no public exploit code or active exploitation has been identified at time of analysis.

CVE-2026-97817 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow in Windows DNS Server allows an authenticated, low-privilege attacker with network access to disclose sensitive information from server memory. The vulnerability affects numerous Windows Server and Windows 10/11 builds that have the DNS Server role installed, with no public exploit identified at time of analysis. Although rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, the confidentiality-only impact and requirement for authentication limit the realistic threat to information leakage rather than code execution or denial of service.

CVE-2026-96948 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Local information disclosure in the Windows Client Side Caching driver (csc.sys) lets an authenticated attacker who already holds low-level privileges on a Windows host read sensitive data that should be restricted, such as contents of the Offline Files cache. The flaw affects default installations across Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012 through 2025, and requires only local access with no user interaction (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5). There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable with partial technical impact, and Microsoft has released patched builds - making this a post-compromise disclosure primitive rather than a remote entry point.

CVE-2026-96938 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Local privilege escalation in the Windows Distributed File System (DFS) lets an authenticated attacker with valid host credentials trigger a heap-based buffer overflow (CWE-122) and elevate to SYSTEM on unpatched Windows 10, Windows 11, and Windows Server builds. Exploitation is local only with no user interaction and, per Microsoft's advisory, requires existing high privileges, so realistic exposure is limited to shared, multi-user, or terminal-server hosts where an untrusted authenticated principal is present. No public exploit code has been identified at time of analysis and CISA's SSVC rates exploitation as none; vendor patches are available.

CVE-2026-96935 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in the Windows NTFS file system driver allows an authenticated local attacker to read sensitive system information that should be restricted to a higher privilege level. The flaw affects Windows 10, Windows 11, and Windows Server installations on NTFS volumes below their respective patched builds; exploitation requires pre-existing local code execution or interactive access as a low-privileged user (CVSS PR:L), with no remote vector and no user interaction (UI:N). No public exploit code has been identified at time of analysis, and Microsoft has released vendor patches.

CVE-2026-96930 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Universal Disk Format File System (UDFS) kernel-mode driver lets a locally authenticated attacker disclose information - potentially kernel memory contents - on an affected host. Exploitation requires existing local access and the ability to feed crafted UDF-formatted content (a mounted ISO/UDF image, removable USB media, or a virtual volume) to the driver; the vulnerability is not remotely reachable, cannot be triggered unauthenticated, and has no integrity or availability impact, which is why CISA's SSVC rates it non-exploited and non-automatable. Microsoft has shipped fixed builds for every affected Windows 10, Windows 11, and Windows Server release, and no public exploit code has been identified at time of analysis, making this a moderate-severity, low-priority issue despite affecting a kernel-mode component present by default on all listed platforms.

CVE-2026-96927 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows NTFS file system driver (ntfs.sys) lets an authenticated local user with low privileges read memory contents beyond an allocated buffer, resulting in local information disclosure (CWE-125, CVSS 3.1 5.5). Only hosts that have not applied Microsoft's current cumulative updates are affected; the EUVD data lists a broad range of client and server branches below their respective fixed builds (?fix versions include Windows 11 23H2 10.0.22631.7652, 24H2 10.0.26100.9711, 25H2 10.0.26200.9711, Windows 10 1607/Server 2016 10.0.14393.9612, and Windows 10 1809/Server 2019 10.0.17763.9376). There is no remote vector and CISA SSVC rates the flaw as non-automatable with only partial technical impact, and no public exploit code has been identified at time of analysis, so this is a genuine but low-priority disclosure primitive rather than a path to privilege escalation.

CVE-2026-96926 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Tampering with Windows DNS Server configuration or data is possible for an authenticated local attacker on affected Windows Server and Windows 10 builds because of missing authorization checks (CWE-862). Affected systems must be running the DNS Server role, and exploitation only compromises integrity (no confidentiality or availability impact). Microsoft has released vendor patches; CISA SSVC rates exploitation as none, the issue is not automatable, and no public exploit is identified at time of analysis.

CVE-2026-96925 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in the Microsoft Windows NTFS filesystem driver allows a local, low-privileged, authenticated attacker to read portions of kernel memory by triggering an integer underflow (wraparound) during a crafted NTFS operation, with no user interaction required. Exploitation is confined to the local attack vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and yields confidentiality impact only (C:H/I:N/A:N, score 5.5) - there is no write, code-execution, or denial-of-service effect, and CISA's SSVC analysis rates the issue as not automatable with no known exploitation. No public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch covering all affected Windows client and server builds.

CVE-2026-96921 Oct 13, 19:22 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in Windows Message Queuing (MSMQ) Queue Manager allows an authenticated local attacker to read data from an affected host via a type confusion flaw. Exploitation requires the optional MSMQ feature to be installed and the Queue Manager service running (not enabled by default), and impact is limited to confidentiality with no code execution or privilege escalation. Microsoft has released patches; no public exploit or active exploitation has been identified at time of analysis.

CVE-2026-96851 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in Windows Management Instrumentation (WMI) allows an authenticated local attacker to read past the end of an intended buffer, potentially exposing sensitive data held in the memory of the WMI service. The flaw affects a wide span of Windows builds - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2 through 26H2, including 26H1), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations - and requires the attacker to already hold a low-privileged local session on the host (CVSS 3.1 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Impact is confidentiality-only: no data modification, no denial of service, and no remote or unauthenticated path is indicated by the assessed vector. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none and automatable as no, and Microsoft has released fixed builds for the affected branches.

CVE-2026-96846 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the WebDAV functionality of Microsoft Windows allows a locally authenticated, low-privileged attacker to read memory contents and disclose information; exploitation requires existing local access to the host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5), with no user interaction and low complexity. Affected systems span Windows 10, Windows 11 (23H2 through 26H2) and Windows Server 2012 through 2025, including Server Core installations, per the EUVD-listed build ranges. There is no CISA KEV entry and no public exploit identified at time of analysis (SSVC: Exploitation none, Automatable no), so this is a moderate, not urgent, priority best characterized as a post-compromise or malicious-insider information-disclosure aid rather than an initial-access vector.

CVE-2026-96316 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Improper access control in the Windows Routing and Remote Access Service (RRAS) allows an authenticated local attacker holding only low-level privileges to tamper with service state or configuration on affected Windows 10, Windows 11, and Windows Server builds. Exploitation is strictly local (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), requires the optional RRAS role to be installed and enabled, and impacts integrity only - confidentiality and availability are unaffected, which is consistent with the moderate 5.5 base score. There is no public exploit identified at time of analysis and no evidence of confirmed active exploitation (CISA KEV), and vendor-released patches are available for every affected build branch.

CVE-2026-96314 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Audio Service (Audiosrv) allows an attacker who already holds authenticated local access with low-level privileges to disclose memory contents from the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning it is strictly a local, post-compromise information-disclosure issue - there is no remote vector, no integrity or availability impact, and no code execution. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records no exploitation activity and marks the issue as not automatable, so this is a genuine but low-urgency issue that should be handled through routine patching rather than emergency response.

CVE-2026-96311 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Local tampering of network list data in the Windows Network List Service allows an authenticated low-privileged attacker to modify network profiles and settings, resulting in partial integrity impact while confidentiality and availability remain unaffected. Affected versions span Windows 10, Windows 11, and numerous Windows Server releases, with vendor patches available. No public exploit identified at time of analysis, and given the required local access and lack of remote vector, the risk is assessed as a moderate, low-priority integrity issue.

CVE-2026-96247 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in Windows Kernel-Mode Drivers lets an authenticated local attacker read uninitialized kernel memory and leak residual kernel data on affected Windows 10, Windows 11, and Windows Server builds (Windows Server 2012 R2 through 2025). Exploitation requires a pre-existing standard local account and the ability to invoke the vulnerable driver code path; it is not remotely triggerable, needs no user interaction, and provides no code execution or system modification, so realistic value is as a kernel-memory-leak primitive inside a larger exploit chain. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA SSVC rates the issue non-automatable, consistent with its low-to-moderate priority despite the CVSS 5.5 Medium score.

CVE-2026-95904 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in the Windows Event Log service allows an authenticated local attacker to read potentially sensitive memory contents. Affecting a broad range of Windows 10, 11, and Server editions, this low-severity flaw requires prior local access and only results in confidentiality impact, with no code execution or privilege escalation. No public exploit identified at time of analysis, and Microsoft has released patches.

CVE-2026-88226 Oct 13, 19:21 MEDIUM PATCH This Month

An out-of-bounds read in the Microsoft Windows Storage Port Driver (CWE-125) lets an attacker who already has physical access to a device read past the end of a buffer and disclose kernel memory contents to an unauthorized party. Every supported Windows client and server build from Windows 10 1607 and Windows Server 2012 through Windows 11 26H2 and Windows Server 2025 is affected, as tracked in EUVD-2026-100340, and because the vector is AV:P the flaw cannot be reached remotely - it is confined to lost, stolen, or unattended hardware and evil-maid style scenarios. Microsoft has released a vendor patch, there is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as none and the issue as non-automatable, making this a genuinely low-priority item despite the CVSS confidentiality rating of High.

CVE-2026-88130 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Denial of service in the Microsoft Windows DNS Server role allows a network-reachable attacker who holds valid low-privilege credentials to crash or destabilize the DNS service on unpatched Windows Server releases from 2012 through 2025, including Server Core installations. Per the assessed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authorization on the target - this is explicitly an 'authorized attacker' scenario, not anonymous remote abuse - and the resulting impact is availability only, with no code execution, no data access, and no integrity loss. No public exploit has been identified at time of analysis and CISA's SSVC rates the issue non-automatable with nonexistent observed exploitation, making this a moderate-priority availability bug rather than a critical RCE-class threat.

CVE-2026-88129 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Microsoft Windows DNS Server role lets a remote attacker who already holds a low level of authorization (PR:L, per the assessed CVSS vector) crash or destabilize the DNS service, denying name resolution to clients on the network. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core installations), and exploitation requires the DNS Server role to be installed and reachable. Impact is availability-only (C:N/I:N/A:H) with no confidentiality or integrity effect, no public exploit identified at time of analysis, no CISA KEV listing, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no' - a moderate, not top-tier, priority. Microsoft has released fixed builds.

CVE-2026-88125 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Denial of service in the Windows DNS Server role affects Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations), where an attacker who already holds valid low-privilege credentials (CVSS PR:L) can send specially crafted DNS traffic over the network that triggers an out-of-bounds read (CWE-125) and takes the DNS service down. Impact is availability-only: confidentiality and integrity are both rated None, scope is unchanged, and the CVSS 3.1 score is 6.5. No public exploit has been identified at time of analysis, and CISA's SSVC assessment records exploitation as none and automatable as no, so the practical priority is moderate and driven by the criticality of the DNS role rather than by observed attacks.

CVE-2026-88123 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows DNS Server role lets an attacker who already holds low-level authorized access on the network crash or degrade the DNS service, resulting in a denial of service. The flaw affects unpatched Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 builds, and because the DNS role runs on most Active Directory domain controllers, any environment with an exposed or reachable DNS service should treat those hosts as in scope. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) the attacker must be authenticated with low privileges, exploitation is over the network, and impact is limited to availability with no code execution or data disclosure; CISA's SSVC assessment records no observed exploitation and no public exploit code, so this is a moderate-severity, patch-cycle issue rather than an emergency.

CVE-2026-88122 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who is already authorized to send DNS messages to the service trigger a denial of service over the network, degrading or crashing the DNS service on affected Windows Server builds. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning it is remotely reachable without user interaction but requires at least low-level authorization - the attacker must be an authorized actor able to submit DNS queries, not an anonymous internet client - and the impact is confined to availability with no confidentiality or integrity loss. Affected systems are Windows Server 2012 through Windows Server 2025, including Server Core installations, that are actually running the DNS Server role; default workstation installs are not affected. Vendor patches are available for all affected builds, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording exploitation as none and the vulnerability as not automatable.

CVE-2026-87714 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Missing authorization checks in the Windows WebDAV component allow an attacker who already holds valid low-privilege credentials to bypass a security feature over the network, affecting only integrity (no confidentiality or availability impact). Microsoft rates this CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning exploitation is straightforward once an authenticated foothold exists but does not permit data theft or denial of service. Vendor fixes are available; at time of analysis there was no public exploit code and no confirmed active exploitation (not in CISA KEV).

CVE-2026-85821 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in the Windows Universal Disk Format (UDFS) file-system driver lets an authenticated local attacker read memory beyond the bounds of an allocated buffer by presenting a crafted UDF volume - typically a rigged ISO image, optical disc, or virtual/removable disk - for the kernel driver to mount and parse. The flaw is an out-of-bounds read (CWE-125) rated 6.5 MEDIUM; although the supplied CVSS vector advertises network reachability (AV:N), the file-system parsing path and the description's 'locally' wording indicate that local, authenticated access is required, so defenders should treat the vector as AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. Impact is bounded to confidentiality with no code execution or data tampering, no public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as 'none' and the attack as non-automatable, and vendor patches are available - together these signals keep real-world urgency moderate-to-low despite the MEDIUM score.

CVE-2026-85815 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read (CWE-125) in the Windows Device Association Service lets an authenticated, low-privileged local user read memory past the end of an allocated buffer and disclose its contents, producing a high confidentiality impact with no integrity or availability effect (CVSS 5.5, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The affected surface covers Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H2), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including Server Core installations, but exploitation requires an existing local account/session on the host because there is no network-facing vector and no user interaction is needed. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none and the flaw as not automatable, and patch availability from Microsoft makes this a moderate, low-urgency remediation item rather than an emergency one.

CVE-2026-85805 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

Security feature bypass in Windows PowerShell allows an unauthenticated attacker to defeat a security check, but the victim must actively run or open attacker-supplied content (UI:R), so it is not a hands-off remote exploit. Impact is integrity-only (C:N/I:H/A:N, CVSS 6.5); Microsoft has released patches, CISA SSVC rates exploitation as none and automatable as no, and no public exploit code was identified at time of analysis.

CVE-2026-85794 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Routing and Remote Access Service (RRAS) allows an attacker who already holds valid credentials for a low-privileged local account to read memory beyond the bounds of an allocated buffer and disclose information from the affected host; no user interaction is required. The exposure is narrowed considerably by two prerequisites: RRAS is a non-default role that must be installed and running, and exploitation requires local access plus low-privileged authentication, so there is no remote or unauthenticated path. Impact is confidentiality-only (high) with no integrity or availability effect, and no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and the activity as not automatable, making this a moderate, low-urgency issue rather than a top patching priority.

CVE-2026-85374 Oct 13, 19:21 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in Windows Installer allows an authenticated, low-privileged local user to disclose information from the affected host, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires the attacker to already hold a low-privileged local account and the ability to have Windows Installer (msiexec) process a crafted MSI package on that machine; the vulnerability cannot be triggered remotely or by an unauthenticated user, and no victim interaction is required. Impact is bounded to confidentiality - there is no code execution or privilege escalation from this flaw alone, CISA SSVC records exploitation as none, and no public exploit has been identified at time of analysis; a vendor patch is available.

CVE-2026-85337 Oct 13, 19:20 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Remote Desktop Client lets a malicious or compromised RDP server leak process memory, giving an unauthenticated attacker a network-based information disclosure path against any Windows host whose user connects to that server. The flaw is strictly client-side: the victim must initiate an outbound RDP session (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5), which is the main limiting factor, while confidentiality impact is rated High and no authentication, integrity, or availability impact is involved. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as "none" and automatable as "no", and Microsoft has published remediation through its Security Update Guide, making this a moderate-priority issue rather than a top-tier emergency.

CVE-2026-85336 Oct 13, 19:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds memory read in the Windows Device Association Service (DAS) allows a locally authenticated, low-privileged user on Windows 10, Windows 11 and Windows Server 2012 through 2025 to make the service return data past the end of an allocated buffer, disclosing memory contents. The vector (AV:L/PR:L/UI:N, C:H/I:N/A:N) confirms the attacker must already be able to execute code locally and needs no victim interaction, and no public exploit code has been identified at time of analysis; CISA's SSVC rates exploitation as 'none' with partial technical impact and non-automatable, so this is best characterised as a secondary primitive (for example an ASLR or memory-layout bypass) rather than a standalone compromise path. Microsoft has released vendor patches, and because DAS ships enabled by default on all supported Windows editions, every unpatched host in the listed build ranges carries the exposure.

CVE-2026-85331 Oct 13, 19:20 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in the Windows Device Association Service (DAS) lets an attacker who already holds valid low-privileged credentials on a target host read portions of the service's memory over the network, exposing potentially sensitive data. The flaw affects default installations of Windows 10, Windows 11 (23H2 through 26H2/26H1), Windows Server 2012 R2, 2016, 2019, 2022, and 2025 below their respective patched builds, and carries a CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), meaning confidentiality-only impact with no code execution, modification, or denial of service. Microsoft has released fixes and CISA's SSVC evaluation records no exploitation and no automatable exploitation at time of analysis, with no public exploit identified; the PR:L authentication prerequisite and read-only outcome materially reduce real-world urgency.

CVE-2026-85323 Oct 13, 19:20 MEDIUM PATCH This Month

Weak authentication in the Network Device Enrollment Service (NDES) component of Active Directory Certificate Services lets an authenticated, network-positioned attacker spoof the enrollment service and obtain or manipulate certificate enrollment data, with high confidentiality and integrity impact but no availability impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). Only Windows Server hosts on which the optional NDES role has been installed and exposed are affected - this is not a default Windows feature - and the high attack complexity means success depends on a specific condition outside the attacker's control rather than a single deterministic request. No public exploit code has been identified and the issue is not listed in CISA KEV, and a vendor patch is available from Microsoft.

CVE-2026-70244 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read (CWE-125) in the Windows DNS Server role lets an unauthenticated remote attacker disclose process memory contents over the network; per the CVSS vector (AV:N/PR:N/UI:R) exploitation is not fully autonomous, because the server must be induced to parse attacker-influenced DNS data - for example by resolving an attacker-controlled name or handling a crafted response - rather than being triggered by a single unsolicited packet. Impact is limited to confidentiality (C:H/I:N/A:N): the flaw yields a memory over-read and information disclosure, not remote code execution or service disruption, and the practical risk is highest for internet-exposed or recursive/forwarding DNS servers. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released patched builds for all listed Windows client and server versions, making this a moderate-priority information-disclosure issue that is removed by applying the Microsoft update.

CVE-2026-70166 Oct 13, 19:19 MEDIUM PATCH This Month

An out-of-bounds read in Windows DNS Server allows an authenticated, low-privileged attacker to cause a denial of service (DoS) over the network. The flaw affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 and Windows 10 Versions 1607 and 1809 when the DNS Server role is enabled; exploitation requires valid credentials (PR:L) but no user interaction. No public exploit code has been identified, and CISA SSVC rates exploitation as none, yielding a modest, non-urgent risk despite the network attack vector.

CVE-2026-70087 Oct 13, 19:19 MEDIUM PATCH This Month

Incorrect authorization in the Microsoft Windows DNS Server role allows a locally authenticated attacker with low privileges to bypass a DNS security feature and alter DNS resolution behavior on the affected host. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N), meaning it cannot be triggered remotely or by an unauthenticated actor - the attacker must already hold a foothold on the server - and its impact is limited to integrity, with no confidentiality or availability loss and no user interaction required. All supported Windows Server generations that host the DNS Server role are affected, from Windows Server 2012 through Windows Server 2025, along with the Windows 10 1607 and 1809 clients that ship the same DNS components; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no' (technical impact: partial), and no public exploit code was identified at time of analysis, so this is a genuine but moderate-priority hardening issue rather than an emergency.

CVE-2026-70085 Oct 13, 19:19 MEDIUM PATCH This Month

Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged attacker to tamper with DNS data or configuration, earning a CVSS 5.5 rating (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The flaw (CWE-862) affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installation variants, with integrity-only impact and no data disclosure or denial-of-service component. Microsoft has released a vendor patch per the MSRC update guide, and CISA's SSVC assessment records no known exploitation with no public exploit identified at time of analysis; because exploitation requires existing local credentials on the DNS server, real-world urgency is moderate rather than critical.

CVE-2026-70083 Oct 13, 19:19 MEDIUM PATCH This Month

Incorrect authorization in the Windows DNS Server role allows an attacker who already holds a low-privileged local account or interactive logon session on the DNS host to tamper with DNS data or service configuration, degrading integrity with no confidentiality or availability impact. Affected systems span Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including Server Core installations) plus Windows 10 versions 1607 and 1809, in each case below the vendor's patched build numbers. Microsoft has released a fix, and no public exploit code has been identified at time of analysis; the SSVC assessment records exploitation as 'none', automatable as 'no' and technical impact as 'partial', so this is a genuine but moderate-priority issue rather than a top-tier emergency.

CVE-2026-70074 Oct 13, 19:19 MEDIUM PATCH This Month

An out-of-bounds read in the Windows DNS component lets a locally authenticated, low-privileged attacker cause the service to read past the end of an allocated buffer and leak information from process memory, giving high confidentiality impact with no integrity or availability effect (CVSS 3.1 base 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires an attacker to already hold local, authenticated low-privileged access to an affected Windows host - there is no remote or network-triggerable path - and no public exploit code has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'. Affected builds span Windows Server 2012 through Windows Server 2025 and Windows 10 versions 1607 and 1809, and Microsoft has released fixed builds for each, making this a moderate, low-priority patching item rather than an urgent emergency.

CVE-2026-70071 Oct 13, 19:19 MEDIUM PATCH This Month

Improper verification of cryptographic signatures in the Windows DNS Server component lets an authenticated, low-privileged attacker who already has local access to the host tamper with data that the service is supposed to validate, with the impact confined to integrity (no loss of confidentiality or availability). Exploitation is local only (AV:L, PR:L, UI:N) and requires a signature-validating configuration to be in use for the tampering to have meaning, so this is a moderate, non-urgent issue rather than a remotely reachable emergency. No public exploit code exists and there is no evidence of active exploitation, and CISA's SSVC assessment records Exploitation as none and Automatable as no; Microsoft has published patched builds that resolve the flaw.

CVE-2026-70044 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read (CWE-125) in Microsoft's Windows Media Foundation allows a local attacker to disclose information by convincing a victim to open or process a specially crafted media file. Affected are unpatched Windows 10, Windows 11, and Windows Server editions up to the fixed build for each release - for example Windows 11 24H2 below 10.0.26100.9711, Windows 10 22H2 below 10.0.19044.7807, Windows Server 2022 below 10.0.20348.5761, and Windows Server 2012 R2 below 6.3.9600.23470. Exploitation requires no attacker privileges (PR:N) but is entirely contingent on victim user interaction (UI:R) with the malicious file, and there is no public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, and the impact is read-only information disclosure with no code execution or data tampering.

CVE-2026-70041 Oct 13, 19:19 MEDIUM PATCH This Month

Information disclosure in the Windows CD-ROM driver (cdrom.sys) lets an attacker who already holds a low-privileged local session on a Windows host read past the bounds of an allocated buffer in kernel memory, exposing data they should not be able to see. Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5), the flaw is local-only, requires prior authenticated access, needs no victim interaction, and is confined to confidentiality impact - it cannot alter data or crash the system, so remote and unauthenticated attackers cannot use it directly. No public exploit code and no confirmed active exploitation were identified at time of analysis, and Microsoft has released fixed builds across Windows 10/11 and Windows Server 2012 through 2025, making this a moderate, low-priority item despite the ubiquity of the affected platform.

CVE-2026-70025 Oct 13, 19:19 MEDIUM PATCH This Month

Denial of service in the Windows Netlogon service arises from a use-after-free memory corruption flaw that a network-positioned attacker holding valid low-privilege domain credentials can trigger against a domain controller's Netlogon RPC interface, crashing the service and disrupting domain authentication. Per the CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), exploitation requires authenticated low-privilege access (PR:L), needs no user interaction (UI:N), is gated by high attack complexity (AC:H) consistent with a race/timing-dependent memory reuse, and yields availability impact only (A:H) with no confidentiality or integrity loss and no system compromise. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with partial technical impact, making this a moderate, availability-only issue rather than a top-tier priority.

CVE-2026-69958 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

Code execution with full confidentiality, integrity and availability impact is achievable on unpatched Windows systems through a heap-based buffer overflow in the Windows Overlay Filter (WOF), but only for an attacker who already holds physical access to the target machine. The flaw carries a base score of 6.8 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): physical access is required, yet once obtained no authentication and no user interaction are needed and attack complexity is low, so any unattended, shared or physically exposed endpoint that processes attacker-supplied input through WOF is at risk. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none and automation as not feasible, but Microsoft has published a vendor fix and the technical impact is assessed as total, so the residual risk is concentrated in kiosks, lobby/plant-floor PCs, and other hands-on devices rather than in remotely reachable server fleets.

CVE-2026-69955 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Client for NFS (Services for NFS) allows an unauthenticated, network-positioned attacker to leak client memory contents when a victim connects to or mounts a share from an attacker-controlled NFS server that returns crafted protocol responses. Exploitation is narrow: the non-default optional 'Client for NFS' feature must be installed, the victim must initiate the connection (UI:R), and the impact is confidentiality-only with no code execution or data modification. There is no public exploit code and no confirmed active exploitation (SSVC Exploitation: none; not listed in CISA KEV), and Microsoft has shipped vendor updates, making this a moderate-severity information-disclosure issue to remediate on a normal patch cadence rather than an emergency.

CVE-2026-69954 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

An authenticated local attacker can trigger an out-of-bounds read (CWE-126) in the Windows Overlay Filter (WCIFS) driver and disclose the contents of adjacent kernel memory on affected Windows 10, Windows 11 and Windows Server builds. The flaw is only reachable from an existing interactive foothold on the host with at least low user privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) and results in confidentiality loss only, with no integrity or availability effect. There is no public exploit identified at time of analysis, CISA's SSVC rates exploitation as 'none' and the issue as non-automatable, and Microsoft has shipped fixed builds for all listed products.

CVE-2026-69940 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows Client for NFS (the optional Services for NFS client component) allows a remote attacker to leak contents of process memory from an affected Windows host, yielding information disclosure only with no code execution, integrity, or availability impact. Because the feature is not present in a default Windows installation, the exposed population is limited to hosts where the NFS client has been explicitly installed, and per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 6.5) exploitation also requires user interaction - the victim must initiate or be induced into connecting to or mounting an attacker-controlled or spoofed NFS resource, though no authentication is required on the target. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automatable 'no' and technical impact 'partial', and Microsoft has released a vendor patch.

CVE-2026-69902 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

Untrusted pointer dereference in the Windows NTFS file system driver allows a locally authenticated attacker who already holds elevated privileges on the host to execute code, with full impact to confidentiality, integrity, and availability of the affected system. Because the attack vector is local (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N) and low complexity (AC:L) once those prerequisites are met, the flaw functions as a post-compromise escalation and code-execution primitive rather than an initial-access or remote vector, and it cannot be triggered across the network. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and Microsoft has published fixed builds covering all affected Windows 10, Windows 11, and Windows Server platforms.

CVE-2026-108129 Oct 13, 19:18 MEDIUM PATCH Exploit Unlikely This Month

An out-of-bounds read in the Windows DNS Server role lets a remote attacker who already holds low-level authorization (PR:L) read past the bounds of a buffer and disclose information over the network - confidentiality is fully impacted (C:H) but there is no integrity or availability effect, and no code execution. Affected platforms span the supported Windows Server line (2012, 2012 R2, 2016, 2019, 2022, 2025) plus Windows 10 (1607 through 22H2) and Windows 11 (23H2 through 26H2), so domain controllers and any host with the DNS Server role installed are the primary exposure. No public exploit has been identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); Microsoft has released a vendor patch, and this is a moderate-priority issue rather than an emergency.

CVE-2026-108128 Oct 13, 19:18 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Microsoft Windows DNS Server role lets an attacker who already holds some level of authorization cause the service to read past the bounds of an allocated buffer and return that memory content over the network, disclosing information (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The flaw only matters where the DNS Server role is installed - standard on domain controllers and dedicated DNS infrastructure, but not enabled by default on client Windows - and per the PR:L vector the attacker must already be an authenticated/authorized principal, so this is not an unauthenticated remote bug. There is no public exploit identified at time of analysis, CISA SSVC records Exploitation=none with Automatable=no, and vendor patches are available for every affected build, so this is a moderate-priority information-disclosure issue rather than an emergency; note that although confidentiality impact is rated High, integrity and availability are untouched.

CVE-2026-108127 Oct 13, 19:18 MEDIUM PATCH Exploit Unlikely This Month

Information disclosure in Microsoft Windows DNS Server stems from an out-of-bounds read (CWE-125) that an authorized, network-positioned attacker can trigger to leak memory contents over the network. The CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms remote reachability with low attack complexity, but PR:L indicates the attacker must already hold some authorized level of interaction with the DNS service rather than being fully anonymous; the impact is confined to confidentiality, with no integrity or availability effects, so DNS records cannot be altered and the service cannot be crashed through this flaw alone. Only hosts running the Windows DNS Server role are exposed - a server-side feature that is not present on default client installations - and no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none, automatable: no, technical impact: partial); vendor patches are available.

CVE-2026-103560 Oct 13, 19:17 MEDIUM PATCH Exploit Unlikely This Month

Missing authorization checks in the Windows Server DNS Server role allow a locally authenticated, low-privileged user to tamper with DNS configuration or zone data on affected hosts, yielding a high-integrity impact with no confidentiality or availability effect. Exploitation is constrained: the attacker must already hold local access to a server running the DNS Server role (Windows Server 2012 through 2025, including Server Core installations), and the issue cannot be triggered remotely or by an unauthenticated user. Microsoft has released vendor patches, and no public exploit code or confirmed active exploitation was identified at time of analysis; at CVSS 5.5 this is a moderate-severity integrity flaw whose practical risk is dominated by the prior-access requirement.

CVE-2026-78516 Sep 08, 18:20 MEDIUM PATCH This Month

Buffer over-read (CWE-126) in the Windows Storage component exposes adjacent memory contents to a physically-present attacker across virtually the entire supported Windows product line, from Server 2012 through Windows 11 25H2 and Server 2025. The CVSS vector (AV:P/UI:R) confirms exploitation requires both physical access to the target machine and user interaction to trigger the vulnerable code path, sharply constraining real-world attack surface. No public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis; a vendor-released patch is available via the Microsoft Security Response Center.

CVE-2026-78508 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows CD-ROM kernel-mode driver exposes kernel memory contents to an attacker with physical access across virtually every supported Windows release from Server 2012 through Windows 11 Version 26H1. The flaw (CWE-125) allows kernel memory disclosure - potentially including credentials or cryptographic material - when a crafted disc interaction or malformed IOCTL triggers a read beyond the intended buffer boundary. Microsoft has released patches; no public exploit code exists and the vulnerability is not listed in CISA KEV.

CVE-2026-78453 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Integer underflow (CWE-191) in the Microsoft Windows SCSI Class System File enables remote unauthenticated attackers to disclose kernel-level information when a user interacts with a crafted resource, affecting all major Windows desktop and server releases from Server 2012 through Windows 11 26H1. The out-of-bounds read condition triggered by the wraparound arithmetic can expose high-confidentiality memory contents (C:H) with no integrity or availability impact. No public exploit has been identified at time of analysis, and the CISA SSVC framework rates exploitation status as none and technical impact as partial, consistent with a disclosure-only profile.

CVE-2026-77892 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Privilege escalation in Windows Boot Manager allows an unauthorized attacker with physical access to achieve full pre-OS system compromise, yielding high confidentiality, integrity, and availability impact across a sweeping range of Windows desktop and server editions. The root cause is a protection mechanism failure (CWE-693) in the boot-time security stack - consistent with a Secure Boot or early-launch integrity bypass - that an adversary can exploit without any prior authentication or system privileges once physical access is obtained. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

CVE-2026-77891 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Local code execution in Windows DHCP Server affects all major Windows Server versions from 2012 through 2025, exploitable by an authorized attacker with high-level local privileges. The vulnerability stems from an out-of-bounds read (CWE-125) in the DHCP Server role that, despite its read-class root cause, is confirmed by Microsoft to enable code execution - suggesting the OOB read yields a usable memory corruption primitive. Exploitation is substantially constrained by requiring local access, high attack complexity, and high privileges (PR:H/AC:H/AV:L), and no public exploit or active exploitation has been identified.

CVE-2026-77887 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read (CWE-125) in the Windows DHCP Server service permits a locally present, highly privileged attacker to achieve code execution on the host system. The CVSS vector (AV:L/AC:H/PR:H) confirms this is not a remote or unauthenticated threat - exploitation requires an authorized administrator already present on the system with the DHCP Server role installed and under specific attack conditions. Microsoft has released patches covering Windows Server 2012 through 2025; no public exploit or active exploitation has been identified at time of analysis.

CVE-2026-77492 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows Storage Port Driver (storport.sys) allows a local attacker with low-privilege credentials to disclose contents of kernel memory. The flaw spans the full supported Windows ecosystem - from Server 2012 through Server 2025 and Windows 10/11 through version 26H1 - making the attack surface exceptionally broad. No public exploit or CISA KEV listing exists at time of analysis; however, the C:H rating indicates the leaked kernel data is potentially sensitive enough to assist KASLR-bypass chains targeting full privilege escalation.

CVE-2026-77491 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in Windows GDI (Graphics Device Interface) exposes sensitive memory contents to local attackers across a wide range of Microsoft Windows desktop and server releases. When a user opens or previews a specially crafted file, the GDI subsystem reads beyond its intended buffer boundary (CWE-125), potentially leaking heap data or kernel address space layout pointers that can serve as ASLR-bypass primitives in chained exploit scenarios. No public exploit code has been identified and no CISA KEV listing exists; Microsoft has released patched builds for all affected versions.

CVE-2026-73019 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Security feature bypass in Windows URL Moniker enables a remote, unauthenticated attacker to circumvent URL-based security controls across virtually all supported Windows versions from Server 2012 through Windows 11 26H1. Rooted in improper resolution of path equivalence (CWE-41), the flaw allows crafted URL representations to evade security filters that would otherwise block access to restricted resources. Exploitation requires user interaction per the CVSS vector (UI:R) and yields only limited confidentiality impact (C:L) with no integrity or availability effects; no public exploit code has been identified at time of analysis.

CVE-2026-72985 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Privilege escalation to SYSTEM level is achievable in Windows Volume Shadow Copy Service (VSS) across a broad range of Microsoft Windows and Windows Server releases, from Server 2012 through Windows 11 25H2 and Server 2025. The root cause is a heap-based buffer overflow (CWE-122) exploitable by an unauthenticated attacker with physical access to the target machine, yielding full C:H/I:H/A:H impact. SSVC assessment confirms no current exploitation and a non-automatable attack path; no public exploit identified at time of analysis.

CVE-2026-72966 Sep 08, 18:20 MEDIUM PATCH This Month

Tampering in the Windows Remote Access Connection Manager (RASMAN) service allows a local low-privileged authenticated user to modify protected system state without proper authorization checks. Affecting a broad swath of Windows releases - from Server 2012 R2 through Windows 11 25H2 and Server 2025 - the root cause is CWE-862 (Missing Authorization): RASMAN performs sensitive operations without verifying the caller's entitlement to execute them. Microsoft has released patches across all affected product lines; no public exploit has been identified at time of analysis.

CVE-2026-72942 Sep 08, 18:20 MEDIUM PATCH This Month

Out-of-bounds read in Spaceport.sys, the Windows Storage Spaces kernel-mode driver, enables network-accessible information disclosure across Windows 10, 11, and Server editions from 2012 R2 through 2025. Exploitation requires user interaction (UI:R per CVSS vector), meaning an attacker must induce a victim to access malicious content - such as a crafted remote storage resource - to trigger the read beyond the allocated buffer and leak kernel memory. Microsoft has released patches for all affected versions; no public exploit code has been identified at time of analysis.

CVE-2026-72939 Sep 08, 18:20 MEDIUM PATCH This Month

Null pointer dereference in Windows Routing and Remote Access Service (RRAS) enables a network-authenticated attacker with low privileges to crash the service and cause denial of service across all major Windows and Windows Server releases. The vulnerability is triggered over the network without user interaction, making it suitable for disrupting VPN, dial-up, or routing services that rely on RRAS. No public exploit or active exploitation has been identified at time of analysis; a vendor-released patch is available.

CVE-2026-72937 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows Storage Port Driver allows a low-privileged local attacker to disclose kernel memory contents on a wide range of Windows client and server releases. The driver mishandles a crafted request, reading beyond an allocated buffer boundary (CWE-125), exposing high-confidentiality data such as kernel addresses or sensitive in-memory data. No active exploitation or public proof-of-concept has been identified; Microsoft has released patches across all affected Windows versions via the MSRC update guide.

CVE-2026-72935 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows NTFS kernel driver allows a locally authorized attacker to escalate privileges, achieving full confidentiality, integrity, and availability impact on affected systems. The flaw spans virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025, making the patch surface exceptionally broad. No public exploit has been identified at time of analysis, and Microsoft has released corrective updates across all affected build branches.

CVE-2026-72931 Sep 08, 18:20 MEDIUM PATCH This Month

Local denial of service in Windows Secure Socket Tunneling Protocol (SSTP) stems from a missing resource release after effective lifetime (CWE-772), allowing an authenticated local attacker to exhaust resources and cause service unavailability. The flaw spans a broad range of Windows and Windows Server releases from Server 2012 through Windows 11 26H1 and Server 2025, confirmed by Microsoft's security response center. No public exploit or active exploitation has been identified; vendor patches are available via the standard Windows Update cycle.

CVE-2026-71350 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, allows an attacker with physical access to execute arbitrary code at kernel privilege across a wide range of Windows 10, Windows 11, and Windows Server releases. The vulnerability (CWE-122) results in full confidentiality, integrity, and availability compromise of the affected system upon successful exploitation. Microsoft has released patches; no public exploit has been identified at time of analysis and CISA KEV listing is absent.

CVE-2026-71349 Sep 08, 18:20 MEDIUM PATCH This Month

Heap-based buffer overflow in Windows Spaceport.sys, the kernel-mode Storage Spaces port driver, enables an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege level. The vulnerability spans virtually all supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1/25H2. No public exploit has been identified at time of analysis; a vendor-released patch is available via the Microsoft Update Catalog.

CVE-2026-71348 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow in the Windows Storage Spaces kernel driver (Spaceport.sys) enables kernel-mode code execution through a physical attack, affecting nearly every supported Windows desktop and server release. The flaw carries a CVSS 3.1 score of 6.8 with a physical attack vector, meaning an adversary must have hands-on access to the target hardware to trigger the overflow. Microsoft has issued patches covering Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11 26H2; no public exploit or CISA KEV listing has been identified at time of analysis.

CVE-2026-71341 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows Partition Management Driver exposes sensitive kernel memory to locally authenticated low-privileged users across a wide swath of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Exploitation is strictly local and requires an authorized user account, limiting blast radius to post-compromise or insider-threat scenarios. No public exploit code exists and SSVC classifies exploitation status as none, making this a lower operational priority despite the formally high confidentiality impact rating.

CVE-2026-71339 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow in Windows Installer (msiexec) enables local privilege escalation across a broad range of Microsoft Windows client and server releases. An attacker with high-privileged local access can exploit this CWE-122 flaw to achieve full system-level code execution - compromising confidentiality, integrity, and availability - making it a post-exploitation escalation primitive. Vendor-released patches are available; no public exploit code or CISA KEV listing is identified at time of analysis.

CVE-2026-71338 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Privilege escalation via a double-free memory corruption bug in Windows Failover Cluster affects multiple Windows Server editions from Server 2012 through Server 2025, as well as Windows 10 versions 1607 and 1809. An authorized local attacker already holding high privileges can exploit heap corruption triggered by the double-free condition to achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit code has been identified and no CISA KEV listing exists; a vendor-released patch is available through the Microsoft Security Response Center.

CVE-2026-71329 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow in the Windows NTFS kernel driver allows an unauthenticated attacker with physical access to execute arbitrary code at kernel privilege on affected systems. The vulnerability spans nearly every supported Windows release from Server 2012 through Windows 11 26H1 and Windows Server 2025, and is triggered when the NTFS driver processes a specially crafted volume attached by an adversary. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.

CVE-2026-70582 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Privilege escalation in Windows Management Instrumentation (WMI) on Windows 10, Windows 11, and Windows Server 2012 through 2025 allows a locally authenticated attacker with high-privilege access to gain further elevated system permissions by exploiting a race condition in concurrent shared-resource handling. The flaw spans a broad Windows version range-from the legacy Server 2012 family through Windows 11 26H1 and Server 2025-indicating a long-standing WMI component is affected. No public exploit code is identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

CVE-2026-70290 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Uninitialized kernel memory exposure in the Windows Win32 Kernel Subsystem allows a local low-privileged attacker to read sensitive memory contents from the kernel address space. Exploitation requires only a valid local account and no user interaction, making it accessible to any authenticated user on affected Windows endpoints and servers. The vulnerability spans an exceptionally wide range of Microsoft Windows releases - from Windows 10 version 1607 and Windows Server 2012 through the latest Windows 11 and Windows Server 2025 builds - and is remediated via the July 2026 Microsoft security update cycle. No public exploit or KEV listing has been identified at time of analysis.

CVE-2026-70145 Sep 08, 18:20 MEDIUM PATCH Exploit Unlikely This Month

Out-of-bounds read in the Windows Search Component allows a local low-privileged authenticated user to disclose sensitive memory contents on the affected host. The flaw (CWE-125) spans an exceptionally broad Windows footprint, covering every major release from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released patches across all affected branches; no active exploitation or public proof-of-concept has been identified at time of analysis.

CVE-2026-70091 Sep 08, 18:20 MEDIUM PATCH This Month

Denial-of-service in Windows DNS Server allows unauthenticated network attackers to crash or hang the DNS service via a race condition in concurrent request handling. The vulnerability spans a broad range of Windows Server versions from Server 2012 through Server 2025, making it relevant across many enterprise environments. No public exploit exists and SSVC rates exploitation as none with non-automatable attack path, but successful exploitation would disrupt name resolution for all clients depending on the affected server.

CVE-2026-69895 Sep 08, 18:20 MEDIUM PATCH This Month

Out-of-bounds read in Windows Spaceport.sys (the kernel-mode port driver for the Windows Storage Spaces subsystem) allows a locally authenticated, low-privileged attacker to disclose kernel memory contents under high-complexity conditions. The vulnerability spans virtually all supported Windows releases - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - making the patch surface extremely wide. Microsoft has released fixes for all affected versions; no public exploit or CISA KEV listing has been identified at time of analysis.

CVE-2026-69878 Sep 08, 18:19 MEDIUM PATCH Exploit Unlikely This Month

Heap-based buffer overflow (CWE-122) in the Windows DHCP Server service enables an authorized local attacker with administrative privileges to execute arbitrary code on affected Windows Server systems. The vulnerability spans Windows Server 2012 through 2025 as well as Windows 10 versions 1607 and 1809, and requires that the DHCP Server role be installed and running. Microsoft has released patches via the standard Windows Update channel; no public exploit code or active exploitation has been identified at time of analysis.

CVE-2026-69853 Sep 08, 18:19 MEDIUM PATCH This Month

Uninitialized kernel memory in Win32K (win32k.sys) enables local attackers with standard user privileges to read sensitive kernel memory contents on affected Windows systems. The vulnerability spans virtually all currently supported Windows client and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 25H2/26H1. No public exploit identified at time of analysis, though Win32K info-leaks of this class are routinely chained with privilege escalation exploits to defeat kernel address space layout randomization (KASLR).

CVE-2026-69839 Sep 08, 18:19 MEDIUM PATCH This Month

Denial of service in the Windows iSCSI Target Service affects authenticated network users on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. An authorized low-privileged attacker can send a crafted network request that triggers an uncaught exception (CWE-248) in the iSCSI Target Service process, causing the service to terminate and disrupting storage connectivity for all iSCSI initiators connected to that target. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected Windows versions.

CVE-2026-69832 Sep 08, 18:19 MEDIUM PATCH Exploit Likely This Month

Sensitive kernel information is exposed to low-privileged local users through a CWE-497 flaw in the Windows Win32K graphics subsystem, confirmed by Microsoft's own security team (secure@microsoft.com). The scope-changed CVSS vector (S:C/C:H) indicates the leaked data originates from the kernel security boundary, making this a classic KASLR-defeat primitive that threat actors chain with separate privilege-escalation exploits to achieve full system compromise. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; vendor patches covering every supported Windows release are available.

CVE-2026-69808 Sep 08, 18:19 MEDIUM PATCH This Month

Out-of-bounds read in the Windows Win32K kernel graphics driver allows a local, low-privileged user to disclose sensitive kernel memory contents without requiring elevated rights or user interaction. The flaw spans a wide range of Microsoft Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025, making the exposure surface broad. Microsoft has released patched builds through its standard update cycle; no public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.

CVE-2026-69770 Sep 08, 18:19 MEDIUM PATCH This Month

Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. Microsoft has released patches for all affected versions; no public exploit or active exploitation has been identified at time of analysis.

CVE-2026-69723 Sep 08, 18:19 MEDIUM PATCH Exploit Likely This Month

Windows Kernel information disclosure affects virtually the entire active Windows ecosystem - from Server 2012 through Windows 11 26H1 and Server 2025 - enabling a low-privileged network attacker to obtain sensitive system-level information when a target user is induced to take a specific action. The flaw (CWE-497) involves the kernel exposing restricted internal data to an unauthorized control sphere over the network, producing high confidentiality impact with no integrity or availability effect. Microsoft has released patches across all affected versions; no public exploit code has been identified at time of analysis.

CVE-2026-69713 Sep 08, 18:19 MEDIUM PATCH Exploit Unlikely This Month

Windows Secure Boot security feature bypass affects a broad range of Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. The root cause is a dependency on a vulnerable third-party component embedded within the Secure Boot trust chain, enabling a locally present, high-privileged attacker to bypass boot integrity enforcement. No public exploit or CISA KEV listing is associated with this vulnerability at time of analysis; patch versions are confirmed available across all affected Windows release trains.

CVE-2026-69684 Sep 08, 18:19 MEDIUM PATCH This Month

Windows Error Reporting (WER) on multiple Windows versions leaks sensitive information into generated error messages that a locally authenticated low-privileged user can read. The vulnerability stems from CWE-209 (sensitive data embedded in diagnostic output) and requires only local access with standard user privileges to exploit. Microsoft has released patches across all affected Windows builds; no public exploit code or active exploitation has been identified at time of analysis.